Given a (TrueCrypt) encrypted volume on one device A, what is the more secure way to back it up via a VPN connection to the physically far away device B?
- Backup the data: Requires the volume to be mounted on both devices, which a physical intruder could abuse to obtain one of them while the container is open, thus rendering the encryption useless. On the other hand, an incremental backup is easy. The transmission itself should of course still be secured...
- Backup the container: No device requires the containers to remain open. However, unless small file changes only change small portions of the container and these changes are tracked, this quickly involves a lot of unnecessary data traffic
- Backup individually encrypted files instead (not using TrueCrypt but e.g. encFs): Seems to eliminate the disadvantages of the other two methods. But since the encryption should be bound to one single passphrase/keyfile/... this increases the risk of a known-plaintext attack, should too many trivial files happen to be encrypted.
So, is there the secure backup solution?