0

I am using duplicity to back up files to my external hard drive. I see that I have different options of encrypting my backup:

  • Encrypt backup disk (filesystem-level encryption)
  • Encrypt backup (Duplicity signes the backup with GnuPG)
  • Both

Is there a "way to go"? Obviously using both seems "safest", but it seems a bit overkill.

Improve this question

1 Answer 1

Reset to default
1

It depends upon your level of paranoia.

Short answer: all 3**

Minimal answer: encrypt the backups individually

Longer answer: The FS-level encryption and file-level (or backup-level) encryption are protecting against two different (although overlapping) attacks. The FS-level is protecting against the unauthorized mounting of the backup drive; whether that's the physical theft of the drive, or the attaching of the drive to your system when you do not intend for that to happen. The FS-level really only provides protection if you are only mounting the disk when you are either performing a backup or restoring data. Otherwise, if you leave it mounted to the OS, the backup files are available to whomever has access to the machine they are mounted.

The file-level encryption protects your files for unauthorized reading whether they are still on the drive or not. So in the case that the backups are exfiltrated from the drive, they are still unreadable w/o serious effort. Hence, at a bare minimum, you should encrypt the backups.

** There's actually a 3rd level of encryption you can have, which would be at the physical disk layer. This seems to be a growing feature among SSD drives. In many respects, the Disk-provided encryption is somewhat redundant to the FS-level encryption.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .