I use a cloud service for my off-site backup, and all my files are encrypted. But I am wondering whether to enable filename encryption or not. Are there any security advantages to be gained by encrypting the filenames as well?
The downside to encrypted filenames is that it leaves the cloud web browser utterly useless.
If filenames are sensitive then encrypt them, if not then don't. Eg. are you happy for staff at your backup service or possibly others (in the case of breach) to see Secret Government Contract bid.docx listed?
That's all it comes down to. A cost/benefit analysis for your particular usage. You should also find out if the client software can restore the original folder structure and filenames upon recovery from backup. Consider if this original information stored encrypted in the cloud and where the decryption key is kept.
The security advantage would be that encrypting the filenames would somewhat obscure the contents. Unfortunately, there are still other tells (like file size and directory structure) that would give clues as to which files are and aren't valuable to a potential attacker. Overall, it's security by obscurity, which isn't worth very much.
If anyone needs to use the web interface, I'd say you shouldn't encrypt the filenames.
If no one needs to use the web interface, then your choice doesn't really make a difference either way.
