Hot answers tagged

160

I like to store mine on paper. Using a JavaScript (read: offline) QR code generator, I create an image of my private key in ASCII armoured form, then print this off. Note alongside it the key ID and store it in a physically secure location. Here's some that should work for you no matter what operating system you use, as long as you have a browser that ...


50

On the days when my paranoia is like a ripe tomato, begging me to pick it, I split the private key (naturally it is already passphrase-protected) in half, then make a 3rd string by XOR-ing them together. Then I use simple password encryption (gpg --symmetric) on each string, and put each on a remote server on a different continent. Ideally, each remote ...


43

I'm not sure about Google Drive, but Dropbox provides a way to recover previous file versions, a feature that wouldn't be impacted by the ransomware, since it relies on a file copies on the Dropbox servers. So it'd certainly be a way of protecting your data. However, recovering everything over your internet connection is a relatively slow process. ...


38

If the ransomware gains administrator access to your computer then it can damage any backups that the Windows machine may have created on that computer. If the ransomware only acquires non-administrator access (i.e. you use a non-admin account for web-browsing) then those backups will be safe. The best thing is to back up to a removable storage device. (...


28

This is not what I currently use, but I am thinking about it: Encrypt the private key with very long symmetric encryption key Use Shamir's Secret Sharing to split the symmetric encryption key to 7 pieces (like Voldemort), require at least 5 shares to merge successfully. Figure out where to put 7 secret backups, some ideas: media card in a safe at home ...


26

I haven't thought through the details, but if a secure hash of the file content were used as the key then any (and only) clients who "knew the hash" would be able to access the content. Essentially the cloud storage would act as a collective partial (very sparse, in fact) rainbow table for the hashing function, allowing it to be "reversed". From the ...


22

The commercial ad you link to, and the company web site, are really short on information; and waving "20 patents" as a proof of competence is weird: patents do not prove that the technology is good, only that there are some people who staked a few thousand dollars on the idea that the technology will sell well. Let's see if there is a way to make these ...


21

Simple, cheap and relatively scalable solution (Although I'm aware it has nothing with online storage to do) I have two USB drives that I rotate regularly (you can add a reminder in your calendar if you're afraid to do so). You can use one of the many synchronization tools to choose which folders should be copied, I use Allway Sync. One of the drive is ...


19

On-site storage Fireproof safe/cabinet in a access controlled environment is often considered safe enough, It is manual labor to actually put the drives/tapes into the container. Example: Attached fireproof media container. An example here is SentrySafe. A cheaper example is ioSafe. Site redundancy. When you already have site redundancy for your ...


18

Likely the best option in this kind of scenario is to record the password/passphrase in a physically secure location (e.g. bank vault, safe deposit box). Relying on human memory to record this kind of information for 10+ years is an extremely bad idea. For example the person who knows the passphrase leaves the comapny/gets hit by a bus/forgets it. Writing ...


17

Backing up the TrueCrypt container means that you'll end with a timeline of your encrypted volume, and all of those versions share the same key. Having different versions of the container with the same key gives the adversary two advantages: Information leakage: The adversary will know which sectors of the volume changed. and, as a consequence, a compromise ...


16

The most sensible approach is to assume you cant rely on their privacy - it isn't their responsibility, although there are some services whose selling point is securing this data. If you take that stance, as long as you encrypt all data before it goes to the cloud you can be safe (decide on what level of encryption you need in order to be safe) This ...


16

Bruce Schneier touched on the subject in May http://www.schneier.com/blog/archives/2011/05/dropbox_securit.html related to the Dropbox problem of that week. TechRepublic offers a great 7 page white paper on the subject for the price of an e-mail sign up at http://www.techrepublic.com/whitepapers/side-channels-in-cloud-services-the-case-of-deduplication-in-...


16

One option is to encrypt your key using a passphrase, and store the encrypted key on a cloud service. I have the key on my laptop (hardware encrypted drive) and on a Truecrypt container on an external hard drive as backup. Ok, it's not zero risk of data loss, but it's down to a level that is acceptable to me.


16

First assumption: The backup key is saved on WhatsApp servers too. Otherwise a local phone to phone backup would not work? TL;DR: Yes, after some investigation, this seems to be the case. Secondary devices The protocol is quite complicated and not limited to WhatsApp, but works generally like this; The phone that uses chat app is called the first device. ...


15

At the time of writing, Dropbox would be a good way to mitigate ransomware attacks because a 30 day version history of file changes is kept on their servers (even on the free tier). This, depending on the volume of data, requires a fast internet connection for both upload and download for it to be effective. However, (big caveat) it wouldn't take much for ...


15

What would you recommend as backup strategy to avoid Ransomware? Read Only Storage The simplest solution covers 90% of the average person's data preservation needs: store your old data in a read-only format. How much of your data is old tax information, resources from past schools/jobs, photos from vacations, or any other type of information that isn't ...


14

For the sake of having some fun, I'm going to answer this question exactly wrong. Just to get some practice in pointy haired boss thinking. If this isn't appreciated I have no doubt a moderator will delete it and threaten me. First, have only one person responsible for backups, ever. This way when anything goes wrong you know who to blame. Next, have ...


14

You can keep your private key in a flash drive and keep this drive in a locker. Also, ensure that you don't use this flash drive for activities which might cause infecting it with some malware.


14

It's kind of scary that only one answer here mentions the verification of the backups so I felt the urge to add this answer: Whatever you chose as a backup strategy: Your backups are worth absolutely nothing if you don't have a working and well tested verification mechanism to check the integrity of the files. It's just a matter of time until ransomware ...


14

The System Volume Information folder only contains files backed up by System Restore. That is, it won't protect your personal files should they get overwritten by malware, it will only protect Windows system files. Additionally, although you cannot by default get access to this folder, if you were to take ownership of the folder as administrator (or with ...


13

I would say no its not suitable for storing criticial information, From the sound of their terms Google essentially owns everyting you upload as well as anything derivitive of your data as well. Here is an excerpt from the verge.com explaining the differences of the 3 major players, notice Google is very liberal with what they can do with your data. ...


13

You should never use OpenSSL's command line utility for general purpose encryption. It is actually designed only as a test of the library's internal encryption routines. Because of this, there are a few problems inherent in using it when real confidentiality and integrity are needed: You will be vulnerable to malleability attacks, as CBC mode is ...


11

When trying to access the content of a hard-drive, you have to use the interface provided by said hard-drive. It usually comes with a firmware. Currently, it is stated that this firmware will not allow data to be read without providing the correct password and that in case of 10 failed attempts, the data would be deleted. To circumvent the restriction, ...


11

I feel like random people on the internet are not going to be able to answer this for you. This is a business decision. How valuable is the data? What is the risk of loss / corruption vs the cost of more disk space? Imagine your worst disaster-recovery scenario, how far back would you need to go to get a clean snapshot? I certainly can't answer any of this ...


10

Will the created containers still be bitwise comparable? No. Veracrypt stores different containers with different encryption keys, even if you use the same password. So the containers won't be bitwise identical. You'll need to open the container and compare the files rather than compare the container. How robust will the containers be against data loss, ...


9

Consider this from an Information Management or Information Assurance question rather than an Information Protection question. To the question if a service provider's level of security is "safe" (sufficient and appropriate), the answer is YES and NO - depending on the level of protection the specific information requires. My suggestion is you create three ...


9

A backup, if there is one, takes time to get restored, if it can be. In other words: Not every company has good backup practices. Considering that, as noted in the security investigation, UBS had other poor security practices it may not be surprising if they didn't have good backups. Even if a backup has been made it takes time to restore. During this time ...


9

In addition to the other good answers here, I'd like to point you to the following two academic papers, which were published recently: Martin Mulazzani, Sebastian Schrittwieser, Manuel Leithner, Markus Huber, and Edgar Weippl, Dark Clouds on the Horizon: Using Cloud Storage as Attack Vector and Online Slack Space, Usenix Security 2011. This paper describes ...


9

Nothing can prevent physical items being stolen by a sufficiently determined adversary; even the British crown jewels have gone AWOL over the years, and they live in the Tower of London. What mitigates the risk, for me, is encrypting my backups. Most enterprise-grade backup software, including the excellent bacula, allow the encryption of backups. Once ...


Only top voted, non community-wiki answers of a minimum length are eligible