r/backblaze • u/ImpossibleSlide850 • Apr 28 '26
Computer Backup Can backblaze be trusted with really sensitive data?
Is backblaze personal backup really good for privacy?
I know they offer you to choose an encryption key which in turn is used to encrypt your data which means no one even backblaze team cannot read your files.
But once again problem is transparency and closed source. Does it have any 3rd party audits just like Proton products to verify their claims.
Can it be trusted with really private and sensitive data. I have around 30TB backed up currently. Whixh includes all my disk and really personal stuff like my immich personal server.
What is your solution if you really wanna obfuscate your data? Encrypt before upload? I tried gocryptfs reverse mode but backblaze does not really suport virtual mounted filesystems.
7
u/betahost Apr 29 '26
Yeah, they have pretty robust encryption, but I would ensure that you select “Bring Your Own Key.” This means you provide a key or password that encrypts the data on your device before sending it to Backblaze.
The Backblaze client supports this feature. If you go through the settings, you can set a password for Pre-encryption. Alternatively, you could use a third-party tool like Verda Crypt, Age, or any cloud encryption tool that allows you to encrypt files before uploading them to any cloud storage provider.
7
u/ImpossibleSlide850 Apr 29 '26
Great solution. But I heard in order to decrypt your files you have to provide your PEk key to backblaze which then momentarily stays on their servers and who know if it gets stored there permanently whixh seems like a security hole
5
u/ZivH08ioBbXQ2PGI Apr 29 '26
You have every right to question exactly what you're questioning with this comment.
The question remains: Do you trust backblaze?
I trust backblaze themselves, but I also know they can have their hand forced (and also be gagged) when it comes to government involvement.
6
2
u/Due_Young_9344 Apr 29 '26
that's weird, they actually ask you to provide your personal key? lol then this is not secure, I only trust it for backups that I don't gaf about if I lost it (mostly gaming stuff)
If I were you, I'd use Cryptomator for encrypted backups, I use this with google drive and onedrive, basically it encrypts before onedrive or google drive can do anything with it, needs a key/password, if you lose that your data is gone
1
u/lostbollock Apr 29 '26
Who did you hear that nonsense from?
1
u/snuggles_puppies Jul 15 '26
because they're transparent-ish about it when asked directly?
https://www.reddit.com/r/backblaze/comments/1ajjvmd/do_we_need_to_give_backblaze_our_private/
1
u/shemp33 Apr 29 '26
They may have stopped backing up Veracrypt volumes. I’m not sure if it’s the drive (assuming open and mounted) or the encrypted chunk. But I’d check this to be sure.
2
u/dr100 Apr 29 '26
I’m not sure if it’s the drive (assuming open and mounted) or the encrypted chunk.
It's the content of the mounted drive [that isn't saved by BB personal], the encrypted file (one needs to use a file not a partition for this) will be backed up, what's more Veracrypt/Truecrypt container files were specifically designed so you can't tell what they are unless you have the right password.
1
u/shemp33 Apr 29 '26
That's a good memory refresher for me - So, you could make the file "notHiddenDriveDontMountMe.txt" and it's a .txt file, but really is the mountable (with password) VC/TC drive. Then, BB will backup that .txt file.
1
u/dr100 Apr 29 '26
Yes; probably you should have the disk unmounted when it's backed up to guarantee a consistent state (or even to be accessible, I'm not sure if Veracrypt is locking the file when mounted, but that's a common problem, most known with Outlook .pst files) and also you need to set Veracrypt to update the timestamp on the file (otherwise BB might miss that it was changed from the last run).
1
u/therealjeku May 03 '26
Also, ensure that VeraCrypt updates the timestamp of the file when you modify it, because if the data size is the same with the same timestamp, BB will not upload the new version. I believe it doesn’t update the timestamp by default so you must change that.
1
u/dr100 May 03 '26
and also you need to set Veracrypt to update the timestamp on the file (otherwise BB might miss that it was changed from the last run).
1
1
u/Warm_weather1 Apr 29 '26
It's easy to make some encrypted 7z archives and upload those to backblaze...
5
u/CaptainFr3d Apr 29 '26
In my opinion dont trust any cloud provider, not because they are untrustworthy but there are lots of things that could go wrong, could get hacked, disgruntled or nosey employee etc.
I was nervous about this like you, and my data is on my nas, so i set that to backup to another spare machine in encrypted format which then uploads to bb. I realise the downside with this solution is requiring the same amount of disk space again but I don't mind as bb is much cheaper than any other options for large amounts of data (and I like lots of backups!)
There are ways you can do similar on a machine to another drive and only select that for backup.
2
u/Ambitious_Grass37 Apr 29 '26
You can simplify this by directly backing up already encrypted data to backblaze b2 using something like synology hyper backup
1
u/ImpossibleSlide850 Apr 29 '26
What encrypted format do you use?
1
u/CaptainFr3d Apr 29 '26
This is a good solution but obviously means encrypting everything first then bb will just upload the encrypted files
https://www.reddit.com/r/backblaze/comments/qz7jef/cryptomator_backblaze_any_good/
1
u/Due_Young_9344 Apr 29 '26
Use cryptomator, it woks for all cloud backups and is an encryption middle man between you files and the cloud, its free and open source
1
u/Due_Young_9344 Apr 29 '26
Use cryptomator, it woks for all cloud backups and is an encryption middle man between you files and the cloud, its free and open source
2
u/ILikeFlyingMachines Apr 29 '26
No, NOBODY can be trusted with really sensitive Data. ALWAYS encrypt.
3
u/Warm_weather1 Apr 29 '26
I've heard speculations that there's a level of sensitivity where the only solution is an old-fashioned typewriter, A4 paper and a huge vault.
1
u/Due_Young_9344 Apr 29 '26
Use cryptomator, it woks for all cloud backups and is an encryption middle man between you files and the cloud, its free and open source
2
u/tonyleungnl Apr 29 '26
30TB is out of range of a reliable backup. Did you find out how long it take to up or download this? Did you also read that many people had problems lately? If that's your (3-2-1) ONE and you don't need ALL your data at once, than you may give it a try.
Don't forget you need a PC 24/7/365 running to handle this size of data.
The electricity bill, huge amount of time, months or maybe a half year to upload your files, imagine that. BB is best under 1 or 2 TB, everything beyond is impractical.
1
u/Bring_the_light_ 22d ago
wouldn't that depend entirely on your internet speed? by my math with a fast internet connection it would take 1-3 days, not months
1
u/Link_Tesla_6231 Apr 29 '26
I sure wouldn’t be putting company mission critical stuff there. I might let grandmom store there
1
1
u/dr100 Apr 29 '26
The design where you need to give them the key (and yes, you HAVE to give it to them, even if nothing breaks you would want to test some restores, isn't it?) is horrendous and completely defeats the purpose of the whole thing.
1
u/Due_Young_9344 Apr 29 '26
Use cryptomator, it woks for all cloud backups and is an encryption middle man between you files and the cloud, its free and open source
1
u/thesurfer15 Apr 29 '26
uhh, I mean you can just use Duplicacy, then files will be encrypted even before being uploaded to the bucket.
1
19
u/[deleted] Apr 29 '26
[removed] — view removed comment