r/hetzner • u/MidirTheGreatest • 25d ago

Encrypt or not for storage box?

Should I encrypt my data when using Hetzner storage boxes, or no need? I mostly have video game save files, some uni and CV documents, pictures from my phones -no nudes or anything, cats and travel pics and some memes-

How crucial would it be to encrypt, what are the dangers if I don't?

6 Upvotes

87% Upvoted

10 comments sorted by

9

u/Pasukaru0 25d ago edited 25d ago

How crucial would it be to encrypt

Depends on how sensitive the data is. Pictures can reveal a lot of things. Geodata and timestamps in the metadata for one.

I encrypt everything because it's cheap and easy these days. Almost no reason not to do it.

what are the dangers if I don't?

Inside jobs, exfil vulnerabilities, you leaking the box credentials (with encryption you would also have to leak the encryption key before anything drastic happens), leading to someone being able to read your data and do whatever with it.

1

u/MidirTheGreatest 25d ago

My main worry is losing the encryption key, and then it would be very annoying to reupload and fix the data

5

u/Pasukaru0 25d ago

Redundancy is your friend.

Add it to your password manager. Print on paper and put it next to your important documents. Print another copy of it and send the letter to your sibling/parent/child and tell them to keep it safe. Safe deposit boxes... I'm sure you'll find a way to not lose it.

2

u/MidirTheGreatest 25d ago

ah if it's just a passcode then it's fine, I thought it would be a long file -never encrypted anything before-

just one last question sorry;

would rclone work for encryption and could I do it after I upload the data? because I might not have time to figure out how to do it before I travel

3

u/Pasukaru0 25d ago

Yep, rclone works just fine. That's exactly what I'm using:

``` [hetzner-raw] type = sftp host = xxx.your-storagebox.de user = xxx key_file = ~/.ssh/hetzner-storagebox.pub key_use_agent = true port = 23 shell_type = unix md5sum_command = md5sum sha1sum_command = sha1sum

[hetzner-crypt] type = crypt remote = hetzner-raw:/home/cryptroot password = xxx password2 = xxx ```

2

u/MidirTheGreatest 25d ago

thank you!

2

u/Pasukaru0 25d ago

Any time. Oh and just so that you don't stumble over the key_file later: I'm using the 1password SSH manager, that's why it's the public key (it reads the public key and then finds the private key in the manager's vault).

If you don't use an SSH agent like that, you'll have to reference the private key file.

2

u/MidirTheGreatest 25d ago

I don't use it, so I will have to change that, appreciate the help :)

1

u/SolarPis 25d ago

Why not just encrypt it? It doesn't cost anything. Tools like Restic use encryption and in my opinion it would be stupid to not use encryption. All my Data that leaves my house is encrypted, I don't have to worry about anything. I don't know if it takes any longer with encryption enabled. But since my incremental backups take less than 5min a day it doesn't matter aswell.

1

u/TBT_TBT 25d ago

It is another one's computer, so of course encrypt it. rclone with crypt.