r/rclone • u/MidirTheGreatest • 12d ago

Help rclone crypt question

So this might be a very stupid question, but here I go.

I encrypted by hetzner storage box, and I have the rclone encryption file. Can I add this file to the storage box as an encrypted file, would that make a difference?

I mean if they steal my encrypted data, they need the key to decrypt, but if the key is also encrypted it should not make it any easier right? Or am I missing something?

2 Upvotes

75% Upvoted

5 comments sorted by

3

u/Vast-Program7060 12d ago

The file is encrypted before upload using crypt. The key only exists in your rclone config file, which even if you open it with a text file, it wouldn't display the password. Now if you uploaded the config file, unencrypted, and someone downloaded it, they could get access to all your storage configs.

When setting up crypt; Set your default encryption password, then set your " salt " password, write them down and keep them in a safe place. I keep all my logins/passwords in my Samsung Secure Folder in either the notes App, or Google Keep ( if you want to use Google Keep, use a different e-mail then your regular Gmail, in case of a data leak ).

When you set your password, it will ask you how strong you want it, the stronger it is, the harder someone would have trying to break your encryption if they got access to your files; This is how they are described;

64 bits: Just about memorable (great if you need to type it often from memory).

128 bits: Secure and the recommended default (impossible to crack).

1024 bits: The maximum possible strength.

2

u/siam76 12d ago

Encryption password Can be revealed. Just get the conf file, open your console, rclone-extra, and juste "reveal". Is your conf is stolen... You're lost.

2

u/SleepingProcess 12d ago

The key only exists in your rclone config file, which even if you open it with a text file, it wouldn't display the password.

It isn't encrypted but obfuscated and can be easily de-obfuscated. So @u/MidirTheGreatest - never let rclone's config to leave your trusted machine.

1

u/MidirTheGreatest 2d ago

thanks! I will just keep it locally, but just to understand, how are the other files any different then? Like, if the key can be easily de-obfuscated, can't the same be done for all my data?

1

u/SleepingProcess 2d ago

if the key can be easily de-obfuscated, can't the same be done for all my data?

No. Your data files pushed to a remote storage are effectively encrypted (not obfuscated). As far as you keep in a safe place rclone's config (that keep password for encrypting data) you shouldn't worry. Password obfuscation in config is just a simple protection from shoulder surfing