Arq - S3 - Crashplan « Legacy Arq Forum

Legacy Arq Forum » Backing Up and Restoring

Arq - S3 - Crashplan

(10 posts) (4 voices)

Started 1 year ago by jabalalam
Latest reply from SamM

This legacy forum is read-only. Please use the new Arq forum.

jabalalam
Member

Sorry if this question is very basic. I'm just switching from Crashplan as after two years of successful use my data has gone missing from their servers.

I'm having difficulty getting my head around Amazon S3 storage.

1.) When I log-in via the Amazon website and select my arq S3 storage bucket it measures the size in kilobytes, when I've backed up around 6 Gigs. Am I selecting the wrong thing, or are those buckets a just a file pointed elsewhere?

2.) Encryption. If I can log-in to Amazon S3 with my Amazon log-in and 'see' the storage bucket, then if someone had my Amazon username and password couldn't they access my files? In other words, is my data only as secure as my Amazon log-in?

If I could understand this I'll probably pull the trigger and purchase, because the interface is so intuitive and Mac-like, and speed of upload and download to Amazon S3 in Ireland (EU) is something else.

So, I understand the front-end and how it works, I guess it's back-end and S3 (which we are usually shielded from in Dropbox etc) I'm having trouble understanding. And, after my experience with Crashplan, I want to be sure I know what I'm getting into.

Thanks,

Posted 1 year ago #
stefan
Key Master

1. I'm not sure which kilobytes thing you're referring to, but if you select your computer in Arq and click the "Calculate" button you'll see how much space your backups are using.

2. Yes. If someone has your S3 keys, they can access your data. They can use Arq or arq_restore (the command-line tool) to decrypt your data. If your computer is stolen, the first thing you should do is delete your S3 key pair through the Amazon web site.

Posted 1 year ago #
jabalalam
Member

So I'm guessing that if an Amazon employee had access to my Amazon username and password (and I'm not sure of Amazon's policy on this) then they potentially could log-in, grab my keys off the web-console and then download my data?

Or, would they need the separate encryption password as well as the keys that Arq asked for when I first started backing up?

Regarding the 'kilobytes' thing, I'm referring to logging on to the Amazon web-console. When I press calculate on Arq it says I'm backing up 2.3 Gigs, but on the web-console their are no buckets or files anywhere near that size. So I'm wondering about the disparity. And being paranoid about whether my data is really there on S3.

Thank you for your reply.

Posted 1 year ago #
stefan
Key Master

An Amazon employee would need your encryption password to decrypt your data. Your encryption password never leaves your computer. (Write it down someplace so you have it if your computer dies and you need to restore to a new one!)

The Amazon web console doesn't present any total size, as far as I know. That's why I added the calculate button. The best way to see if your data are really there is perhaps to test restoring it. Just grab any file or folder from the backups and drag it to your desktop to create a copy there.

Posted 1 year ago #
SamM
Member

Stefan, the security terminology between ARQ and S3 seems inconsistent. You say "If your computer is stolen, the first thing you should do is delete your S3 key pair through the Amazon web site." But on the Access Controls portion of the AWS Console Security Credentials page, I see my Access Key ID and a Secret Access Key. Are these what you suggest I delete if my laptop is stolen?

Posted 1 year ago #
stefan
Key Master

Yes, that's it. Sorry I wasn't clear. Your Access Key ID and Secret Access Key are a "key pair". You should never share your Secret Access Key with anyone by the way.

If someone steals your computer, you can delete that key pair through the AWS site, and create a new key pair for your account, and use it with Arq on a new computer.

Posted 1 year ago #
propolis
Member

So the 'key pair' establishes your authentication with S3, and the Arq 'encryption password' decrypts your data. Therefore the worst that could happen if your S3 account is compromised is that someone could use the 'key pair' to access your encrypted data. Providing your 'encryption password' is secure, having access to encrypted data should not be of any concern.

Posted 1 year ago #
SamM
Member

Thanks, that's useful. I'm guessing that deleting my s3 key pair -and creating a new one- does not invalidate the backup data. But what if I've choose a not especially secure local encryption passcode? Arq doesn't make changing it easy or obvious; will doing so invalidate whatever backups are on s3 and begin a new backup? Lastly, what files need to be trashed to force the local encryption passcode reset?

Posted 1 year ago #
stefan
Key Master

@SamM Deleting an S3 key pair and creating a new one does not invalidate backup data.

If you want to change your encryption password, all your data would have to be encrypted with that new password and uploaded. The only way to do this at the moment is to pick "Create new backup set" from Arq's menu, choose a region, enter your new encryption password, and configure (again) the folders you want backed up.

Posted 1 year ago #
SamM
Member

What files need to be trashed to force the local encryption passcode reset?

Posted 1 year ago #

RSS feed for this topic