I am setting up Cloud Sync backup to Backblaze B2.
I have a question around encryption. I have the option in the Cloud Sync Task to setup “Remote Encryption” w/ “Filename Encryption”. Or in my bucket in Backblaze, I can configure it with “Default Encryption”.
I am trying to decide which one to use. I plan to use Backblaze as my DR recovery, and to protect against ransomware.
My understanding is that if I do “Remote Encryption” w/ “Filename Encryption” in TrueNAS, I can do a full recovery, but I would not be able to (easily) restore individual files.
What is the risk to using the Backblaze “Default Encryption”? When select the “Enable” option (before saving), I get this warning message:
Any thoughts or can someone clarify this for me? Thanks.
You first need to decide what kind of encryption you want. You listed two options, client-side encryption (in the cloud sync task) or server-side encryption (in blackblaze). You can also use both at the same time.
In client-side encryption, then the files will be encrypted by your TrueNAS Machine before sending them to backblaze. This means that even if a third-party has access to your backblaze account (or the entire backblaze company is hijacked/turns evil) they cannot decipher the data. HOWEVER this also means that you need to safe keep your encryption password. Without that you won’t be able to restore any data.
You can restore individual files with client-side encryption, but you must use the tool you made the backup with (rclone) and must have the encryption password.
In server-side encryption, backblaze promises you that it will encrypt data before storing it. If your account or backblaze itself is compromised then the encryption may not provide any security. On the upside, you are able to easily access the backups using backblaze ui or other tools.
If you want some more details regarding the warning from backblaze: backblaze disables some features when using server-side encryption. Likely because the wanted to limit which services have access to the encryption keys.
