Why cloud backup needs a privacy charter

Every cloud backup service on the market will boast about its security, whether they ought to or not. But is there a minimum standard of privacy we all ought to expect when we back up our personal data online? When it comes to cloud backup, what constitutes good security? We decided to answer these questions and lay out a charter that anyone to whom privacy is a concern should demand from their backup provider.

The answer ultimately comes down to encryption. Less quantifiable privacy concerns also play a role, e.g. any records of breaches by hackers, giving in to coercion by authorities, abuse by the backup provider itself, and the geographic location of the data centers. But these threats may not be publicly disclosed and in any case can be nullified with proper encryption practices. Not to mention that just because a company’s servers haven’t been compromised today doesn’t mean they won’t be tomorrow.

We advocate a zero knowledge policy. That means the backup provider sees only encrypted packets of files being uploaded and cannot ascertain any info whatsoever of what they hold.

Comparitech Cloud Backup Security Charter

To qualify as a safe and private service under the Comparitech Security Charter, cloud backup providers must guarantee the following:

• 256-bit AES, 128-bit AES, or 448-bit Blowfish encryption protocol: These are the strongest standards of encryption available for consumer-level cloud backup services. When a backup provder advertises “military grade” encryption, they’re using one of these. 128-bit encryption is technically weaker but should be more than sufficient for any modern-day attacks. If it takes 50 years to brute force 128-bit and 1,000 years for 256-bit, the difference doesn’t really matter. 256-bit is more future-proof, and the differences between it and 128-bit may become more apparent with the advent of quantum computing, but that’s still a long way off. The majority of cloud backup providers offer one of these types of encryption, but not all do.
• SSL encryption: The encryption standards above are used for the data stored on the cloud server, but when the data is still being transferred to the server from the original computer, there’s SSL. This is the same encryption used on URLs prepended with “https”. Most ecommerce sites like Amazon use SSL to protect shoppers’ credit card details when they’re being sent through the payment process. Almost all cloud backup providers use SSL nowadays.
• Encryption takes place on the local machine: When data is backed up onto the cloud, it’s preferable that the data be encrypted on the local machine before it’s sent to the server, even if it’s protected by SSL. This way, user data is never sitting unencrypted on the cloud server, even for a second. The reverse also holds true when performing a restore: the data should be decrypted on the local computer, not on the server. Whether a provider does this or not can be difficult to ascertain as it’s not something they typically advertise. Some transfer the data to their servers and encrypt it after the fact. Users may need to inquire with customer service to find out.
• Set a private key: Even if data is encrypted with the highest standards, it makes no difference if someone else has access to the encryption key, which is essentially a password that can decrypt all user data. Backup services should give the option to set a private encryption key rather than use the company’s key. This option means no one except the user can decrypt his or her data, not even the provider hosting it. If hackers breach the servers, user data is safe. If authorities coerce the company into giving up access to their servers, user data is safe. Setting a private encryption key places the security of your backup solely in your hands. Just keep in mind that if the key is lost, the data can never be decrypted. Additionally, users must take extra care not to leak the key to anyone else, so be sure not to store it unencrypted on your device and that your antivirus is up to date.
• In addition to all of these encryption standards, it’s also important that the backup provider owns private physical data centers as opposed to renting rack space or virtual server space. Doing so prevents any third parties from potentially entering the equation.
• Metadata is not accessible. Besides the data itself being encrypted, no one but the user should have access to information about that data. Filenames, size, directory structure, and file creation dates are examples of metadata that should be left out of the backup provider’s reach.
• Finally, cloud providers must guarantee that no one except the user can gain access to that user’s data. Company employees may not access it. Sufficient security is in place so that hackers cannot breach it. And government officials may not access it with anything less than a warrant. The lattermost is perhaps the most difficult to accomplish, as governments around the world are pushing tech companies to allow backdoors to peek at users’ data. The failure and uncertain future of Safe Harbour makes this an even more difficult promise to keep. That ultimately makes the cloud provider itself responsible for guarding user data.

Backup providers that meet the privacy standard

To make your search a little easier, we’ve compiled a list of cloud backup and storage providers that are up to par and meet all the encryption standards listed above. Here they are, in no particular order.

• Carbonite – read our review
• IBackup – read our review
• IDrive – read our review
• Crashplan – read our review
• SpiderOak
• Wuala
• Tresorit

This is by no means an exhaustive list and if you have more to suggest, let us know in the comments. If you want to continue using a cloud backup service that doesn’t meet our standards but would like to add a layer of encryption, check out our article on the best apps to encrypt your data before uploading to the cloud.

We believe this charter is perfectly feasible and reasonable for cloud backup providers to undertake. For many out there, it would be an improvement, but there’s no perfect solution. IT professionals have pointed out that encryption schemes like these still have holes, however the alternatives could be equally risky. That’s why it’s still important to create and protect strong passwords.

“System Lock” by Yuri Samoilov licensed under CC BY 2.0