Worth to encrypt my Backup on an encrypted Cloud Storage? (Help with my Backup Solutions)

[novisin]

I’ve gone back-n-forth regarding the future of my backup storage solutions for awhile in my mind. I’ve have not gotten to a definitive conclusion, so I need a second opinion to help sway me to action.

My Current Backup Solution (& Problem)

The goal for my backup solution is to match the widely promoted 3-2-1 Backup Strategy, yet I fall quite short of achieving that strategy.

My first backup is on an SSD. The device itself was encrypted using Veracrypt, and the backups are itself encrypted using Kopia. For what its worth, this solution both works, makes me feel safe, and is fast. I’ve only had two moderate problems with it, in past two months, out of the two years I have used it. It’s also been tested a lot, owed to the fact of having to restore my system multiple times due to messing up Linux multiple times (another story for another time ).

My second* backup is on the cloud storage Filen. The intent was to use Kopia’s cloud storage tools to upload my backup of at the time ~350GB to Filen. Similarly, this would encrypt my backup on an already encrypted storage device. The problem here is speed. Backing up this amount of data, took around a week and a half on my very slow WIFI. This does not even include the maintenance tasks Kopia does to my backup, which can be more than an hour (I haven’t even finished maintenance on my cloud backup). This has led me to neglect my cloud backup for quite a long time, owed to the fact that it would take me hours to backup my data, even with methods that Kopia employs like deduplication. The process itself led to a lot of stress and additional work on my part, which I do not want to repeat again, especially as my backups grow larger.

My third backup, I don’t even have since I’ve been stuck getting the second to work. So I do not have 3 backups, and while I technically have two, with one offsite, only the on-site, SSD backup is regularly updated.

Where I am currently at, and where I need a second opinion

The current priority is getting a cloud solution up, running and regularly updated. I won’t go into the details of why, but finding a meaningful upgrade to my internet won’t be feasible for a long time (I actually have had the internet upgraded, to no noticeable benefit ). That leaves how I set up my cloud backup. Is it really worth using encrypted backup software to backup my data, when the cloud storage is already E2EE? I am personally leading towards no, since I do not think I am personally the type of person who needs that kind of security of “double encrypting” my files, but I’m still conflicted. I’m willing in the case of cloud storage, to try out different backup software (maybe different cloud solutions) if that would lead to a faster (therefore less stressful) experience. I think I’ve racked my brain enough with this issue, I need other people to push me one way or the other.

On that note, I still have not done a third backup. While lower priority right now, I would not be opposed to recommendation on what my third backup could be. I currently have a relatively empty WD External Hard Drive with space I could use. I also have a very old, HP Pavilion Slimline 408-034, and I have heard you could turn old computers in NAS’, though I have no researched at all on how feasible that is. Recommendations on this front would also be welcome. Maybe I can even make this my second backup while I workout the cloud solution.

Advice is very much welcome, and in fact needed for how indecisive I can be. Thanks

[Sorge]

is it really worth using encrypted backup software to backup my data, when the cloud storage is already E2EE?

It’s always the user’s choice, of course. But it’s worth knowing that double encryption is standard for government-sensitive data — it’s mandatory policy, since we can never be sure that any particular encryption method has no bugs. This is so common that when cryptographers design new software, they assume their app will be one layer of encryption, not the only one:

Saying this I don’t mean everyone should do this. One encryption layer is fine, no encryption is fine too in a lot of cases.

But are you sure encryption is what’s making the backup slow? I used Kopia for a while and remember the devs were skeptical about non-S3 backends with rclone — and using Kopia with Filen you’re actually using rclone, i guess. Filen is also historically not known for high speed, though I haven’t tested it for heavy uploads after the recent update that was supposed to fix speed issues.

Could you first test your regular Filen speed as well as uploading a Kopia backup to S3, to see where the real bottleneck is? I’d guess it’s not the encryption.

Finally, from my experience living with slow wifi while traveling: I ended up making regular remote backups of just the small part of my data that’s most important or changes often, and sticking to full backups for everything else, triggered when visiting an office or library. Maybe you don’t need the same backup policy for all 350GB?

[Sorge]

@novisin

This does not even include the maintenance tasks Kopia does to my backup, which can be more than an hour

Rereading the post — did I get this right? Local maintenance takes more than 1h? That would be odd, Kopia is pretty fast for that, especially for new repos. If that’s the case I’d want to ask more about how the backup is being processed

[novisin]

@Sorge

Rereading the post — did I get this right? Local maintenance takes more than 1h? That would be odd, Kopia is pretty fast for that, especially for new repos. If that’s the case I’d want to ask more about how the backup is being processed

To clarify, maintenance is taking long for the cloud backup, local is going just fine and fast (though i do need to figure out why one of my backup repositories keeps having maintenance fail on it).

@Sorge

But it’s worth knowing that double encryption is standard for government-sensitive data — it’s mandatory policy, since we can never be sure that any particular encryption method has no bugs. This is so common that when cryptographers design new software, they assume their app will be one layer of encryption, not the only one:

Thats…good to know. Did not know I was doing that but I’m glad it isn’t as strange as I personally thought it was. I think just having one layer of E2EE is fine enough for me when it comes to cloud storage and upload speeds

@Sorge

But are you sure encryption is what’s making the backup slow? I used Kopia for a while and remember the devs were skeptical about non-S3 backends with rclone — and using Kopia with Filen you’re actually using rclone, i guess. Filen is also historically not known for high speed, though I haven’t tested it for heavy uploads after the recent update that was supposed to fix speed issues.

I get what you’re saying. I think I framed encryption in my original post as the main bottleneck, but really I think that my WIFI itself is the main issue. As I mentioned in my original post, internet, especially with upload speeds, can be slow, even with ethernet (and without any VPN). Unfortunately, after upgrading multiple times, I think I have to change my router/modem, or change my ISP to improve conditions. Making that change however, is troubling in my circumstances, and as mentioned in my original post, unlikely to even be done in a few months. Hence, I am looking at other potential ways of reducing the load when uploading.

I am uninformed on how networking works when it comes to what makes connections fast other than basic concepts like ethernet, or fiber-optic.

@Sorge

Could you first test your regular Filen speed as well as uploading a Kopia backup to S3, to see where the real bottleneck is? I’d guess it’s not the encryption.

I’m guessing I would upload something fairly large (e.g. 30gb) to test this. Will need to find time to learn and set up an S3 Bucket though. I guess call it paranoia for my original backup potentially failing, but maybe I should start considering the 2tb hard drive I have around as my second backup and quickest solution.

@Sorge

Finally, from my experience living with slow wifi while traveling: I ended up making regular remote backups of just the small part of my data that’s most important or changes often, and sticking to full backups for everything else, triggered when visiting an office or library. Maybe you don’t need the same backup policy for all 350GB?

That, could be doable. Would take some time for me to determine what is critical for me. I have a problem of not letting a single thing just fade away, hence I am in the (precarious in this context) “all or nothing” mindset.

---

Reading your reply, its implied to me that you no longer use Kopia to some extent. The main topic aside, I do have some other concerns regarding Kopia that have me look towards other backup solutions. What have you/are currently using? I’ve tried restic, though as someone who prefers GUI, none of the GUI frontends have clicked with me compared to Kopia’s.

[Sorge]

@novisin

I’m guessing I would upload something fairly large (e.g. 30gb) to test this. Will need to find time to learn and set up an S3 Bucket though.

It also depends on the number of files, not total size only. Uploading one 30GB file will probably give very different results compared to 30k 1MB files. I’d start with Backblaze: their free 10GB of S3 compatible storage should be enough for experimenting with real or similar-to-real data to see the difference.

What have you/are currently using?

I use restic. Nothing wrong with Kopia, I just found the UI and amount of features a bit overwhelming for the simple things I actually need. The fact that almost everyone else uses restic was a bonus too.

I also have a small local backup with Vykar. While it’s new and is not recommended for production, I’ve only had a few minor issues and they were fixed pretty quickly. The UI feels more practical than Kopia’s:

Vykar Backup Documentation

[novisin]

@Sorge

I use restic. Nothing wrong with Kopia, I just found the UI and amount of features a bit overwhelming for the simple things I actually need. The fact that almost everyone else uses restic was a bonus too.

That’s funny, I found the various UI’s of restic to be either too little or too much in complication/simplicity. I’ve only ever heard of Kopia, Restic, and Borg, so nice to know about Vykar for the future. Also good to know about the Backblaze part.

@Sorge

It also depends on the number of files, not total size only. Uploading one 30GB file will probably give very different results compared to 30k 1MB files.

I’ll likely test with a fairly non-important folder, with multiple files of various sizes.

Kind of off topic, but regarding storage solutions like S3, I see a lot people mention they use them, but it feels like its very expensive when going up to TB levels of storage. I’ve only found Hetzner to be comparable to the more commonly known form of cloud storage (e.g. GDrive, Mega, OneDrive, Filen, etc.)

[Sorge]

@novisin

I found the various UI’s of restic to be either too little or too much

Yep, I guess that would be my feeling too if I tried them. The good thing about restic is it’s simple enough that when you need to do something advanced, you end up learning more about your OS or language of choice rather than about restic itself. So I’ve never bothered with external UI tools for restic for personal backups.

It’s very expensive when going up to TB

Just in case — the linked Hetzner storage is not S3-compatible, though it can be used with restic/Kopia via SFTP or rclone+WebDAV. This can still be better than rclone+Filen: my point was that your network performance might be limited by rclone’s use of the Filen API rather than the backup tool itself.

Hetzner’s own S3-like storage is a bit more expensive. Depending on the use case, Backblaze is probably cheaper for most users — on Hetzner you pay for a whole first TB even if you’re only storing a few GB, while Backblaze pricing is fairer in that sense. Traffic costs on BB can also be optimized. The cheapest S3 storage is probably still iDrive E2

S3 can be cheaper or more expensive than consumer clouds depending on the case. S3-like services justify their pricing with network performance, certificates, and guarantees individuals don’t care about. Consumer clouds, on the other hand, often make you pay for TBs before you actually use them or tools you do not need. That said, some consumer packages can make sense — Google bundles a lot of storage with the Gemini Pro tier, so if I would need this many Gemini tokens, that storage could work for backups even if performance isn’t as good as S3-like services

[Undone_Diary]

Check out Cryptomater and see if that is a viable solution. Hope that helps.

[Sorge]

I completely forgot about this, but the Filen desktop app has a cool feature that creates a local S3-compatible bridge:

Hosting a local S3 server | Filen Docs

We haven’t tested whether Filen’s native speed meets your requirements. Also the desktop app seems to be missing the recent mobile update. It is still worth trying if rclone was the bottleneck.

[Harisfromcyber (Haris)]

@novisin

~350GB to Filen

I would recommend only backing up files that can not be recreated, as in files that are the most important to you. 350GB is a lot tbh. If you have any data that can fall in the data hoarding category, I would recommend excluding that. You don’t have to share what the data is, nor would I ask that. This is more just for context of my suggestion.

@novisin

take me hours to backup my data, even with methods that Kopia employs like deduplication

this makes sense for the amount of data you would like to encrypt.

@novisin

Is it really worth using encrypted backup software to backup my data, when the cloud storage is already E2EE?

I would say so. It’s a better safe than sorry approach. I would also say to occasionally test your backup to make sure it is working. That is however time and network taxing if you are moving 350GB, which in that case would be harder to accomplish.

@novisin

I also have a very old, HP Pavilion Slimline 408-034, and I have heard you could turn old computers in NAS’, though I have no researched at all on how feasible that is

Are you able to copy data to that drive and have someone away from your house store it for you? If so, then that is a backup on another medium (Hard drive), and it is not at your current location. This can allow you to do occasional updates, while having it away from your physical location, in case of emergencies.

If money and time are restrictions, I would recommend tiering your data into: non-replaceable, important (yet replaceable), and good to have. Once you do this mental calculation, backing up the non-replacable to cloud will save you a lot of cloud space and time for uploads to your cloud.

Hope that helps.

[novisin]

@Harisfromcyber

Are you able to copy data to that drive and have someone away from your house store it for you? If so, then that is a backup on another medium (Hard drive), and it is not at your current location. This can allow you to do occasional updates, while having it away from your physical location, in case of emergencies.

I have heard people doing that. It is something that I have considered but, I don’t know if I have a person that I trust that highly to take care of such a thing right now.

@Harisfromcyber

If money and time are restrictions, I would recommend tiering your data into: non-replaceable, important (yet replaceable), and good to have. Once you do this mental calculation, backing up the non-replacable to cloud will save you a lot of cloud space and time for uploads to your cloud.

That mental calculation would be tough. I think my issue is that I have a lot of non-replacable data that makes those 350GB. What is important yet replaceable, and what is good to have honestly don’t make up too much of my data. Though that does bring up a good point. A lot of it is non-replacable, but not interacted with all that much. For instance, I have a lot of family photos that are non-replacable (also individually quite large strangely), but are not gonna be viewed even every month. I would have a lot less data to routinely back up if I move them out of my working computer and just leave them in the backups.

[Harisfromcyber (Haris)]

If that is the case, you could potentially do two backup folders: one with the photos in it and one without. You would upload both and only replace the non-pictures one more frequently. Just a suggestion for this, as that would be how I would approach this. Hope this helps.

[novisin]

Thank you all for your insightful comments. It’s been a while, and I have not really come to a conclusion regarding my main issue. However your responses have spurred me into a interim solution of sorts. As mentioned I have a underused 2TB Hard Drive, and I have successfully turned it into my second backup. This was only a minor headache given how long Veracrypt took to fully encrypt the drive w/out quick format. Again, this may not be the perfect move I could do, but it does give me a sense of relief having two function backups at least.

Regarding the cloud situation, I am still undecided on how I want to tackles things, especially as my personal life is developing in ways that directly affect my ability to maintain/test such a backup solution.

@Harisfromcyber

If that is the case, you could potentially do two backup folders: one with the photos in it and one without. You would upload both and only replace the non-pictures one more frequently. Just a suggestion for this, as that would be how I would approach this. Hope this helps.

Thank you for this suggestion however. It is the one I am considering the most (whenever I get around to it).