[Question] HBS3 - Client-Side Encryption

[sentinelvdx]

Hi,

I'm looking to create a disaster recovery backup job to have a remote copy on a private cloud.
Because I want to avoid prying eyes, I saw it offers "Client-Side Encryption", where it says data is encrypted before being sent remotely...

So from my understanding (english it's not my native language), this means that my NAS stored data won't be encrypted at all, right? only the copy which is being sent remotely...

Thanks in advance,

[Moogle Stiltzkin]

viewtopic.php?p=726520&sid=6787ce865ebb ... c077336690

Client-side encryption is the cryptographic technique of encrypting data on the sender's side, before it is transmitted to a server such as a cloud storage service.[1] Client-side encryption features an encryption key that is not available to the service provider, making it difficult or impossible for service providers to decrypt hosted data. Client-side encryption allows for the creation of applications whose providers cannot access the data its users have stored, thus offering a high level of privacy.[1] Those applications are sometimes marketed under the misleading term "zero-knowledge"

You can also use client side encryption for a backup on another device on same lan (in my case a 2nd qnap NAS). In this scenario i cannot just simply browse the contents of the backed up data because it's encrypted. I have to restore the data first to decrypt it. This is how the tech works.

It's highly recommended especially when storing your backup offsite. Or if you are backing up an encrypted share to a backup, hence you would obviously want that backup to be encrypted and not be a sitting duck (exposed/unencrypted) on the backup location.

so that is the purpose for what client side encryption does (in HBS)


Credits to Jon2288

Client site encryption: when enabled, your files will be encrypted before being transferred to the cloud storage, and your data will remain encrypted in the cloud storage. The encryption key is derived from the password you enter for this job. Without your password to decrypt the file, your original data cannot be decrypted. This prevents unauthorized access to your confidential data even if your credentials of the cloud storage are compromised or if your cloud storage provider tries to access your data. As standard openssl is used for encrypting the files, you can use it to decrypt your files after you download the files using other utilities without using a Turbo NAS. Please note that you cannot change this setting after a job is created.

https://www.qnap.com/en-us/how-to/tutor ... tion-note/


oo and another thing. your encryption is only as good as your encryption password. Don't use a short or overly simplistic password because that could possibly reduce the encryption strength.

And ALWAYS test that your decryption WORKS. Don't simply assume it will. TEST back ups actually work, ESPECIALLY if they are encrypted and require a password to decrypt.

[P3R]

So from my understanding (english it's not my native language), this means that my NAS stored data won't be encrypted at all, right? only the copy which is being sent remotely...

It depends on if you use encryption on the NAS or not. It support volume and shared folder encryption but it need to be configured with that and it need to be properly managed to be useful.

[sentinelvdx]

viewtopic.php?p=726520&sid=6787ce865ebb ... c077336690

Client-side encryption is the cryptographic technique of encrypting data on the sender's side, before it is transmitted to a server such as a cloud storage service.[1] Client-side encryption features an encryption key that is not available to the service provider, making it difficult or impossible for service providers to decrypt hosted data. Client-side encryption allows for the creation of applications whose providers cannot access the data its users have stored, thus offering a high level of privacy.[1] Those applications are sometimes marketed under the misleading term "zero-knowledge"

You can also use client side encryption for a backup on another device on same lan (in my case a 2nd qnap NAS). In this scenario i cannot just simply browse the contents of the backed up data because it's encrypted. I have to restore the data first to decrypt it. This is how the tech works.

It's highly recommended especially when storing your backup offsite. Or if you are backing up an encrypted share to a backup, hence you would obviously want that backup to be encrypted and not be a sitting duck (exposed/unencrypted) on the backup location.

so that is the purpose for what client side encryption does (in HBS)


Credits to Jon2288

Client site encryption: when enabled, your files will be encrypted before being transferred to the cloud storage, and your data will remain encrypted in the cloud storage. The encryption key is derived from the password you enter for this job. Without your password to decrypt the file, your original data cannot be decrypted. This prevents unauthorized access to your confidential data even if your credentials of the cloud storage are compromised or if your cloud storage provider tries to access your data. As standard openssl is used for encrypting the files, you can use it to decrypt your files after you download the files using other utilities without using a Turbo NAS. Please note that you cannot change this setting after a job is created.

https://www.qnap.com/en-us/how-to/tutor ... tion-note/


oo and another thing. your encryption is only as good as your encryption password. Don't use a short or overly simplistic password because that could possibly reduce the encryption strength.

And ALWAYS test that your decryption WORKS. Don't simply assume it will. TEST back ups actually work, ESPECIALLY if they are encrypted and require a password to decrypt.

Thanks that's exactly what I was expecting. Just encrypting data which will be stored offsite.

So from my understanding (english it's not my native language), this means that my NAS stored data won't be encrypted at all, right? only the copy which is being sent remotely...

It depends on if you use encryption on the NAS or not. It support volume and shared folder encryption but it need to be configured with that and it need to be properly managed to be useful.

Sorry but didn't understand you...
My NAS is not encrypted and I'm just looking to encrypt what it's going to be stored offsite. That's why I was asking.

Sent from my SM-G965F using Tapatalk

[P3R]

Okay, then it was me that misunderstood you.