Hello 
Would like to ask a couple of questions:
- Is it possible to initialize a new encrypted storage with the RSA encryption using Duplicacy Web Edition?
- Which criteria two storages need to met in order to be copy compatible?
Thanks in advance!
Not as of today. You woudl need to init it using command line tool and then add that storage in the UI
At the time of second storage creation you can specify it to be created as copy compatible to first storage.
Thanks! So all the storages are copy compatible with the others?
Not all:
1 Like
In the latest version (1.5.1) there is an option to enable RSA encryption when initializing a new storage.
When is the expected release date?
Thanks! My bad, I suppose it can only be enabled for new storages and not for existing one?
Thinking, i use b2 so auctually for someone to be able to stole my backup, the attacker should also know my bucket keys right? Was evaluating how much security moving to an RSA bucket would provide to me.
Actually i suppose most of the providers need some sort of “token” before they can be added to Duplicacy. If i’m not wrong the tokens needed from B2 are visible only once.
You would want to re-encrypt existing chunks, which effectively means decryption and re-encryptign everything anyway. I’m wondering if it is possible to copy between differently encrypted repositories, if they are created as copy compatible.
This does not matter, and it is not a concern. Concern is backblaze themselves having access to your data. And by extension, anyone that gets access to their network, by mistake, malice, bugs in their authentication mechanisms, etc… Relying on bucket side encryption means relying on backblaze to manage your security, including the whole company you don’t control into your security perimeter. Do you trust backblaze that much? I certainly don’t.
Therefore your data needs to be encrypted before it leaves your network. And if that is the case – it does not matter if buckets are encrypted, if transfers are encrypted, or whether backblaze gets hacked. Worst case – you will lose your backup, not disclose your data.
If now you don’t encrypt duplciacy backup, starting encrypting it will be beneficial, regardless of what you do cloud side.
if you are talking about switching from symmetric to asymmetric encryption – this solves different issue – see if you have that issue in the first place. It’s harder to manage – 2 keys, in addition to one password – but in some scenarios I ti useful.
Thanks for your answer.
Oh i actually do not use B2 bucket encryption because they need to have my key.
I use Web Edition with encrypted storage (B2), so basically my backup is encrypted before it is sent to B2 i suppose.
I was meaning that if an attacker wants to restore my backup installing Duplicacy itself, he will need my b2 bucket encryption password. But most importantly he will need to know my account and application keys from B2 in order to add my B2 storage to Duplicacy. Similar to this are other providers like Google etc where you have to put something from the provider to Duplicacy in order to connect them. Hope i’m clear 
This said i was wandering what kind of extra security can RSA add.
you mean duplicacy repository encryption password?
What if attacker is actually running on the same machine as your duplicacy? Then it has exactly same access as duplicacy, including ability to delete.
There was a topic recently where fellow user described how to generate B2 credentials for backup that will not have permission for delete or modify.
Yes was talking about the duplicacy repository encryption password, sorry.
Uhm if on B2 i create application keys for a bucket without the delete/modify capabilites and use them in Duplicacy, how will Duplicacy able to prune?
EDIT: Application keys on B2 can be only read; write; both.
It won’t be able to. THat’s the point. You don’t want malicious actor to prune your backups out of existence
If you want to prune – you woudl need to do that with another set of keys, probably from more secure machine.
Have a look a this discussion here How secure is duplicacy?
This is not accurate. Please refer to the thread linked above
In Duplicacy web edition i should create a storage with the “prune key”. So that storage will only be used to prune. But if an attacker take control of my device then he can prune everything, correct?
Should I use the prune command (application key) manually?
Yes, you would prune from some secure (mayve separate virtual?) machine;
Or don’t prune at all. Depending on your data turnover savings of storage costs may not be significant enough to care. (Or risk damaging the datastore by bugs in prune code, hypothetically).
Thanks again.
I’m going pretty confused. So actually what i have to do after keys generation is to initialize the same storage in Duplicacy on another machine but with the “delete only” key?
And if instead i want to do it with a script directly from the machine where the “write only” key is used? Can both keys be used when adding the storage? I’m actually using Duplicacy Web Edition in docker container. Maybe i could add the same storage but with a different name? Probably this will not differ from having just one key for everything…
What happens to the config file on b2 when i add/delete the storage from different machines and connect to the storage with different application keys? I’m afraid to mess up with it.
Actually speaking of my situation, Duplicacy is running in a container on my NAS. Duplicacy is not exposed to the internet and from the outside I only access from vpn. Also the Duplicacy UI is locked behind administration password and I only access ssh via private key. So maybe the use of 2 application keys for b2 is a little overkill for me?
I access the NAS daily so I would notice if a Ransomware strikes. Also if it starts attacking after a week I will know the exact day the data started to corrupt and restore the backup just before.Probably I’m still missing something on the Ransomware question.