Encryption for USB Backups

user1111111

I'm assuming the Seedvault backups to USB are not encrypted?

What options are there for encrypting the backup data?

Is it on the roadmap to more fully develop cloud based backups?

c86

user1111111

VeraCrypt is the gold standard for most use cases and you can use it on a USB

https://veracrypt.io/en/Downloads.html

LeslieFH

user1111111 I'm assuming the Seedvault backups to USB are not encrypted?

Why do you assume they're not? Seedvault encrypts all backups with the recovery passphrase, you need the recovery passhprase to decrypt the backup, even if it's a local file.

NetRunner88

c86
But Veracrypt isn't available on Android

c86

NetRunner88

You're right. Needs a but of a workaround and I get that can be a hassle, sorry.

Cryptomator has apps both on desktop and android, the android version has a onetime fee.

Another option you may prefer is encrypted cloud storage. You can make a proton drive account for free pretty quickly, as an example.

nandohyphen1

c86 Another option you may prefer is encrypted cloud storage. You can make a proton drive account for free pretty quickly, as an example.

Yes this is great! I use Proton Drive and I love it for files and photos. I just download it on my new phone and my photos are all there! :)

chinook

c86 until they implement DocumentProvider in cryptomator on android, it's sadly too big of a faff

c86

nandohyphen1

Ya it can be handy. I believe their photo integration is still in beta though, so be cautious with it for saving all of them. There are other photo saving options, or just stick to a USB.
And just an obligatory reminder that a backup on multiple mediums is ideal for redundancy

user1111111

LeslieFH
I took a brief look at the binary files that were written to the external USB drive and wasn't sure if it applied encryption or not. I searched the GOS documentation and looked around online prior to creating this thread, and couldn't find a reference to encryption for external USB drives specifically. Can you link the document that mentions this so I can have this for future reference?

n3t_admin

user1111111 why should there be a "specifically"? It's just encrypted, period.

Test this tool which is designed to de- and reencrypt SeedVault backups.

IDtheTarget

I'm sorry for changing the subject, but I've been looking for backup options. I thought seedvault had been deprecated?

argante

https://cryptomator.org/

IDtheTarget

argante

Thank you, but to the best of my knowledge cryptomator is an encryption solution, not a backup solution. It won't copy my phone settings or apk's, for instance.

I'm working on transferring my services to self-hosted solutions like next cloud so I can just back up my NC instance, but I've already spent a couple of weeks setting up my new 9 pro xl and having to replicate everything would be difficult to impossible with my impaired memory.

Speeduser7533

IDtheTarget

Even if using NextCloud, you need separate file-only backups spread across multiple devices and locations, to safeguard your data.

ryrona

In my opinion, GrapheneOS should implement native support for LUKS encrypted USB devices. So we have a known correct and secure implementation in GrapheneOS itself, without having to rely on mostly unaudited third-party apps.

The kernel and user space already has support for it, or at the very least can easily have support for it added, as it is a standard feature in the Linux kernel and Linux user space. Only some UI would need to be implemented, to allow entering the passphrase when plugging in the USB device.

I think there maybe is a ticket about this actually.

LeslieFH

ryrona

Indeed there is: https://github.com/GrapheneOS/os-issue-tracker/issues/4839

IDtheTarget

Speeduser7533

I've been setting up a NextCloud instance on a Raspberry Pi 5 with dual NVME SSD's. The idea is that I'll do an on-board backup of my files from the first SSD to the second. Then, I'm going to set up a second Pi (I have a 4 laying around) with another NVME in a different location (probably different city) and do rdiff-backup over ssh from the production system. If I could figure out a way to do a text-dump of all of my phone settings to NextCloud, I'd be happy with that level.

I know about the whole "offline" principle of backups, but I'm not very good at keeping up with that kind of thing. This set up will protect me against all except a determined malicious actor. I'll just try to remember to occasionally copy the files off of the rdiff-backup server and onto an offline SSD.

Oh, almost forgot. I'm also using Syncthing between my phone and the Pi with NC on it for my Calibre library and Joplin notes, so I can add any other files on the phone to that as well. Then I'll use rdiff-backup for those folders also.