Privacy Risks of Cloud Backups Explained

# See what metadata your backup tool sends
# Example: Restic shows what it backs up, in encrypted form
restic -r s3:backup-bucket/mybackup snapshots

# But the snapshot metadata itself is encrypted
# The provider only sees encrypted objects of various sizes

# With Duplicati, you can verify encryption locally:
duplicati-cli test-filters --include-filter="**" /local/backup/path

# Example: Apple's 2023 transparency report showed
# 60,000+ government account requests globally
# ~80% compliance rate in the US

# Check a provider's transparency report
# Most major providers publish these annually

# Install restic
sudo apt install restic   # or brew install restic

# Initialize a repository (the encryption passphrase is your key)
restic -r s3:s3.amazonaws.com/my-backup-bucket init
# Enter a strong passphrase — store it in your password manager

# First backup
restic -r s3:s3.amazonaws.com/my-backup-bucket \
  --password-file ~/.restic-password \
  backup ~/Documents ~/Pictures

# Scheduled backup (cron)
echo "0 2 * * * restic -r s3:s3.amazonaws.com/my-backup-bucket --password-file ~/.restic-password backup ~/Documents" | crontab -

# Restore
restic -r s3:s3.amazonaws.com/my-backup-bucket \
  --password-file ~/.restic-password \
  restore latest --target /tmp/restore-test

# Linux: install from cryptomator.org/downloads
# Creates a vault directory — contents are encrypted before syncing

# Structure on cloud:
# Dropbox/my-vault/
#   d/             (encrypted directory tree — names are random UUIDs)
#   masterkey.cryptomator  (encrypted master key)
#   vault.cryptomator      (config)

# Attacker or Dropbox employee sees:
# Random 36-char directories with encrypted filenames
# Cannot determine file count, names, or structure

# Install
sudo apt install borgbackup

# Initialize encrypted repository (repokey = key stored in repo, encrypted by passphrase)
borg init --encryption=repokey-blake2 user@backup-server:/backup/mybackup

# Backup
export BORG_PASSPHRASE='your-strong-passphrase'
borg create user@backup-server:/backup/mybackup::'{hostname}-{now}' \
  ~/Documents ~/Pictures

# List backups
borg list user@backup-server:/backup/mybackup

# Export the repo key (back this up separately — losing it = losing all backups)
borg key export user@backup-server:/backup/mybackup ~/borg-key-backup.txt

#!/bin/bash
# backup-test.sh - Test backup recovery capability

BACKUP_LOCATION="s3:my-backup-bucket"
TEST_FILE="/tmp/backup-test-$(date +%s).txt"
TEST_DATA="Critical data: $(openssl rand -hex 32)"

echo "$TEST_DATA" > "$TEST_FILE"

# Test 1: Can you encrypt and back up?
echo "Testing backup encryption..."
restic -r "$BACKUP_LOCATION" --password-file ~/.restic-password \
  backup "$TEST_FILE"

if [ $? -ne 0 ]; then
    echo "ERROR: Backup failed"
    exit 1
fi

# Test 2: Can you restore?
RESTORE_DIR="/tmp/restore-test-$(date +%s)"
mkdir "$RESTORE_DIR"

echo "Testing restoration..."
restic -r "$BACKUP_LOCATION" --password-file ~/.restic-password \
  restore latest --target "$RESTORE_DIR"

if [ $? -ne 0 ]; then
    echo "ERROR: Restore failed"
    exit 1
fi

# Test 3: Is the data intact?
RESTORED_FILE=$(find "$RESTORE_DIR" -name "backup-test-*" | head -1)
RESTORED_DATA=$(cat "$RESTORED_FILE")

if [ "$TEST_DATA" == "$RESTORED_DATA" ]; then
    echo "SUCCESS: Backup and restore working correctly"
else
    echo "ERROR: Restored data does not match original"
    exit 1
fi

# Cleanup
rm -rf "$RESTORE_DIR" "$TEST_FILE"

# Example: Restic with S3 backend
# The passphrase NEVER leaves your machine
# The provider sees only encrypted blobs

# Attacker with S3 access sees:
# - Encrypted data (useless without passphrase)
# - Backup timestamps
# - Approximate backup sizes
# Cannot see: filenames, content, directory structure

# Even if AWS is breached:
# - Your encrypted backups remain secure
# - Attacker cannot read any data without your passphrase
# - AWS cryptographic keys are irrelevant to your data

# Step 1: Export from Google Drive
# Use Google Takeout (takeout.google.com)
# Downloads all data as encrypted backup file

# Step 2: Transfer to Restic
tar -xzf takeout.tar.gz
restic -r s3:my-secure-bucket \
  --password-file ~/.restic-password \
  backup ~/Downloads/Takeout/

# Step 3: Verify
restic -r s3:my-secure-bucket \
  --password-file ~/.restic-password \
  restore latest --target /tmp/verify-restore

# Step 4: Delete from cloud provider (optional)
# Settings → Manage your Google Account → Data & Privacy → Delete...

# Generate a strong passphrase using cryptography-grade randomness
openssl rand -base64 32
# Output: aB3xY9kL2mN5oP8qR1sT4uV7wX0yZ

# Or use diceware method (human-memorable, cryptographically strong)
# Download diceware word list and roll dice
# Example: correct-horse-battery-staple
# This is actually very strong (entropy comparable to random string)

# Store securely:
# 1. Password manager (encrypted, backed up)
# 2. Physical safe (separate location from backups)
# 3. Never in plaintext on your computer

# Test that you can remember or retrieve it
# Losing the passphrase = losing all backups permanently