2019 Why Does the Backblaze Website Need My Private Encryption Key To Prepare a Restore?

(10/24/2019)

Who am I?
My name is Brian Wilson, and I am one of the founders of Backblaze, and I wrote the code in "Backblaze Personal Backup" that encrypts the files on your laptop before sending them to Backblaze for safe backup.  I stand behind my product, and you can check out my identity by looking at some of the links below:

What is this Web Page about?
I get asked a certain question fairly often.  The question is: "Why does the Backblaze Website Need my Private Encryption Key To Prepare a Restore"?  The worry here is that because your files are decrypted on the Backblaze servers for a few seconds or minutes, this creates a potential security issue that could have been avoided if the Backblaze servers never knew the private encryption key.  Systems that never EVER know your private encryption key are often called "Zero Knowledge Encryption" and they are considered more secure.  The answer to why Backblaze requires customers to enter their private encryption key on the website is kind of lengthy, so I typed it up here.

Short Answer:
Backblaze doesn't even know your filenames, so you must provide the private encryption key to allow convenient web browsing of your encrypted files (without installing a local application first).

Slightly Longer Answer:
At the start (before we even built anything at Backblaze) we decided we wanted a web based restore that did not require a client. This allows you to sign in from any web browser on the planet, browse the list of files, grab one file, and sign out. By "any" web browser I really mean that, you could be in a library, a Kinkos, on the mobile web browser on your smartphone, on a device that IS NOT RUNNING WINDOWS or MACINTOSH OS, etc. So we built web based restore FIRST (because it is more general and useful to more people), and to browse the list of files and provide file preview without any client installed on your computer, the web site must prompt for the user's private key. For some use cases, this is literally the only possible way it could work. One of the restore options is to order an 8 TByte USB external drive with all of your files on it, and have that hard drive FedEx'ed to your home. To make that friendly and easy to use, the files must be decrypted and arranged on the disk correctly, and then the drives are encrypted for transport to your home (using the built in drive encryption, not Backblaze's storage encryption). Now a LESS FRIENDLY option would be to get all 8 TBytes of your files jumbled up on the external hard drive, then you could run a local program to decrypt them at your home, but that would require you purchase an ADDITIONAL 8 TByte drive as the destination for the decrypted versions. Make sense? Yes more secure, but much much less convenient for naive users who just want their family photos back on an external hard drive.

Now, this may not be your particular use case, but it does work for a gigantic percentage of our customers. My own niece had her laptop die, and therefore thought she could not prepare a restore until I told her to use the mobile web browser on her phone to get a copy of her homework she was working on when the computer crashed. She was so happy!

Now, we DO get a number of requests for a feature where you never give the Backblaze website your private encryption key, so we are actively trying to figure out how to build that and get it into customer hands if they want it. So stay tuned!

Longest Answer below.  Here is a wall of text for people who want the most detail. :-)

Which Backblaze Product should I use?

Backblaze produces four different products/modes for different customers with different needs and requirements. We want customers to choose what is appropriate for them. One size does not fit all:

1) Backblaze Personal Online Backup ($6/month) where every file is encrypted on your laptop BEFORE being sent to Backblaze and your backup is secured by your username/password - where you can recover your password if you have access to your email account. (We support two-factor auth which provides an additional optional layer of protection.)

2) Backblaze Personal Online Backup ($6/month) where every file is encrypted on your laptop BEFORE being sent to Backblaze and your backup is secured by your username/password AND your private encryption key is secured by a "passphrase" that is not recoverable in any way, shape, or form. (Two-factor auth is also optional here.)

3) B2 Object storage (half of 1 cent/GByte/month) where you store your file completely unencrypted, and this can be "private" (only accessible by username/password) or "totally public accessible by knowing the URL". A good application of this is serving up a web page to the public - you really WANT people to see all the contents!

4) B2 Object storage (half of 1 cent/GByte/month) where Backblaze has zero knowledge. You cannot browse your file hierarchy in a web browser because Backblaze doesn't know your filenames. You cannot preview your images. You cannot recover your passwords. There is no other option other than downloading the encrypted blobs and applying whatever decryption algorithm you decided on (we have no ability to know what that is).

Ok, so I think some (many?) people in the security field think that Backblaze should ONLY offer mode #4 (and maybe #3 to serve up public websites). I happen to disagree and I personally feel that products #1 and #2 are useful and appropriate for some customers. But everybody is welcome to their opinion and we want to be completely open as to what exactly is occurring and what we are offering as a service.

Personally I think #2 is an excellent trade off of security vs convenience. Your data is as impervious to attack as a zero knowledge system in #4 for years upon years. Then one day your laptop is stolen or crashes and you want your files back. You want all 6 TBytes of your data back - so you order one of our free (encrypted) USB hard drives to be FedEx'ed to your home with all your data. To kick this process off FOR THE FIRST TIME EVER you tell us your passphrase (up until this very moment it really has been zero knowledge). At this moment you are opening a window of SLIGHTLY lowered security that slams shut after a few hours. For those few hours of preparing your 4 TByte restore, if an undetected hacker had compromised the one restore server in the Backblaze data center that your job was on, that hacker could possibly get access to your files. But then the reduced security window slams shut, we NEVER write your passphrase to any disk so it has now vaporized and we do not remember it, and if a hacker hacks into our system the following day you are STILL completely impervious.

I am COMPLETELY supportive if you choose #4 which is our "Zero Knowledge" offering.

On average, Backblaze makes about the same amount of money from the Personal Backup Client and the B2 offering so I have no financial interest in pushing one over the other. For ease of use reasons (for naive users) the pricing on the easy to use Personal Backup Product is a fixed "$6/month" just because a naive user does not know the difference between a Gigabyte or a Megabyte and we wanted to offer a really stress-free, decision free product. B2 allows much more flexibility for highly technical users, but B2 will be more difficult to use. For example, in the Personal Backup Product ($6/month) there is a fixed 30 day history roll back period, or a 1 year rollback history (for an additional $2/month), but no other choices. Backblaze keeps the FINAL version of every file forever, but we keep EVERY version of a single file you have changed for 30 days (or 1 year if you select that option) in case you made a mistake (like accidentally deleted it) and need to roll back time. For B2, you can set ANY ARBITRARY roll back policy, like keep every version of every file for 6 months or for 3.5 months - and you will pay EXACTLY how much that costs to provide for your particular backup. If you aren't happy with the cost, you can change the roll back policy. B2 is complicated and (much?) harder to use for an 86 year old grandmother, but B2 is more powerful and flexible.

We want customers to choose what is appropriate for them. One size does not fit all.

 

Return to Random Stufff

Return to Ski-Epic home pagee.