Encrypted offsite backup system: storage 💾

Threat model: my house burns. Or someone breaks in and takes my computers and hard drives. Everything’s encrypted so I’m not so worried about them gaining access to my data but I’m concerned about losing my data.
Solution: offsite backup system.

But then… threat model: breach in the company / data center that hosts my offsite backups, from a third-party attack or from maleovlent employees.
Solution: end-to-end encrypted offsite backup system.

Requirements

I have over 4 TB of data and I want a bit of buffer, so I’m only gonna consider solutions for 5 TB of storage.

Comparison

Let’s start with everything I considered for offsite storage. If you know better options, let me know!

Name	Plan	Storage	Monthly price (billed annually)	Monthly price
Sync	Teams+ Unlimited	6 TB	20 CAD	24 CAD
Dropbox	Standard	5 TB	15 USD	18 USD
Discontinued.
Dropbox	Business	9 TB	26 CAD	31 CAD
Google One	5 TB	5 TB	20.83 USD	24.99 USD
Discontinued. Google One doesn't offer more than 2 TB now so it's not an option anymore.
OneDrive	Business (Plan 2)	Unlimited	65 USD
Discontinued. OneDrive only offers up to 1 TB now. They used to have unlimited storage if you have 5 or more users with "Business (Plan 2)" at 13 USD per user.
Box Drive	Business	Unlimited	63 CAD	84 CAD
21/28 CAD per user per month but need at least 3 users.
MEGA	Pro II	8 TB	16.66 EUR	19.99 EUR
Backblaze B2		5 TB	30 USD*
*And $0.01/GB to access the data, so that would be 50 USD for me to download my entire 5 TB backup once.
Backblaze Computer Backup		Unlimited	8.25 USD*	9 USD*
*Per machine. And can only use through their own proprietary backup software with serious limitations.
Linode Object Storage		5 TB	100 USD*
*1 TB outbound transfer included, after that $0.005/GB, so that would be 20 USD for me to download my entire 5 TB backup once.
iCloud	6 TB	6 TB	39.99 CAD
Hetzner Storage Box	BX21	5 TB	10.90 EUR
Hetzner Storage Share	NX21	5 TB	14.19 EUR

Diving in

Backblaze Computer Backup

Backblaze Computer Backup is incredibly cheap with 9 USD per month for unlimited storage, but keep in mind the price is per machine, and everything needs to go through their own proprietary backup software. No Linux support, no way to customize the backup strategy, no way to script it. The software needs to call home at least once a month otherwise data gets deleted.

While the backups are encrypted, by default Backblaze can decrypt them, however they also provide a way to make the backups end-to-end encrypted, which is nice.

So if you’re fine with the terms and limitations of their backup software, then it’s by far the cheapest option and it seems convenient to use.

Box Drive

Another “unlimited storage” option without as many limitations as Backblaze Computer Backup is Box Drive. It’s 63 CAD per month though so quite a lot pricier. But if you have a lot of data and want more control over it, that may be very well worth it.

It’s even cheaper than the unlimited OneDrive storage that Microsoft was offering at some point for 65 USD per month.

Box Drive comes with a decent web interface as well as a native app for macOS, Windows, iPhone and Android.

However keep in mind that it’s gonna behave like Dropbox and iCloud: it’s great as a virtual remote drive that has a local copy of some or all files, but it may not be what you want from a backup solution.

As far as encryption goes, it doesn’t seem that anything prevents Box to access your data, so it’s something you have to be comfortable with.

MEGA

Pretty decent option at 16.66 EUR for 8 TB. Like the above, it comes with an app, and it also supports Linux on top of macOS and Windows!

It’s basically a mix of the 2 products mentioned above. You can back up entire devices to it, but also use it as a shared drive, so that’s pretty neat.

However unlike the Box Drive app, all the files in the synced folder must be present locally. There’s no way to have synced files being on the server only and being downloaded on demand only when you need them (and delete just the local copy afterwards).

So like for Box Drive, if you like the way it behaves, it’s a pretty cheap and convenient solution. If you want more flexibility, they do offer a SDK but you’ll have to write C++. There’s also a Rclone integration for MEGA so that’s neat to interact with the storage from the CLI and make something more custom with it.

In terms of encryption, MEGA seems pretty solid because everything is end-to-end encrypted with a key derived from your account password. If you forget your password and recovery key, you’re out of luck, but that also means MEGA can’t read your data. Thumbs up for me.

Hetzner Storage Box

At 10.90 EUR for 5 TB, it’s the cheapest option here to be actually flexible. You don’t need a proprietary app to use it. Instead it supports the following protocols:

• FTP
• FTPS
• SFTP
• SCP
• Samba/CIFS
• BorgBackup over SSH
• Restic over SSH
• Rclone over SFTP
• rsync over SSH
• HTTPS
• WebDAV

This is quite impressive, as it supports a number of popular backup software, so unlike the options above, you don’t need to use a backup or syncing software made by the storage provider. Hetzner only does the storage (and does it well), and you can use the backup or syncing software of your choice, whose only focus is to do just that (and do it well). Now we’re talking.

Most of those protocols are gonna be useful for listing, retrieving and uploading files, and the few options “over SSH” are gonna be particularly performant at incremental backups.

While backup and syncing software often have an option to working over SFTP or similar, it’s usually pretty inefficient when you need to diff the local and remote state in order to upload only what changed.

However, when paired with a companion command on the server, like is the case with BorgBackup, Restic and rsync above, the process can be much, much more efficient, because the client/server programs can exchange just the minimum amount of metadata in order to determine what changed and what needs to be transferred.

This makes the Hetzner Storage Box a killer option if you’re gonna use one of those natively supported options above.

The encryption is gonna depend on the protocol you use. The files are obviously stored encrypted on disk, and everything but FTP will transfer the files encrypted, however only BorgBackup and Restic actually perform end-to-end encryption of the files (meaning that Hetzner can’t decrypt them).

If you want to use any other protocol and also want end-to-end encryption, you can still implement it yourself as another layer. See more in the next article. 😉

Hetzner Storage Share

A bit pricier than the Storage Box at 14.19 EUR for 5 TB, and the use case is a bit different. It’s a hosted Nextcloud instance.

They have an app for Windows, macOS and Linux, as well as mobile apps. I only tried the macOS app and it acts as a shared folder just like Dropbox would.

At the time of writing, the desktop app will download all the files locally, there’s no way to browse the remote data without downloading everything locally first. For me and my 5 TB, that’s a problem.

Also keep in mind Nextcloud doesn’t support end-to-end encryption.

So the Hetzner Storage Share looks like a pretty sweet option with a decent price if you want a synced folder, but it doesn’t cut it for my backups.

Bonus: why not GCP and AWS?

Google Cloud Platform and Amazon Web Services both offer solutions that could help. So you may wonder why I’m not considering a pure cloud storage service like GCS or S3, or alternatively, a VM with persistent disk on GCE or EC2.

Well, I did consider those option, that’s actually the one I professionally work with most of the time, but they definitely did not fit the bill for my personal usage.

GCS/S3

As usual with cloud computing, the pricing is hard to predict. Not because the pricing model is unpredictable per se (although it’s complex, it’s also relatively clear). But because my potential usage is unpredictable without gathering data by running real-world simulations.

GCS and S3 charge not only for the amount of data stored, but also the read/write operations and download bandwidth.

Depending on the selected storage class, either the storage itself is expensive but reading/writing and downloading are relatively cheap, or the storage is cheap but reading/writing and downloading gets much, much more expensive.

GCS and S3 are pretty similar for this in pricing. So for my 5 TB, I could either:

• Pay $100 per month for storage and spend $15 to download my entire backup.
• Pay $50 per month for storage and spend $50 to download my entire backup.
• Pay $20 per month for storage and spend $200 to download my entire backup.

And it’s not a precise number because it’s really, really hard to predict how many operations I will actually use. And it would be totally possible that I’m missing some egress bandwidth fee on top of what’s already factored in the data retrieval fees, and it could easily surprise bump the bill by something like $400 in case of downloading the entire backup.

Not down to take the risk.

GCE/EC2 VM

On GCE, it would cost ~$200 per month for a 5 TB HDD. Downloading the entire backup would cost $400.

On EC2, that would be ~$80 per month for a 5 TB HDD, and $500 to download the entire backup.

Not in my price range at all.

Conclusion

The Hetzner Storage Box was by far the best option for me. It’s pretty cheap, and offers a ton of flexibility with SFTP access as well as support for a number of protocols like rsync, Restic and BorgBackup. End-to-end encryption comes for free with Restic and BorgBackup, and can still be implemented “manually” otherwise.

All the other storage providers require a specific app that can’t be customized to my needs, except for the cloud providers that are even more flexible but also insanely more expensive (and whose pricing model can easily result in very costly surprises).

Also except for MEGA and Backblaze Computer Backup (as an option), the other solutions don’t support end-to-end encryption.

So I subscribed for a 5 TB Hetzner Storage Box. Now, let’s see how I implemented end-to-end encryption and syncing with it!

Want to leave a comment?

Join the discussion on Twitter or send me an email! 💌
This post helped you? Buy me a coffee! 🍻