Ask Slashdot: With Whom Do You Entrust Your Long Term Data?

jppiiroinen writes: F-Secure, a company based in Finland, has sold its cloud storage business to a U.S. company (Synchronoss Technologies, Inc) speculated to have ties to the NSA. In previous, public announcements, they used arguments equivalent to, "trust us, your data will be safe." Now, it's likely F-Secure simply realized that competing against the big players, such as Google and Dropbox, didn't make much sense.

But it makes me wonder: Whom do you trust with your data? And who really owns it? What about in 3-6 years from now? How should I make sure that I retain access to today's data 20 years from now? Is storing things locally even a reasonable option for most people? I have a lot of floppies and old IDE disks from the 90s around here, but no means to access them, and some of the CDs and DVDs has gone bad as well.

Comments

Same answer every time.

[khasim]

Once you give your data to "the cloud" it ceases to be YOUR data.

Now it belongs to whomever owns those servers.

You want to keep it? Then keep it on your own hardware.

Re:Same answer every time.

[Alrescha]

"You want to keep it? Then keep it on your own hardware."

Exactly.

A.

Re:Same answer every time.

[Anonymous Coward]

This should be the only answer and this thread should be immediately be marked as "closed"

The person who asked the question doesn't understand how computing works.

Re:Same answer every time.

[everett]

Encrypt your own data, store it where ever and hope it's not valuable enough for someone to bother cracking it.

Re:Same answer every time.

[Anonymous Coward]

One can still safely put their data on servers if they encrypt it first. (Encrypted by their own PC, not by the server).
Of course, this is quite time consuming, which is why I agree with your sentiment.

Re:Same answer every time.

[CaptainDork]

Or ... a person who doesn't understand how computers work could ask a question and get answer ... just not from you.

My answer is to store data both locally and in the cloud.

Re:Same answer every time.

[StormReaver]

Once you give your data to "the cloud" it ceases to be YOUR data.

It boggles my mind that people still haven't caught on to this. I'm going to expand on your message just a little bit:

Once you give your data to "the cloud", it becomes the property of government snooping agencies. It doesn't even matter if you're in a country that doesn't actively snoop (if you believe that such a thing exists anymore). Companies change hands, and they do so across political boundaries. Companies cannot be trusted with your data. Period.

Hopefully, this little incident opens some eyes.

Re:Same answer every time.

[lgw]

Once you give your data to "the cloud" it ceases to be YOUR data.

Now it belongs to whomever owns those servers.

You want to keep it? Then keep it on your own hardware.

"The cloud" is just too fuzzy a term. I have no problem with cloud-based file storage services, but I'd never put, say, my personal photos on an online photo-sharing service, or any other content-aware cloudy-thing.

My own hardware? That's silly. From Snowden we know the NSA can access files on my home server just as easily as they can on a cloud-based file server. If they take an interest in you, pretty much the only defense is a latop that you built before they took an interest in you and that you keep locked in a safe at all times when not using (I believe Bruce Schneier does this). But anything less than that, if they like you then you have a keylogger already, sorry.

All we can realistically hope to put our trust in is encryption. Even that's not easy (but if TrueCrypt passes it's audit, it's good enough for me). An encrypted archive is just as safe "in the cloud" as it is on a home file server.

Want to backup your data long-term and can't afford LTO tapes in a box out of state? Make one (encrypted) copy locally, but not in your house and not powered. Store another (encrypted) copy in the free files hosts if its small, or Amazon Glacier if you can't fit in the various free options.

Re:Same answer every time.

[Anonymous Coward]

Once you give your data to "the cloud" it ceases to be YOUR data.

Now it belongs to whomever owns those servers.

You want to keep it? Then keep it on your own hardware.

"Cloud" can also imply that you sync, and DO keep a copy of it on your own hardware (ala Dropbox).

You were saying about ownership...

Re:Same answer every time.

[geekmux]

"You want to keep it? Then keep it on your own hardware."

Exactly.

A.

When every piece of marketing-subsidized hardware in the future looks and smells like today's whored-out smartphones, attempting to secure said hardware will be rather difficult, or impossible.

Point is, you won't be able to ensure you "keep" your data anywhere, much like a smartphone today. Unless you're going to enjoy maintaining that offline system locked in a vault powered off 99% of the time. Doesn't smell very useful.

Re:Same answer every time.

[Anonymous Coward]

Also, you could not physically connect your backup server to the internet, although I trust iptables and DD-WRT to do this too.

Regardless, I thought it was common practice (read best practice) to have backups stored in a fireproof safe.

Re:Same answer every time.

[ShanghaiBill]

The person who asked the question doesn't understand how computing works.

... and the person that thinks there is only one answer probably doesn't understand how encryption works. You can put data in "the cloud" and still keep it private.

Re:Same answer every time.

[tattood]

The person who asked the question doesn't understand how computing works.

... and the person that thinks there is only one answer probably doesn't understand how encryption works. You can put data in "the cloud" and still keep it private.

Exactly. I use Dropbox to sync data between PCs, and I use a TrueCrypt vault (maybe should be changed since TC went away) that I can open from any of the PCs.

Re:Same answer every time.

[Anonymous Coward]

Regardless you should encrypt it. Even if it's on your servers you can't be sure nobody else will ever get physical access to them.

Re:Same answer every time.

[Anonymous Coward]

Agree. which is why I have a fileserver of my own at home. Neither difficult nor expensive. And I can access my pictures when the web is down too...

Re:Same answer every time.

[JohnFen]

"The cloud" is just too fuzzy a term. I have no problem with cloud-based file storage services, but I'd never put, say, my personal photos on an online photo-sharing service, or any other content-aware cloudy-thing.

"The cloud" is just the hip new marketing-speak for "centralized server". In this context, it's not too fuzzy at all. Your file storage service is no safer from spying than content-aware services.

My own hardware? That's silly. From Snowden we know the NSA can access files on my home server just as easily as they can on a cloud-based file server.

We don't know that at all, because it's not true unless you haven't set up your own server correctly or you don't have the correct security measures in place. Yes, a determined attacker (NSA or otherwise) can find a way into your servers, but it's' much more difficult for the government than cloud services, because they will have to bring their NSL or search warrant to your house or actually engage in hacking.

Re:Same answer every time.

[lgw]

If you use good encryption, do you care?

If you don't use good encryption, obviously you're not even trying.

In what scenario does it actually matter that your encrypted archive is in some cloud service? If your government can compel you to divulge the key, OK, I could see that, maybe.

Re:Same answer every time.

[Alrescha]

"When every piece of marketing-subsidized hardware in the future looks and smells like today's whored-out smartphones, attempting to secure said hardware will be rather difficult"

You can't do better than 'when this mythical event happens...' ?

A.

Re:Same answer every time.

[Ol Olsoc]

Exactly. I use Dropbox to sync data between PCs, and I use a TrueCrypt vault (maybe should be changed since TC went away) that I can open from any of the PCs.

Will your data always be available to you?

Seriously, you folks get so hung up on encryption.

If I was a bad guy, I'd just pland to make your data inaccessible. In commerce, a few minutes can make the difference between your success, and your failure.

Re:Same answer every time.

[Ol Olsoc]

If you use good encryption, do you care?

Is encryption the only problem inherent in "the cloud"?

In what scenario does it actually matter that your encrypted archive is in some cloud service? If your government can compel you to divulge the key, OK, I could see that, maybe.

In what scenario does it matter if a bad guy keeps your data from you? I can think of many.

Re:Same answer every time.

[Anonymous Coward]

You can put data in "the cloud" and still keep it private.

Until an encryption exploit exposes all your data. Or until your metadata exposes you, even if the plaintext isn't exposed.

There's a lot of reasons to not put your data in the cloud^W^W^Won someone else's computer.

Re:Same answer every time.

[Anonymous Coward]

Yes, a determined attacker (NSA or otherwise) can find a way into your servers, but it's' much more difficult for the government than cloud services, because they will have to bring their NSL or search warrant to your house or actually engage in hacking.

Unless you're in New Zealand, where an agent can break and enter on suspicion, no warrant required, no need to explain afterwards.

Re:Same answer every time.

[lgw]

Always have 2 backups, as I said upthread. You want an offsite backup of some sort, kept in a different state. The expensive (but better) way to to backup to tape, and send the tape to Iron Mountain, or whoever, in a distant state. For the rest of us, sticking the data in the cloud is just as good.

There's no perfect safe place to put any sort of archive - but having the live data plus 2 backups each with different failure modes, is pretty close. Sure things can go wrong in the cloud, but those are different things than can go wrong with the HDD sitting in a desk drawer somewhere.

Re:Same answer every time.

[Anonymous Coward]

... and one person that thinks encryption works for long term data doesn't understand how cryptography works. You cannot put your data for a long term in "the cloud" and still keep it private (every single algorithms weakened over time).

Re:Same answer every time.

[Anonymous Coward]

How useful is it now, dragging all "your data" around with you all the time?

Re: Same answer every time.

[Anonymous Coward]

Unless hardware can automatically log onto a an unknown wifi network, using an unknown password, it won't leak data to the Internet.

On second thoughts, I just realized that there is a semi-secure open network, with a known password, available in most of the country.

Re:Same answer every time.

[Alomex]

The private part yes, the keep it part is the one that fails. They can simply delete it, and no amount of encryption will protect you from that.

Re:Same answer every time.

[manu0601]

And you have to keep in mind that even well encrypted data will be easy to decrypt some day later.

Re:Same answer every time.

[ShanghaiBill]

Will your data always be available to you?

Of course. You put a copy of your data in the cloud, and keep the original data locally.

If I was a bad guy, I'd just pland to make your data inaccessible.

Right, because Amazon Web Services is so much easier to DDOS than "Joe's Dry Cleaners".

Re:Same answer every time.

[Anonymous Coward]

No, you can't. If you think that there is any form of encryption that the NSA can't break, think again! Do you honestly think that the NSA/FBI/CIA/Secret Service would allow the general public to get its hands on any form of encryption that they haven't already broken?

Re:Same answer every time.

[zugmeister]

Unless you're going to enjoy maintaining that offline system locked in a vault powered off 99% of the time.

Funny you should say that. I have an old Mac Mini with a bunch of external drives hooked up to it. Every other week it turns itself on, plays the Imperial March from Star Wars and runs a Carbon Copy Cloner incremental duplication of the files from my server. It emails me when it's done so I can turn it off, as there are multiple jobs and I can't tell which one will finish last. When it's done I turn off the mini and it sits there another two weeks. Every so often (when I think of it) I sync up to an old Drobo as well then unplug it. This means that yes, I do in fact have an offline system powered off 99% of the time. Sadly I do not have a vault but otherwise I have three copies of (almost) all my data at any given time.

Re:Same answer every time.

[zugmeister]

Well, you probably don't need it all with you all the time. For instance, your work machine probably doesn't need all your music and your tablet can hopefully do without your software install files and client information. A little moderation and a home server or NAS to hold everything should do fine. Set up some remote access (VPN or SSH tunnel) for the times you don't have something with you and breathe easier knowing your data is entirely (mostly) under your own control.

Re:Same answer every time.

[Anonymous Coward]

That's why I encrypt anything that I'm going to store online.

As for companies, I don't really trust any of them. I guess I could say I least distrust Microsoft to abuse my data, partly because it's encrypted and they can't gain access to it and partly because they seem to be the only company who is actually standing up to the NSA. Companies like Google and Facebook are in the NSA's back pocket.

Re:Same answer every time.

[Anonymous Coward]

Encrypted USB flash drive. Problem solved.

Re:Same answer every time.

[zugmeister]

Any time someone asks me what "the cloud" is I tell them to substitute the words "someone else's computer on the internet". Almost without exception they look thoughtful for a moment, then suddenly my previously expressed misgivings about putting personal / sensitive data "in the cloud" make more sense to them.

Re:Same answer every time.

[Anonymous Coward]

Some day later will be well after my lifetime and probably my children's children's children's lifetimes too.

Re:Same answer every time.

[mea2214]

A bird in the hand is worth two in the bush.

Re:Same answer every time.

[FlyHelicopters]

And you have to keep in mind that even well encrypted data will be easy to decrypt some day later.

Assuming there isn't a back door or other exploit, not really...

Modern encryption should not be crackable via brute force... ever... It would take more time and energy than exists in the Universe, the math is that big.

Re:Same answer every time.

[Anonymous Coward]

Never ever store ANY sensitive data in any form in the cloud!! Simple and easy!

I really cannot understand that there are people that think any form of "cloud" protection will work. Especially when an company has ties with the USA (or has an sigle office in the USA), you can be sure all your company data will be "leaked" to your USA based concurrent, so they can wreck your buisness.

Especially personal data would be never ever stored "in the cloud". It would be the same as dropping all that data completeley unencrypted on an open FTP site. Make no mistakes about that.

If you really want data to be shared, you store it at your local server, and give strong encrypted acces to only an select number of personel. Make sure that the software you use is either open source or developed and supported by an local company that has no ties with, or has offices and/or branches in other country's.

Re:Same answer every time.

[Anonymous Coward]

Until the hardware that data is stored on is owned and/or maintained by an USA based company. Then they can be legally forced to give acces to your data, and not tell you anything about that.

Gives an really cozy safe feeling huh?

Re:Same answer every time.

[geekmux]

Unless you're going to enjoy maintaining that offline system locked in a vault powered off 99% of the time.

Funny you should say that. I have an old Mac Mini with a bunch of external drives hooked up to it. Every other week it turns itself on, plays the Imperial March from Star Wars and runs a Carbon Copy Cloner incremental duplication of the files from my server. It emails me when it's done so I can turn it off, as there are multiple jobs and I can't tell which one will finish last. When it's done I turn off the mini and it sits there another two weeks. Every so often (when I think of it) I sync up to an old Drobo as well then unplug it. This means that yes, I do in fact have an offline system powered off 99% of the time. Sadly I do not have a vault but otherwise I have three copies of (almost) all my data at any given time.

Well, this is...rather inspiring.

I currently run a Mac Mini, but I will keep this in mind for a future project. Thanks!

My current project is tackling this issue from the other side, by culling my data down to what is essential. I mean hell, I was staring at 300 CDs and DVDs in my closet burned of various backups over the years. Grabbed 10 - 15 discs a day and tackled it. Got through it all, now I'm culling down the RAID array.

When we're carrying around 100TB pocket-sized SSDs in 10 years, I know this effort won't mean much, but it's more for my data inheritors. Kinda knew what anyone else was going to do staring at 300 discs; not go through any effort and trash them.

Re:Same answer every time.

[Megane]

tl;dr: me

I not only don't use cloud file storage, I run my own e-mail server and DNS.

Re:Same answer every time.

[Anonymous Coward]

Yeah, look up "Palladium" renamed "Trusted Computing", which is a complete lie. It's DRM with teeth: hardware encryption with the master keys to revoke or replace other people's keys all held by Microsoft, and almost all the keys held in escrow by Microsoft. There are *reasons* free software people are pretty upset about it: it's designed to tie your data to your particular hardware, and give a company proven to lie, cheat, and steal the keys "for recovery purposes"

Re:Same answer every time.

[Anonymous Coward]

> Yes, a bored script kiddie who downloaded a rootkit can find a way into your server

Fixed That For You. The NSA is hardly the big risk to most environments, it's the *ncessant* hammering at the security walls from every clueless script kiddie, with a very few competent crackers who send out tools for them to play with.

Re:Same answer every time.

[dl_sledding]

Someone mod this up. I am def going to use this definition in the future.

Thanks zugmeister!

Re:Same answer every time.

[Anonymous Coward]

Obviously you don't know much about computing much less encryption.

Re:Same answer every time.

[Anonymous Coward]

This is the best comment that I have seen all day. Sadly, the /. crowd these days are rather lacking in depth knowledge of anything technical.

Re:Same answer every time.

[Anonymous Coward]

So what are these encryption? And will there be any encryption techniques or implementation that does not have any weakness? Who can prove that?

Re:Same answer every time.

[AntiSol]

Wow, a sensible person on the internet! Who woulda thunk it?

Re:Same answer every time.

[JohnFen]

Umm, you didn't fix it for me, you broke it! I was intentionally and explicitly referring to all attackers, not just the NSA. That includes script kiddies (who happen to be the easiest crowd to defend against).

Re:Same answer every time.

[JohnFen]

If you use good encryption, do you care?

Yes, I care. In the first place, good crypto is not a panacea -- certainly not as good as maintaining physical control over your data storage. All crypto that is in common use (that I'm aware of) can be broken given enough time and effort. If you're using crypto to protect long-term storage, you're taking a risk. And, given that the NSA said they store encrypted communications indefinitely, all transmitted information is long-term storage. Remember the purpose of crypto is not to keep something a secret forever, it's to raise the cost of enemies reading that information and to delay the reading of it for long enough that it isn't valuable by the time it can be read

In the second place, crypto doesn't help at all with traffic analysis.

Re:Same answer every time.

[lgw]

It's crucial for liberty to make it impractical to do broad-reaching dragnet surveillance, and any real encryption of archives accomplishes that. Much like for email, PGP might have some weakness, but it's good enough to stop wholesale searches (unless there's something Snowden didn't know). If you're archiving actual state secrets or somesuch, by all means be more paranoid, but remember that for valuable targets, the NSA has a frankly astonishing toolkit, with dozens of ways to get a keylogger where they want it. In the crypto boards I follow, people are now hand-assembling their own RNGs from discrete components for keygen, because no IC can be trusted now. So I'm not sure "keeping physical control" really accomplishes much, unless you're wearing two layers of tinfoil hats (as clearly the tinfoil hatters weren't paranoid enough, fucking NSA).

Re:Same answer every time.

[JohnFen]

I agree about the use of crypto. Don't misunderstand me -- I'm not saying not to use crypto at all! I encourage its use everywhere. I'm just saying that it's not as protective of data at rest as lots of people think.

So I'm not sure "keeping physical control" really accomplishes much

It forces them to deal with you and your machines to get access to your data. It might give you a change to fight against the disclosure, but even if not, you at least know the disclosure happened. If the data is in the cloud, it will just get handed over and you'll never know.

It also goes a long way to accomplish the same effects that you and I agree about: making it more difficult to engage in wholesale surveillance.

Re:Same answer every time.

[mlts]

I treat the cloud as I do a type of storage medium.

The pros of cloud storage:

1: Depending on the type, one can store a lot of stuff on it.
2: Is it durable, and data stashed there is likely to persist even if a site goes down, or your drive array dies.
3: There are auditing tools available and access can be well controlled, depending on the cloud server.
4: It is easy to use. In fact, with OS X, it pretty much comes with the OS.

The cons of cloud storage:

1: The data can be stored anywhere geographically. You have zero clue who has access to it, what security measures (if any) are in place, if the data is stored on reliable hardware or on a cast-off laptop used to prop up a cat litterbox.

2: You have no control of the data. The cloud provider can go out of business, sell the servers, and the buyer of the servers now has your document stash and can do anything they please with it, even make a torrent out of it, without any legal liability.

So, with cloud storage, encryption is a must, be it image based (TrueCrypt, BitLocker, Apple Disk), file based (EncFS, BoxCryptor), or archive based (WinZIP, OpenPGP, WinRAR, StuffIt Deluxe, BCArchive [1]). The best encryption is what is vetted (TrueCrypt, GnuPG, PGP, NetPGP), but any third party encryption tool is better than no encryption.

[1]: It isn't TrueCrypt, but Jetico has a number of interesting, useful tools, from an archiving utility to a clipboard utility for decoding OpenPGP messages, to disk encryption.

Re:Same answer every time.

[mlts]

Hate replying to myself, but there is one major con I forgot:

Network access. If you have a dodgy, metered, or slow connection, this can be a major hindrance not just with access for a restore, but initial file storage.

I don't trust anyone

[magsol]

So I just remember everything.

Re:I don't trust anyone

[Anonymous Coward]

This is what scholars did in antiquity. See http://en.wikipedia.org/wiki/Method_of_loci

I've read Yates 1966 book, The Art of Memory, which everybody cites but almost nobody has read. It's a fascinating exploration of the history of the technique and how it evolved from a utilitarian skill into, ultimately, a form of mystical esotericism. Yates persuasively shows how the technique strongly influenced Western philosophy (Plato's theory of forms and Augustine's conception of God), architecture (particularly Church architecture, which is even today still used to help people memorize the bible), and art (she traces the evolution of symbols in paintings in Western art). She wasn't actually particularly interested in how the method was originally used. To her it was simply a given that it was a useful technique that became increasingly forgotten and divorced from it's original roots because of the decline of Rhetoric during the Middle Ages and the technology of paper and eventually mass publishing. See http://en.wikipedia.org/wiki/The_Art_of_Memory

A more accessible and vastly more entertaining book is Moonwalking with Einstein, a journalist's account of his learning the technique and eventually rising to the #1 ranked American in the World Memory Competition. The book has received rave reviews from all kinds of critics, and deservedly so. He also interviews scientists on how and why it works, and debunks a ton of myths in the process (like the myth of photographic memory, which nobody has been able to reproduce in a scientific experiment). See http://en.wikipedia.org/wiki/Moonwalking_with_Einstein

I've built a wicked memory palace (literally 1.5 miles long!), but I'm too lazy to put it to good use. The technique isn't magical. It takes practice, just like anything else, although it might come easier to some than others. The people with the most practice make it seem magical, however, because they can memorize and recall a ridiculous number of things, including entire books word-for-word.

Re: I don't trust anyone

[Anonymous Coward]

What the fuck is a 'memory palace'?

Re: I don't trust anyone

[Anonymous Coward]

You could just read the link at http://en.wikipedia.org/wiki/Method_of_loci.

Basically, the Method of Loci requires that you first memorize a 3-dimensional map with easily memorizable and stand-out areas. It's easiest to memorize a real, physical area that you've actually visited. Palaces, churches, institutional buildings, and even ornate gardens are ideal because you must rote-memorize every loci on your map, and be able to mentally walk through the map and past every loci. Another good option is your current or previous home. For example, you can probably quite easily visualize and mentally walk through your childhood home, no matter your age, and even if it was pretty mundane, simply because you remember every inch of the space.

This map is your "memory palace", and you'll memorize things by figuratively (but quite literally in your imagination) making associations between loci on your map and the item you wish to recall. How you make the association can be involved and takes practice. They should be evocative, both visually and emotionally, to be most efficient.

A well practiced person can memorize lists of hundreds and thousands of items this way. Speakers in ancient Greece and later Rome used memory palaces to memorize their speeches. They were so good at it that they could memorize epically long speeches the day before they were to speak. In fact, the technique was something that all students of rhetoric and philosophy would learn to some extent because it was a necessity at a time. The use of papyrus and slate tablets was tedious and limited. It was most efficient to memorize, in many cases word-for-word, the facts and citations you needed during argumentation.

Cicero explains it in detail in his treatise on Rhetoric, Rhetorica ad Herennium. The following pertains to the construction of "memory palace". Note that from Cicero's perspective, he was documenting a technique passed down from ancient Rome and with which most scholars would already be familiar.

"The artificial memory includes backgrounds and images. By backgrounds I mean such scenes as are naturally or artificially set off on a small scale, complete and conspicuous, so that we can grasp and embrace them easily by the natural memory — for example, a house, an intercolumnar space, a recess, an arch, or the like. An image is, as it were, a figure, mark, or portrait of the object we wish to remember; for example, if we wish to recall a horse, a lion, or an eagle, we must place its image in a definite background. Now I shall show what kind of backgrounds we should invent and how we should discover the images and set them therein."

"Those who know the letters of the alphabet can thereby write out what is dictated to them and read aloud what they have written. Likewise, those who have learned mnemonics can set in backgrounds what they have heard, and from these backgrounds deliver it by memory. For the backgrounds are very much like wax tablets or papyrus, the images like the letters, the arrangement and disposition of the images like the script, and the delivery is like the reading. We should therefore, if we desire to memorize a large number of items, equip ourselves with a large number of backgrounds, so that in these we may set a large number of images. I likewise think it obligatory to have these backgrounds in a series, so that we may never by confusion in their order be prevented from following the images — proceeding from any background we wish, whatsoever its place in the series, and whether we go forwards or backwards — nor from delivering orally what has been committed to the backgrounds. For example, if we should see a great number of our acquaintances standing in a certain order, it would not make any difference to us whether we should tell their names beginning with the person standing at the head of the line or at the foot or in the middle. So with respect to the backgrounds. If these have been arranged in order, the result will be that, reminded by the images, we can repeat orally what

Re: I don't trust anyone

[Anonymous Coward]

Got it, thanks.

Re: I don't trust anyone

[Anonymous Coward]

tl;dr Give up.

Whom ?

[Anonymous Coward]

Me, myself and I.

you can own it if you can defend it

[turkeydance]

oh, and pay taxes on it.

Re:you can own it if you can defend it

[IMarvinTPA]

If you have sufficient defenses, you don't need to pay taxes... (But by then, you're probably collecting taxes.)

Re:you can own it if you can defend it

[Kjella]

Good luck with that. "I saw you swerving back there, license and registration please." "You seem nervous and what's that smell?" "So you don't consent to a search? Let me just get a narcotics dog" "Why he barked, what a surprise." "Is that your stack of cash?" "Oh I'm seizing it." "Well you drive a car and lots of cash, drug dealers drive cars and have lots of cash so you're probably a drug dealer. Oh, and the dog barked" "Sure you can get it back if you get a lawyer and fight it a few years in court" "Thieves? No, just doing a public service. Now are you going to calm down or do I need to call in a SWAT team? They'd love to test their new paramilitary gear."

Re:you can own it if you can defend it

[TehZorroness]

I accidentally modded your post down when I spazzed out on the keyboard. This post should revert that.

Locally

[Anonymous Coward]

Current hard drives that I can physically handle will house this data.

Crashplan

[Anonymous Coward]

plain and simple, you decide encryption key, always works

Keep making copies

[Anonymous Coward]

Yes, media goes bad. You can't just leave your data in one place and hope it stays there.
Keep making copies on new media, and use all of the data integrity best practices that make sense for your use case--RAID, ZFS, whatever.
Keep testing your backups and making sure you always have multiple good copies of the data you want to keep.
It may mean a lot of work and some moderate expense, but only you can place a value on your own data.

My Attorney

[bragr]

I leave all my important data with my Attorney. I update it every so often which sometimes involves copying the old stuff to a new drive and adding anything new. My attorney is also a family member so YMMV.
As for my cloud data, I pretty much assume that any smaller company could go bust any day, and the larger ones could quite possibly be doing things with my data that I don't like. I use those services accordingly.

Nobody but myself.

[snarfies]

My long-term data is kept on NAS4Free box running ZFS RAID1.

If any piece of hardware fails, I can replace it and be right back in business. Nobody is going to hack into it. If I lose internet connectivity in any way, I still have full access.

Re:Nobody but myself.

[funwithBSD]

Ditto, and I use CrashPlan on that host to back everything up to Crashplan, as well as the server component to backup files there.

Yeah, use up more storage, but I have revision history and drives are cheap.

Re:Nobody but myself.

[pr0fessor]

I'm with you no one but myself.

As far as data 20 years from now, much of the data I keep aside from music and family photos will not be relevant in 20 years. Warranty information, order confirmations, receipts, and shipping information for products I've purchased is usually only needed until the warranty expires in 1-3 years. How long does software last 1-2 years or less before a new major revision makes it entirely obsolete and you are unable to upgrade with out purchasing a new copy. if you purchased it on cd/dvd there's not much point, if it's open source then it's likely to be available with the latest patches somewhere on the internet. I don't keep financial or banking records in digital format but even then 7-10 years. The size of drives keep going up.

I keep all my important data

[mandark1967]

on servers in the balkans and eastern Europe.

Wrong question

[crazyvas]

Wrong question, if it's asking for a storage company that you can trust your data with.

Correct question: which open source encryption software would you trust to encrypt your data /before/ uploading it anywhere. You can upload whereever you want, and redundantly too. All you have to do is store locally is a private key. No different from storing a passport or home or auto title.

Re:Wrong question

[Marginal Coward]

Good question. I asked something similar in a comment the last time this question was asked, only about a week ago but nobody provided an answer. Maybe we'll get one this time.

My own thought was to use 7-zip to make strongly encrypted 7z files, but somebody can suggest something better. In particular, it would be nice if such a tool could automatically do the uploading/downloading to/from the storage provider, which 7-zip doesn't do.

Re:Wrong question

[kdawgud]

Duplicity has worked well for me in the past on my linux server.
http://duplicity.nongnu.org/

Re:Wrong question

[Anonymous Coward]

Have you considered: http://duplicity.nongnu.org/

It's got some upsides and some downsides, but I like the fact that it uses standard unix formats all the way down. i.e., if duplicity were to disappear overnight, you can still use cat/tar/gzip/gpg to restore your files.

Yes, it can upload to some storage providers directly, and you can write your extension to upload to any other provider.

Re:Wrong question

[jeffmeden]

Good question. I asked something similar in a comment the last time this question was asked, only about a week ago but nobody provided an answer. Maybe we'll get one this time.

My own thought was to use 7-zip to make strongly encrypted 7z files, but somebody can suggest something better. In particular, it would be nice if such a tool could automatically do the uploading/downloading to/from the storage provider, which 7-zip doesn't do.

Something like Boxcryptor, perhaps? Although it only works with consumer grade cloud storage it sounds like what you want. Although it is $48/year on its own (if you want to do fancy stuff like manage multiple cloud accounts or encrypt filenames before storing them) so the costs of the belt to go with the suspenders can add up.

https://www.boxcryptor.com/

Re:Wrong question

[Anonymous Coward]

In particular, it would be nice if such a tool could automatically do the uploading/downloading to/from the storage provider, which 7-zip doesn't do.

www.tresorit.com

Trust No One

[Anonymous Coward]

Your data is your responsibility. You cannot trust anyone else. If there is a failure, they just point you to the TOS you agreed to. Stop wasting money on "cloud" storage and get two (different brands) of NAS or make two of your own (better). If your data is valuable, then it is worth the expense to protect it.

Trust but Verify.

[edibobb]

Trust but verify, and copy. For local archival storage, it's as easy as copying it to a new hard drive ever year or three. That way you don't end up with as much bit rot or incompatible data. It takes less and less (percentage-wise) storage each time the data is copied, because capacity grows so much. The older the data, the smaller it is.

Very Telling

[SuperKendall]

Even the most technically astute among us have lost data to storage format changes over time...

I've moved a lot of stuff forward to modern hard drives, but I'm sure there are some things I missed.

Basically there is no hope, so save what you can, and learn to live with loss.

Really network storage is the best kind of offsite backup but there you simply are going to have to live with the fact that MULTIPLE foreign intelligence agencies will have your data (not just the NSA). Encrypt it to reduce casual prying also from network admins, but just understand everything put on the internet will be seen by someone else.

Re:Very Telling

[Anonymous Coward]

Even the most technically astute among us have lost data to storage format changes over time......

Speak for yourself, not others. :)

no one

[phantomfive]

"But it makes me wonder: Whom do you trust with your data?"

If they have the only copy of your data, by Murphy's law it will be lost. Keep a backup, the 'cloud' loses data all the time.
If they have an unencrypted copy of your data, by the rule of the internet, it will be made public.

Myself.

[Immerman]

On both counts.

Nobody else has any significant vested interest in preserving my data - at best any business will have to pay me a penalty if they lose it - almost certainly a pittance compared to the personal value of the data, and a tradeoff they will almost certainly make without hesitation if it makes sound business sense. And should they go out of business, well heaven help my data, they certainly won't - the corporation is already sunk, and it's not like any of the individuals have anything to lose. Non-incorporated businesses may have more favorable (to me) liability repercussions, but are also far more vulnerable to disruption and/or collapse due to personal tragedy

As for ownership - as the old truism states, possession is 9/10ths of the law. If I want to retain ownership of data on someone else's hardware I encrypt it securely before I give it to them. Anything less is an invitation to data-mining, at the least.

Hard disks get bigger.

[TechyImmigrant]

Hard disks get bigger.
Store your data on a reliable raid or mirrored array.
Feed it every 1-2 years with fresh, bigger hard disks.

You will never run out of space if you are a normal household.

Re:Hard disks get bigger.

[Anonymous Coward]

This. I use a RAID1 and a removable backup drive - all server class. That's three copies of everything. Today I bought another removable drive so I'll have four copies, with one off site at all times. Baby pictures and movies really make you think about reliable long term storage.

Re:Hard disks get bigger.

[bananaquackmoo]

That's nice and all... until a fire burns down that building and you've lost a lifetime of data.

Re:Hard disks get bigger.

[Anonymous Coward]

To avoid this, I keep three backup disks. Two at home, one at my brother-in-law's house. I rotate them weekly (more frequently if I generate a lot of new data). Worst case, I lose a week's worth of data.

Before you suggest natural disaster wiping out both our homes, if we live through a disaster of that magnitude, my data will be the least of my worries.

Re:Hard disks get bigger.

[TechyImmigrant]

I occasionally take a backup disk to work, which is a very Earthquake and fire resistant building. I also keep some of the most important information (tax, insurance details etc) encrypted on a cloud drive.

Re:Hard disks get bigger.

[allo]

RAID is no backup!

Absolutely nobody ...

[gstoddart]

But it makes me wonder: Whom do you trust with your data?

Know who you can trust?

You, and encryption you implemented ... absolutely nobody else. Period.

And, really, if they break into whatever keeps your private key for your crypto, you can't even trust that.

In an age where spy agencies have decreed they're allowed to do anything, and don't care about jurisdiction ... assume the world is full of malicious actors.

Because it is.

If you're an acquisition by a US company away from having your data be under their jurisdiction, assume they'll get into it even if that involves breaking your country's law.

Re:Absolutely nobody ...

[geantvert]

Implementing your own encryption is probably the worst idea ever.

Re:Absolutely nobody ...

[ScrewMaster]

Implementing your own encryption is probably the worst idea ever.

I suspect he meant "an implementation using existing encryption software that you selected yourself."

Re:Absolutely nobody ...

[JohnFen]

You, and encryption you implemented ... absolutely nobody else. Period.

Encryption you've implemented?? If you aren't actually a cryptographer and you haven't had your implementation tested by other actual cryptographers, then you're making a terrible mistake in trusting your implementation. It's incredibly easy to implement crypto that looks and acts as if it is correct, but contains a hidden, subtle flaw that renders it easy to crack nonetheless.

Re:Absolutely nobody ...

[Anonymous Coward]

Depends. If your primary objective is to make sure man-hours get wasted instead of actually securing your data, security-by-obscurity might make more sense than anything.

Anyone

[al0ha]

I trust anyone, including iCloud, but then all my data uploaded to a *cloud*, outside of music files, is GPG encrypted with a 4096 key, and that includes the Truecrypt containers I upload and store in the cloud as well, GPG encryption with a large key and super long pass is safe enough for the foreseeable future, at least the next 20 years I hope, and by then I won't care.

Disclaimer - I do keep local copies as well, redundancy is important as who knows when a *cloud* service will go tits-up as they like to say at El Reg...

I'm not overly concerned to be honest

[Anonymous Coward]

I don't store anything online I'd care if someone saw. Photos of my family and myself are all I store online simply because I need a backup because I lost some very dear photos last year and Dropbox makes sense.

Now, I'm hesitant to upload my taxes and things with sensitive info like SSNs and the like, but photos, no worries.

Trust no one...

[Anonymous Coward]

and encrypt your data before you store it in the cloud. If you don't encrypt you only have yourself to blame for leaks.

Argh pick one:

[Anonymous Coward]

To whom do you entrust your data?

With whom do you trust your data?

Illiterate moron.

Re:Argh pick one:

[bigfinger76]

Hate to pick nits here, but OP can obviously read and write. Your gripe is more with grammatical proficiency.

Re:Argh pick one:

[skegg]

I presume what AC meant was that OP should learn how to write proper.

Re:Argh pick one:

[bigfinger76]

Whoosh.

Everyone

[Anonymous Coward]

I entrust my data to everyone. The only way for my data to be lost is for human extinction to come!

How

[rgmoore]

How should I make sure that I retain access to today's data 20 years from now?

If you really want to be able to keep your data that long, you need a serious plan. You need to back up everything to at least two separate devices other than your main storage, and you need to keep at least one of those devices off-site so your data can't be destroyed in a local disaster. You need to test your backups regularly to know if/when your medium is failing.

When a medium fails- or if you think it might be about to fail- get a replacement that uses more modern technology, and make a fresh copy. If you are ever about to replace your computer with a new one that can't read your old backup medium, buy newer media that does work with the new computer and make copies while you can still read the old ones. If you keep doing that regularly, you can always have a good copy that will work with your computer. It's more effort than copying to the cloud and trusting, but it means you're in control of your own data.

The real key is to keep making regular backups and regular tests. If you expect to be able to put something into a box and still use it 20 years later, you're in for an unpleasant surprise. You have to keep copying, testing, and updating your technology in order to have a serious hope of keeping up. If you do that, though, you have a very good chance of keeping access to your data at least as long as you have software that will still read it. I have 20+ year old data at work that I can still access because we've been careful about moving it to new media, and because the company that wrote the software is good about backward compatibility.

Re:How

[Anonymous Coward]

Exactly. And if those devices requires power, keep both devices powered off except when backing up, restoring, or testing media. Also, the off-site backup must be in a place where no one else can access it, or that is owned/controlled by someone you can trust with your life. Currently hard drives, and possibly SSDs and flash drives are the longest lasting storage devices. CD-R and DVD-R and DVD+R media become unreliable after a few years.

Long term storage: process is more important

[QuietLagoon]

How should I make sure that I retain access to today's data 20 years from now?

I still have my long-term MSDOS backups from 1991. The backup file is a whopping 13MB in size, and that includes the OS, a word processor, a C compiler and my source code.

.
I just made sure that I continually copied forward the backup files I wanted to retain. Each iteration of archival storage increased about ten-fold, so space wasn't a problem.

I think it is more important to have a good archival process in place. To the OP, the error you made was leaving all the data you want on old floppies and IDE drives, etc.. You should have moved that data off to more current media as your processing moved to more current media.

Re:Long term storage: process is more important

[Kjella]

I think it is more important to have a good archival process in place. To the OP, the error you made was leaving all the data you want on old floppies and IDE drives, etc.. You should have moved that data off to more current media as your processing moved to more current media.

And this part you can get professional help with. You encrypt it, they deal with redundancy, backups, integrity checking, media rotation. keeping it in multiple geographical locations and whatnot. Yes, you can do it yourself but if you put it on say Amazon Glacier you can be pretty sure it's there (unless an evil hacker gets access to your console and deletes all your archives, I guess... but not due to media deterioration)

Re:Long term storage: process is more important

[Megane]

I have TRSDOS backups from the mid '80s. Years ago I imaged a bunch of .DMK files with a Catweasel board (including the bad sectors from back in the day), then used a utility to extract files from the images. I can now use them with an emulator. While I was at it, I even imaged some random Osborne and Kaypro CP/M floppies that I had found.

My remaining big project someday is that I have a bunch of TRS-80 cassettes from back when I was a kid. I have ripped a few of those, but the crappy signal levels are as much of a pain in the ass to decode with software as they were back in the day with hardware.

Re:Long term storage: process is more important

[maestroX]

GWBasic is not a reliable encryption technique

no one cares about your data as much as you do

[Dan667]

A lot of these issues were painfully learned with mainframes decades ago. The lessons are not changing.

Whom do I TRUST?

[BranMan]

Three individuals:
Me
Myself
and I

EOT

Re:Whom do I TRUST?

[Anonymous Coward]

You will need ways to protect you against yourself. As the saying goes, "You are your worst enemy".

Nobody will ever be able to get my data

[ArcadeMan]

As soon as I finish working on something, I delete it.

Me, myself, and I

[Anonymous Coward]

Ask Slashdot: With Whom Do You Entrust Your Long Term Data?

Me, myself, and I. All three of these persons can be trusted with it; I'd be hard pressed to name any others. So I keep all of my data at home, on the 25+TB that's online there (sorry, less than 1TB of that is accessible from internet), and the 20+TB of external backup (some data duplicated). Not all of the disks are full, of course, so the 25+TB online actually holds only about 15TB at the moment.

Re:Me, myself, and I

[ganjadude]

Me and I can be trusted, Myself on the other hand.....

Same answer and the only answer

[Anonymous Coward]

Jesus. Who else can save ya?

Nope

[Meneth]

Data isn't property. It cannot be owned. It can, however, be controlled. I suggest you don't let anyone else control your data.

Locally migrated to modern formats

[aliquis]

How fucking hard is it?

"Oh I don't deal with floppies no more and the optical discs can't be read!"

So?

Currently it would be hard-drives, even if that mean the new one will be half-filled with the content of your old one (depending on how you do it ..)

How far in the future they will scale or whatever we'll deal with data volumes it's reasonable to keep at home in the future I don't know.

For now it's not harder than getting discs + NAS / whatever yourself.

Get a fire safe

[rwa2]

I got a nice beefy Winchester fire safe from Costco for ~$300 . No state sales tax on it either, I suppose since they want to encourage people to lock up their firearms.

There are much cheaper "plastic water cooler" fire safes available... some even have USB ports on them so you can backup to a big USB disk in them without having to open them.

I still encrypt and backup annually to AWS Glacier ( 42cents per month for 42 GB at the moment, mostly raw camera photo dumps) using the SAGU java client. Also have some online offsite backups of less important stuff from my home dir rsync'd to a HDD I bought for a friend's server.

But as you can see, I'm more worried about losing my data than someone else finding it.

Who do I trust?

[Anonymous Coward]

What company do I trust with my data? None of them!

Sure, I use Dropbox and the like for ordinary stuff, but I won't put sensitive files there and I always have a local backup copy.

These companies are here to make money off of you and me. Why would anyone expect them to act in our best interest?

-JS

Offside storage

[spectrum-]

Things nobody has mentioned here for those not using cloud services are losses due to 'acts of God' for want of a better description. In short if you have RAID on your home NAS you're still at risks from fire or floods or even tornadoes. Fire proof safe not much good if it's been torn into the air and basically lost. It's always a good idea to have a remote backup solution be that a host you pay or a trusted friend. I always think it's a good idea to collaborate. You mind your friends data and they mind yours. You both have a vested interest in safeguarding each other's data. Encryption still good of course but geography and mother earth are foolish to ignore.

With whom do you entrust your METAdata?

[fph il quozientatore]

As many have said, this is a non-problem if you use encryption. A more actual problem is: who do you choose to give your METAdata? If you have Dropbox permanently running on your pc, encrypted or not, they get to know when you are logged on your PC and where you are. Similarly for your mail provider and your instant messaging/VOIP provider. Hell, your NTP server of choice could probably log your location by geolocating your IP address and fingerprinting your NTP request.

me

[MakersDirector]

I trust my data with me :-)

Floppies and IDE still have options...

[BUL2294]

The OP is not considering some easy options for his/her IDE & floppy dilemmas...

IDE - Find a USB-IDE enclosure. Sure, nobody makes them anymore, but there are plenty of used ones out there for 3.5" and 2.5" drives. Spend 5 minutes on Craigslist or eBay.
3 1/2" floppy - Seriously? You can pick up a brand new USB 3.5" floppy drive for US$10 on Amazon (and eligible for Prime).
5 1/4" floppy - This one would take a little more effort--buy a FC5025 card, a used 5.25" drive, an old USB enclosure (with a Molex power connector)--if you don't own a desktop PC, put it all together. Or pay someone to do it...

2c

[snkhere]

Colin Percival at https://www.tarsnap.com/ He knows what he is doing. And my local storage.

Can't access IDE drives and floppies? Really?

[Digital Pizza]

How is it that you can't access floppy disks and IDE drives now?

Here:
http://www.newegg.com/Product/...

And here:
http://www.newegg.com/Product/...

Those are from a simple google search, and among the first links returned; you could probably find cheaper deals than those.

Re:Can't access IDE drives and floppies? Really?

[jppiiroinen]

It is not about having a device to read them, but the hardware will which either controls the data or the media on which the data is physically stored will go bad over the time.

Myself

[JohnFen]

I do not trust any third party storage for my data, short or long term, and especially not cloud providers. It is legally impossible for them to guarantee that it remains safe from spying. Instead, I keep my data stored on my personal servers that live in a place that I physically control.

Who do I trust with my data?

[ScrewMaster]

Why ... me, of course. I don't keep anything of consequence on any cloud-based storage system.

You're fighting the entropy of the universe

[zedaroca]

When you organize so many bits you are fighting the very nature of the universe.
There is no safe place or method, you just have to keep making copies of everything, multiple zfs NASes in different locations is a start, but you can't trust just that, you have to update storage methods. Make tape and disc copies, have them in HDDs and SSDs, print whatever you can. Hopefully, when you try to access it, the universe will not have ruined one of your copies.

I doubt adding more people, companies and laws to it will be of any help.

Myself.

[neminem]

> Whom do you trust with your data?
Me.

And who really owns it?
Me.

What about in 3-6 years from now?
Still me.

How should I make sure that I retain access to today's data 20 years from now?
Keep it on a backup. When your primary starts to die, get a new primary. When your backup starts to die, get a new backup.

Is storing things locally even a reasonable option for most people?
Why not?

Also, if you do still have data in floppies (which, why, they were a great transport medium at the time, but never a particularly great long-term storage medium), you could pick up a usb floppy reader for basically nothing. 3-second google found one for 12 bucks, and I'm sure you could find one for cheaper if you spent more than 3 seconds looking.

Same answer and the only answer

[Anonymous Coward]

Ghostbusters !

The NSA

[LionKimbro]

I keep thinking that the NSA should just open up it's own free public Dropbox/Drive/SkyDrive, so that we can eliminate redundancy.

What is more reliable?

[rrohbeck]

A file server with a reliable disk subsystem and file system that is maintained well, or a company that probably won't be around any more in 20 years?

With Whom Do You Entrust Your Long Term Data?

[W.Brooks]

A "Private Cloud" provides the benefits of data security and easy access to your data from any pc, laptop, tablet or smartphone. I use Owncloud Community Edition running on a desktop in my office. There is also an Enterprise Edition for larger organizations. I know exactly where my data resides and I have control over who gets to share it. I tried a number of other tools to give me secure remote access to my data, but none are as simple to setup and operate as OwnCloud.

Schooling fish

[NapoleonXXX]

Most likely only a small portion of your data should be critical to hide from the outside. Let's say text/code documents, some pictures, and perhaps some video or audio clips. If you are using a cloud storage you have to assume your data will be read by the NSA, FBI, Hacker or other governments at some point. So, your goal is to camouflage it so well that their bots, and their analyst discard them as unimportant. Hackers are not a concern, but powerful entities that have the means to analyze your data exhaustively using several powerful tools available to these people. So visually, your data will seem to be a regular fish in a schooling fish for every tool that analyzes it. You will need to mix this data among several chunk of similar files. The smaller size the better. That would mean that your data has been encrypted and then you split it as many iterations and combinations as possible only known to you. You then code your own simple algorithms that will mix this data across several known files(images, videos, dlls, drivers, and so on). That way, a bot will pass it over since all that is reading rises no red flag. An analyst will discard it because the image has no relative meaning to him, and running software that analyzes for known algorithms gives no positive results at all. A hacker will no go as further as a bot or analyst. That way your data can be stored on any cloud service. That however is a complex process that you will have to religiously follow to back it up, and restore it. At least your data will be safe for some decades, as technology improves so will the bots that analyze your data, and at some point they may break it. Hopefully, by that time you will passed away. Unless you are a person of interest for a powerful entity in charge of analyzing this data for hidden information, your data will be most likely safe. As long the hardware you are using has not been compromised, your data will be safe.

Same Questions Same Answers

[Anonymous Coward]

Why do we keep having these types of articles? The answers are always the same:

1) You have no control over cloud data. It can fully disappear at any time or be modified without your knowledge.
2) Encrypted cloud data is better that non-encrypted, but there's no way to take it back. They will have until the end of the universe to un-encrypt it if they want too.
3) Hardware fails and data formats change. As tech progresses, copy all of your old data onto new hardware (that gets easier year after year). Backup not just the data, but the programs that read it (and what those programs require, etc...) and the tech specs of the format. Try to keep as much data in open, documented, and text based formats. If it needs specific hardware, keep the blueprints, but you're probably screwed as you can't keep the parts.
4) Don't keep so much data. Do you really need your high school papers when you're 50? Though with expanding storage it's no effort to keep it if it's well organized, so organize before backing up.
5) De-duplication saves space, but if that sector fails you lose every 'copy' of that data instead of only only one copy becoming damaged.
6) Hash all your backups so you know when they get corrupted (and they will because you never need to destroy a backup. Keep them until the hardware dies in the rare case that you damage or lose all your more recent backups).
7) Take the backups on your older hardware and lose them in your parent's house (or grandparent's if you live with your parents). You need duplicate copies of your data in different physical locations on different physical devices. The same type of hardware might have the same type of defects.
8) The process of making a backup includes having a way to restore it.
9) The internet doesn't forget but isn't forever. Content is lost. Don't assume that if it's online it'll stay there forever. Torrents die all the time. Sites close. Restructuring breaks links. Companies blast take-down requests.
10) RAID isn't magic.
11) Trust no one, including yourself. Forgetting to do something or where something is located is easy. An automated backup task that silently works can silently break.
12) Your backups are at the most risk when you're in the process of backing something up or restoring something.
13) Never touch damaged hardware, clone it to something that works and work on the data there.
14) Always backup before restoring. You don't want to accidentally lose something.
15) The more of these practices that are followed, the better chances of your backups performing well when needed. But be reasonable, don't waste your life away making backups of the life you used to have.
16) Backups fail. Your life isn't over and even if it is, the world goes on (unless it's the backup fail-safe to a doomsday weapon). Don't sweat the small stuff, or any stuff.
17) Don't produce anything worth backing up.
18) Gain the Brunnen-G belief that time is circular. That everything has happened before and will happen again. Thus eventually you'll have the data again.

Did I miss anything? Someone should repost this every time a data storage question comes up.

Me.

[pubwvj]

I don't trust my data to anybody but myself. I maintain control. I keep all my data moving forward on multiple copies of my latest hardware.

Realize that when you put your data out in the cloud it is subject to both corruption and scrutinization. How do you know you are getting your data back? You don't.

Call me a control freak, please, but at least I have my data. In the cloud you are nothing but a wisp of smoke that dissipates with the whims of the server owners.

All my long term data...

[Anonymous Coward]

...is in my brain. When that fades, I'm not sure i will care for it either way.

It it is not on my brain, then it is not important or not really just mine.

FreeNAS

[cen1]

My 8TB Raidz2 FreeNAS box obviously.

The Packrats Creed

[ihtoit]

This is my hard drive. There are many like it, but this one is mine.
My data is my best friend. It is my life. I must master it as I must master my life.
My data, without me, is useless. Without my data, I am useless. I must secure my data true. I must make more secure than my enemy who is trying to steal my data. I must defeat him before he defeats me. I will...
My hard drive and I know that what counts in information warfare is not the scripts we write, the AV packages we deploy, nor the smoke we create with false data. We know that it is the redundancy and security that counts. We will secure and survive...
My hard drive is human, even as I, because it is my life. Thus, I will learn it as a brother. I will learn its weaknesses, its strength, its parts, its accessories, its power connection and its interface. I will keep my data clean and ready, even as I am clean and ready. We will become part of each other. We will...
Before God, I swear this creed. My hard drive and I are the defenders of my data. We are the masters of our enemy. We are the saviors of my life.
So be it, until victory is Liberty's and there is no enemy, but peace!

  - Me (from the Rifleman's Creed)

Take a bit, leave a bit?

[TiggertheMad]

"When I need important data, I just steal it from other people."

Don't trust the "Cloud"

[rstanley]

You have no idea who is accessing your data, aspecially the NSA!!!

I keep telling all my clients, "Keep your friends close, your enemies closer, and your data in your pocket!"

Keep it all locally with secure offsite backups. Or at least a colocation backup server.

Trust no one

[penguinoid]

For data storage, trust no one and especially not yourself. Always keep a local copy, and copies stored by professionals (but more than one because in the long run they will go out of business), and make sure some copies are backups that your computer doesn't have access to so malware can't delete all your copies. This is, assuming your data is worth that much trouble.

For privacy, trust encryption makers rather than any big juicy targets for the NSA/hackers/whoever that are online storage companies. The difference is that encryption gives you a way to secure your data and that is all, whereas online storage companies have your data and are able to give the government access to it if they "ask nicely" and have financial incentives to slack on their data security. And make sure you don't accidentally install malware. Even so, if the NSA wants your data, they will get it -- presumably through a backdoor in your boot loader or operating system or other software, although maybe they'll add that personal touch and install a hardware keylogger.

Of course, you can combine both, by uploading encrypted files to the cloud.

Me

[Anonymous Coward]

I trust me. No one else.

nobody.

[Anonymous Coward]

next question.

On My Own Server

[Foresto]

I don't trust my data with any cloud storage company, because none of them can be trusted.

Most of my data gets backed up to encrypted disks that can be stored off-site.

Data that I need to access remotely, like my phone's calendar and contacts, live on my home server. It runs only the software that it needs, sits behind a firewall, and is updated with security patches regularly. It has a much smaller attack surface than any cloud storage company's data center, and is a much less interesting/valuable target for attackers.

Of course, running a personal server has long been the domain of people who have lots of computer admin knowledge, but that is starting to change. Projects like ownCloud, arkOS, and FreedomBox are working toward making it easy. Low-power server hardware is getting dirt cheap. It might not be long before anyone capable of using a smartphone or game console can set up their own file / calendar / contacts / mail / whatever server for under $100 (including storage).

Connect a fire safe directly to your nas

[Anonymous Coward]

Anyone tried one of these? Put an SSD inside a fire safe and connect it directly to your nas.

http://www.amazon.com/SentrySafe-QA0121-Fire-Safe-Waterproof-Storage/dp/B00166187Q

I trust me.

[bloodhawk]

Whom do I trust? I trust me and only me. any data I value doesn't leave my possession and if stored online is encrypted using a method of my choosing. the data I do store in cloud providers is only data I don't care if someone else manages to get ahold of.

As many have said, self storage for the win.

[Karmashock]

Look, the virtue of the cloud is that you like having easy access to the data. Probably you don't know how to set up or don't like the idea of using a personal FTP server or using the MyCloud system to set up your own cloud storage system.

I get it. However, if you actually want to be secure, then that is the bullet you have to bite.

The NSA is not going to hack 100,000,000 different micro servers especially considering that a lot of them are going to be different. They're all going to be behind different routers, running on different operating systems, and using different hosting packages.

And of course, they're all going to have different passwords even if most of them are "littlekitty35" or something. Simply divesting ourselves of centralized storage makes the NSA's policy of compromising a central data repository and mining it impractical.

If you want help setting up your own personal cloud server... Ask around. many of us know how to do it. Personally, I'm a big fan of just using a cheap as hell Raspberry pi, installing mycloud, etc on it and then just hosting my data off my personal internet connection. That seems quite reasonable to me. I also use an old laptop as a media server in my home. I've found the pi to be too slow to run HD content in many cases and certainly not strong enough to do real time transcoding if I want to share my home media liberary with my phone OVER the internet sort of like youtube... only with my movies, music, etc. I just sit down somewhere with wifi, log my phone into my home system, and I can browse all the content in my home file servers. Pull up a movie or file I want... and either stream it live to my phone at a bitrate my current internet connection can handle... or just download it to the phone.

Self hosting is way better. I can even share my content with friends really easily. I just give them the URL to the content stored on my system. Easy peasy. They can even upload things to my system if I want. It is perfect.

Re:As many have said, self storage for the win.

[Antique Geekmeister]

> personal FTP server

I'm afraid that, in this day and age, with the monitoring of FTP logins in man-in-the-middle attacks worldwide, no public facing FTP server should be considered "private". FTPS or FTPS or any of several other good protocols all can help with this. But I've encountered far too many environments where people use the same password for their FTP, and their email access, and insist on making it publicly available. Then they wonder why their systems get broken into.

Re:As many have said, self storage for the win.

[Karmashock]

It was just an example. Choose your hosting software of choice.

Re:As many have said, self storage for the win.

[Antique Geekmeister]

I'm afraid that you're going on to expose part of the underlying problems. 100,000 individually built, individual managed servers are likely to suffer 50,000 catastrophic failures for dozens of different reasons, ranging from lost passwords, accidental deletion with no snapshots, hardware failures, breakins due to incompetence such as using FTP, breakins because they choose terrible passwords, and others. These are _precisely_ why so many people are going to cloud services

Frankly, many of the "just ask around" answers you'll find even from technical friends, are horrible and have profound consequences to the safety or reliability of your data. I make quite a bit of my own salary helping companies clean up the results of technologically skilled admins. Many of them didn't bother, or didn't know how, to run real backup services and the results are devastating.

Re:As many have said, self storage for the win.

[Karmashock]

As to lost passwords, one can assume that any such system grants passive root access to anyone that has physical possession of the system. My own servers for example have no passwords for local access. It is only remote access that requires passwords. I forget my passwords all the time... I just reset them. No big deal.

As to backups... back up your data. Why is this so hard? I have an old computer that sits in my closet. It is slow but it draws very little power and has a lot of connections for harddrives. It is my personal file server. I believe it has 10 hard drives in it. And each of those is synced to another on a bit by bit level. I don't think it is technically raid 1 but it is effectively the same thing. Everything is backed up to that system and when one of the drives goes sour, it isn't a big deal to swap it out for another. The cost of all that was just about zero considering that all the parts are surplus computer parts that otherwise would have been thrown away. My only real expense is electricity. Which is negated to a large extent by the fact that most of the enemy is emitted as heat and that heat moderately warms my home and that means my heater kicks on slightly less often. And that means a portion of the energy spent on that machine is actually free. Still... even without that, the unit draws very little power. The computer spins down and turns off drives that aren't used for 10 minutes.

As to why people go with cloud services... because they're lazy.

As to not knowing how to run real backups. I am admin and have run my own backups on my own systems since long before the cloud ever existed. I have never lost data on any system I was responsible for maintaining. Ever.

Why? I back things up in a minimum of 3 places when the data is important. And a minimum of two places when it isn't.

I also am a big fan of the GFS system because it is very simple and very effective.

On one of my systems a script runs every night, it updates a Zip archive of a database. That is effectively one backup in itself as it is on a different drive within that server.

Then that Zip archive is renamed to the current day and pushed to a different server. A total of 7 days of backups are maintained on that system. They're Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, and Sunday.

Every Saturday night, a version is pushed to a third system. This system maintains a copy for every Saturday in a month. I might change it so it has a copy of every Saturday in a year but I on the fence about that. I don't really see the point.

Then on the first day of every month another copy is pushed to a forth system and that system maintains a copy of the database as of the first of the month for an entire year.

What is the point of all this? Fraud, data corruption, backups. Lots of reasons. Employees at that company can enter bogus information into the database to steal from the company and by maintaining literal copies of the database through time we can figure out when it started and to what extent it was done. Here you'll say "but if your database is set up this way"... which ignores that the employees are not stupid and are quite capable of subverting quite a bit of the security policy if they choose. A flaw in that database perhaps but that is what the company uses and I had no say in that. My job is maintaining the system. And I do that.

I do agree that most backup programs are crap. I've used a lot of them and the ones that cost 500 or 1000 dollars are often a total waste of money.

The script that does that GFS backup took me a couple hours to write from scratch and so far is the best system I've seen that doesn't do continuous live backups. I've even built little subroutines into it so that it will text message me when it has a problem by sending an email at my provider's email to text message portal. It is just such a nice little script.

The cloud WAS a nice idea. But frankly the NSA and US government in general has made it clear that it is a liability and people should really just stop being such lazy assholes.

NAS box on a local lan

[Anonymous Coward]

I have a NAS box on a local lan. Important stuff gets archived. SSD's have a long life. I can store 4 TB of compressed data. I suspect it will last 20 years. The NSA can't get to it, nor can you.

no trust in others. ever.

[Anonymous Coward]

i don't have any trust in other people/companies to secure my data. i am regularly checking the integrity of my files as well as doing regular backups. i'll be good till the day i die. ps fuck "the cloud".

Only myself

[pmontra]

I trust only myself and it's not easy. Local storage won't survive a fire and remote backup of locally-encrypted data is always a little too painful.

Thanks guys!

[jppiiroinen]

I do see that many of you prefer the idea of having stuff encrypted and stored in many different locations, some on the cloud and some on your own property.

The topic itself might be easy to answer, but I do feel that it is not that simple and there is no single right answer either.

For example, the data (pictures, videos etc) might have value for the younger generation, but if you encrypt it, those will be gone after you are away. I know that that is a far fetched topic, but still valid. I think that one big question is that how do you document all the places where your data is stored an in which format for the younger generation, so that they can access it and know it that it is there.

For the physical devices, like the old disks, the weak point has been the controller boards, and for the floppies, I must have stored them in near speakers etc. CD's and DVD's must have gotten too much UV radiation from the Sun. Once I did try to keep up with the storage media wars, but it was too time consuming and error prone as well. And I did have setup offsite backup, but the upload bandwidth was too narrow to handle the huge data uploads, some days 32-64GB of raw images.

During the years I have been thinking that maybe it would make sense more to develop some kind of software to provide data to paper conversion, such as High Capacity Color Barcodes. Then I could just write a software which would convert the data into raw photo files and then ask the some shop to print them on some real photograph paper. This way the data would be accessible for the next generation and it would be kept private, while the source code and technical papers would be made available as open source. But having something like that might not be doable right now, giving that the resolution which the images can have might not be good enough to store more than few 100kb per image. But it would be good enough for storing some source code. Does this sound like a good idea? As if it does I could start to work on it on GitHub on my spare time.

For this I did do one experiment few years ago, where I was checking how fast I could transfer data using barcodes. I made a software which was synchronizing data between mobile phone and desktop without any cables or wireless connections. It was just using the display and the camera. The funny part for that is that the laptop failed and the data was lost, but the idea was simple and it worked.

But I do thank you for your time and I feel a lot better knowing that I am not the only one puzzled by this long term data storage issue.

Flash drive and a strong safe

[Anonymous Coward]

Keep all your long term data on a flash drive and keep the flash drives labeled and in a strong fire proof safe. The question remains: what file system to use on the flash drive. Will drivers always be around for NTFS? I don't see that as likely, because NTFS is proprietary. Linux file systems aren't easy to access from non-Linux platforms. Therefore a universal replacement for the FAT file system is needed for large volumes of data.

With Whom Do You Entrust Your Long Term Data?

[Anonymous Coward]

No One !!!

Cloud Computing is Careless Computing

[Anonymous Coward]

Ok - one more time ....

  "Cloud Computing is Careless Computing"

Learn it. Know it. Love it.

Trust nobody. Especially if they do it for free!

Me

[Beacon11]

I trust myself. Get a plug computer with a few USB3 ports, set up software RAID with external hard drives, and you have a server that can run ownCloud using less power than your desktop when it's off. It's worked for me for years. My family uses ownCloud for shared calendards, uses ownCloud for our contacts, and stores all pictures/music/etc. on ownCloud. Bonus: You can host other websites on there as well (I have a few blogs), keeping even more data to yourself!

Weakness of the digital age

[bradley13]

Most of the comments are technically correct, but everyone seems to have accepted the elephant in the room: We have no decent archival solution for the digital age. The bookkeeping done by monks 600 years ago can still be read today, as long as you can make out their handwriting. Accounts from 19th century companies were kept in ledgers. Barring fire, flood or other disaster, any ledgers someone thought were were keeping are still legible today. Some readers may recall that UBS got in trouble for trying to destroy bank records from WWII - but those records still existed with no effort whatsoever other than having them stacking in some storage closet for 70 years.

Yet without a serious and sustained effort, digital data self-destructs. No commonly used media has a storage life of more than a few years. We have all accepted this as fact, but it is actually a problem in serious need of a solution. As more and more records are kept online - business records, governmental records, personal records - the danger of serious data loss increases.

Want a recent example? In the US, the IRS lost important emails from personal mail accounts, because they had no archival strategy. If they were lying (which I personally tend to suspect), then it was an entirely plausible lie, which still serves to make the point. Just as with security, archival is an overhead expense that management doesn't really want to spend money on.

RAID is stupid for most home users

[Anonymous Coward]

RAID is stupid for most home users.

RAID has 1 purpose - HA.

Backups have 1,000+ purposes and can help solve RAID issues.
I see home users getting in to trouble over RAID and not having any backups.

The level of ignorance about this stuff is just too high.

Backups, yes. Then after that, if you need it, RAID.

Re:RAID is stupid for most home users

[TechyImmigrant]

I did mean you should use a RAID NAS as a backup device. Have you computers back up their data to the RAID NAS.
So when a magnetic drive fails in a computer, you can recover from the NAS. When a NAS drive fails, you can just replace it, because it's a RAID NAS.

Eventually you will pay

[fluffernutter]

The thing that worries me the most about storing files in "the cloud" is what will happen when there is a critical mass of people who have GBs of things they want on other people's servers. What a wonderful profit stream to charge people for the transaction of withdrawing a copy of the thing you want, much as the banks do for currency today.

To hell with 'the cloud', store your own data!

[kheldan]

High capacity USB hard drives are cheap an ubiquitos and USB won't be going away any time in the forseeable future, and can be stored in a bank's safe deposit box, or if you're super-paranoid, sealed in a waterproof/weatherproof container and buried in your backyard or out in the wilderness somewhere. Worry about data not being accessible in 3, 5, 10 years time? Face it: If you're not accessing some files for years and years, then you probably don't need the data anyway. If it's important you'll be accessing it regularly and if you notice any degradation in the storage medium you'll copy it to new media/a new device and destroy the old one anyway. Come on people this isn't difficult! Disregard the 'cloud' and be responsible for your own data.

Halt - syntax error

[Anonymous Coward]

Shouldn't the question be "Whom do you entrust with your long term data?" I think the author has mixed up the direct and indirect objects.

God

[ivicente]

I trust all my really important data to God. You can't go bad with this provider.

Store It Locally

[Anonymous Coward]

It's cheap, it's reasonable.

Crashplan

[Anonymous Coward]

Crashplan is a great cloud backup service that supports client-side encryption. Very affordable and highly customizable. No, I'm not a shill, just a super pleased user who evangelizes to all my friends and family about it.

It doesn't matter

[NewYork]

Govt can CONFISCATE whether it's public/private/personal Cloud.
Here is the clue http://en.wikipedia.org/wiki/E...

longaccess.com

[blooher]

There is a startup called Long Access http://www.longaccess.com/ that offers a long-term cloud storage using encrypted data and personal certificates for the encryption. The data stored is AES256 encrypted, and the certificates/keys needed for the decryption are in the user's posession. They recommend the safekeeping of a printout of the certificate that would likely be possible to read in 30 years time.

Take a look at their FAQ for more details.

Disclaimer: I am not affiliated with them, I used to work with one of the founders in the past.

How Hollywood does it

[Anonymous Coward]

With budgets of hundreds of millions of dollars, do you know how they archive their precious films?

Analog hard copy.

That's right, they print it to film, on rolls of old fashioned celluloid, and store it in a proper film vault underground somewhere.

They don't trust the digital formats to survive decade after decade, century after century. Whether it be format read problems, bit-rot, security, or operator error, they don't totally trust digital-only storage for their cash cow masters.

It's not quite the same, but I do audio production and I have tried to bounce just about every track I've worked on in the last 20 years to CD. If I could bounce stem tracks (individual parts) I would do that.

All of my production sessions live on hard drives, but who knows if I'll ever be able to open those things again, at least wihtout paying people like Digidesign alot of money, and assuming that hard drive is functioning in the future (or that I've continued to copy up the 100 gigs of files to a new drive).

All of us on the amateur side of production need to be weary of format lock. I know I have plenty of production from the 90's that's long gone on either SCSI hard drives, DAT tape, ADAT tape, or backup cartridges. If I really wanted/needed that data I could probably dig it out, but not without major effort, with no gurantee of recovering it.

Some alternatives I didn't see in a skim...

[Anonymous Coward]

There are two great options--cyphertite and spideroak. I really like way the cyphertite solution works. Spideroak was prettier but seemed a little buggy.

Also, if you have 2 machines in your house, you can backup their /home dirs to each other.

For the rest of your data, I recommend splitting it up with the traffic light protocol and then upload those sections as time allows.. For most people upload bandwidth is the problem.