Fellow selfhoster, do you encrypt your drives where you put data to avoid privacy problems in case of theft? If yes, how? How much does that impact performances? I selfhost (amongst other services) NextCloud where I keep my pictures, medical staff, …in short, private stuff and I know that it’s pretty difficult that a thief would steal my server, buuut, you never know! 🤷🏻‍♂️

  • AtariDump@lemmy.worldEnglish
    1·
    8 months ago

    I used to until I realized that I’ve got bigger threats to worry about.

    And like someone else mentioned, if I have to do data recovery for some unknown reason I want to make sure the data’s not encrypted.

    • peregus@lemmy.worldOPEnglish
      0·
      8 months ago

      Why? If you store the key in your password manager shouldn’t be a problem to mount the drive on another PC, decrypt it and save data. Or am I missing something?

        • peregus@lemmy.worldOPEnglish
          0·
          8 months ago

          Why? What would be the problem?

          P.s. Why did you link to the Anti Commercial-AI license?

          • onlinepersona@programming.devEnglish
            01·
            8 months ago

            Why? What would be the problem?

            On linux, you’re probably using LUKS. That has a header with the keys at the beginning of each encrypted volume. If those keys (or key if you only have one) is corrupted and you don’t have a backup of that, you’re fucked.

            The next problem is that data recovery tools mostly don’t support decryption. They scan regions or the entire drive for recognizable things like partition headers, partition tables, file types, etc. if those are encrypted, well…

            If you are able to decrypt a partition, then it might work as it will show up like any other device in /dev/mapper/ and you could do recovery /dev/mapper/HDD. However, I have no idea what data corruption does to encryption algorithms. If one part of what is being decrypted is faulty, what does that do to the entire thing?
            This mostly comes from a lack of knowledge on my part. IIRC encryption depends on hashsums -> if you change what’s being decrypted/encrypted, the entire hashsum is incorrect and thus all the data shouldn’t be able to be decrypted. But I might be wrong - I’ll gladly be wrong on this.

            Anti Commercial-AI license