From ec5c6f29634774ca6686c5ec7cbccdd5e30f28bb Mon Sep 17 00:00:00 2001 From: Alex Date: Thu, 10 Sep 2020 17:27:18 +0000 Subject: [PATCH 1/2] Reviewed how-to-backup-and-encrypt-data-privately-and-securely-using-rsync-and-veracrypt-on-macos; added footnote --- .../README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/how-to-backup-and-encrypt-data-privately-and-securely-using-rsync-and-veracrypt-on-macos/README.md b/how-to-backup-and-encrypt-data-privately-and-securely-using-rsync-and-veracrypt-on-macos/README.md index dd5287a..e03455d 100644 --- a/how-to-backup-and-encrypt-data-privately-and-securely-using-rsync-and-veracrypt-on-macos/README.md +++ b/how-to-backup-and-encrypt-data-privately-and-securely-using-rsync-and-veracrypt-on-macos/README.md @@ -3,7 +3,7 @@ Title: How to backup and encrypt data privately and securely using rsync and Ver Description: Learn how to backup and encrypt data privately and securely using rsync and VeraCrypt on macOS. Author: Sun Knudsen Contributors: Sun Knudsen -Reviewers: +Reviewers: Alex Anderson Publication date: 2020-08-26T14:07:36.767Z --> @@ -313,3 +313,7 @@ OK OK 👍 + +You should be careful to ensure the hash is not modified by an attacker, since this would allow [tampering with the backup](https://crypto.stackexchange.com/questions/83776/should-i-be-worried-about-xts-tampering-when-encrypting-backups-using-veracrypt/83782#83782). One good way to do this is to use an [HMAC](https://en.wikipedia.org/wiki/HMAC) hash instead of just hashing the backup, or to simply store a copy of the hash securely. + +Putting the hash in another VeraCrypt container would be enough, assuming you use the standard XTS mode. From d8309ca9c9e06be24b127de450f10307935dcdb3 Mon Sep 17 00:00:00 2001 From: Sun Knudsen Date: Thu, 10 Sep 2020 19:22:38 +0000 Subject: [PATCH 2/2] Moved footnote to heads-up --- .../README.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/how-to-backup-and-encrypt-data-privately-and-securely-using-rsync-and-veracrypt-on-macos/README.md b/how-to-backup-and-encrypt-data-privately-and-securely-using-rsync-and-veracrypt-on-macos/README.md index e03455d..0b4d131 100644 --- a/how-to-backup-and-encrypt-data-privately-and-securely-using-rsync-and-veracrypt-on-macos/README.md +++ b/how-to-backup-and-encrypt-data-privately-and-securely-using-rsync-and-veracrypt-on-macos/README.md @@ -289,6 +289,8 @@ chmod +x /usr/local/bin/check.sh ### Backup +> Heads-up: store hash in safe place such as password manager (not on same device as backup). + ```console $ backup.sh Enter password for /Volumes/Samsung BAR/b: @@ -313,7 +315,3 @@ OK OK 👍 - -You should be careful to ensure the hash is not modified by an attacker, since this would allow [tampering with the backup](https://crypto.stackexchange.com/questions/83776/should-i-be-worried-about-xts-tampering-when-encrypting-backups-using-veracrypt/83782#83782). One good way to do this is to use an [HMAC](https://en.wikipedia.org/wiki/HMAC) hash instead of just hashing the backup, or to simply store a copy of the hash securely. - -Putting the hash in another VeraCrypt container would be enough, assuming you use the standard XTS mode.