6 ms·

Hey Robbie- I am touched you saved my email and remembered me, and that at the time you didn't respond negatively to the message. Thank you for being a custom

Hey Robbie- I am touched you saved my email and remembered me, and that at the time you didn't respond negatively to the message. Thank you for being a customer. The only thing I regret is that comment about version number of 2.3.1 and the claim that it would run flawlessly for a decade. Oh geez, please upgrade to 8.0.1, you won't regret it. -- Brian Wilson, CTO Backblaze, brianw@backblaze.com

argc 5y ago
This conversation makes me think you care about your users and inspired me to go look at pricing for personal laptop backup, and it appears that linux is not supported. Any plans to support it in the future? EDIT I might have not looked hard enough and there are potentially options out there, I just found https://help.backblaze.com/hc/en-us/articles/217664628-How-does-Backblaze-support-Linux-Users- https://help.backblaze.com/hc/en-us/articles/217664628-How-d...
- teraflop 5y ago
  For many years, they were consistently and very diplomatically saying that they had no plans to offer Backblaze Personal Backup to Linux users, because Linux users would use a disproportionately large amount of storage and it wouldn't make sense to offer them a flat-rate alternative to the pay-per-GB B2 option. e.g. https://www.reddit.com/r/backblaze/comments/jsrqoz/personal_backup_linux/gc1peyh/ https://www.reddit.com/r/backblaze/comments/jsrqoz/personal_... It seems that they may be changing their tune, at least as of a few months ago: https://www.reddit.com/r/backblaze/comments/m3xynu/backblaze_on_linux_yet_again/ https://www.reddit.com/r/backblaze/comments/m3xynu/backblaze...
  - Chilinot 5y ago
    As a linux user, i have just setup my own backup solution to backblaze using Rclone and their S3 compatible storage.
    - tallanvor 5y ago
      Which is fine and all, but then you're paying per gb/month. Depending on how much you want to back up, it can cost you a lot more than the personal plan.
      - Chilinot 5y ago
        Eh, im storing about 1.3TB of photos, its costing me around $10/month. That is an acceptable cost IMO.
selestify 5y ago
Is there a reason there’s a short limit on how long my Backblaze password can be? That’s what put me off using it before, because who knows what kind of encryption you guys are using if it can’t handle what my email provider is able to handle, all the while securing more sensitive data ;)
- brianwski 5y ago
  > Is there a reason there’s a short limit on how long my Backblaze password can be? The current limit is 50 characters. There are reasons we don't let it get super long like 2,000 characters but we could easily double or triple the maximum length it if it was requested. Is there a number of characters you have in mind? I found a chart here: https://i.imgur.com/trR2u8g.jpg https://i.imgur.com/trR2u8g.jpg that says a randomly generated 17 character password would take 93 trillion years to crack. The chart doesn't even go up to 50 characters. Backblaze also supports 2-factor authentication via SMS or Google Authenticator codes which personally I would highly recommend to customers also. > who knows what kind of encryption you guys are using Backblaze has two product lines: "Backblaze Backup" where we wrote the app that encrypts data on your laptop before uploading into our storage cloud, and "Backblaze B2" where you use any third party tool (or write your own) so the encryption in that case is all under your control. You can see a list of 3rd party tools here: https://www.backblaze.com/b2/integrations.html https://www.backblaze.com/b2/integrations.html (make sure you scroll down). There are little pictures of penguins by the software that supports Linux, little pictures of an apple for software that support Macintosh, and a little Window icon for the software that support Windows. For "Backblaze Backup", we use a well known design where we use symmetric AES-128 to encrypt the file, but each file is encrypted with a different AES-128 key, and that key and an Initialization Vector (IV) is then encrypted by a 2048 bit RSA public/private key. You can read about the encryption flow we use in this blog post: https://www.backblaze.com/blog/how-to-make-strong-encryption-easy-to-use/ https://www.backblaze.com/blog/how-to-make-strong-encryption...
  - xoa 5y ago
    Love Backblaze and it's my go-to backup recommendation, seeing this very late so not sure if you'll see my reply but a few thoughts: >The current limit is 50 characters. There are reasons we don't let it get super long like 2,000 characters but we could easily double or triple the maximum length it if it was requested. Is there a number of characters you have in mind? I found a chart here: https://i.imgur.com/trR2u8g.jpg https://i.imgur.com/trR2u8g.jpg that says a randomly generated 17 character password would take 93 trillion years to crack. Usually the reason people want longer "password" options is because they're using a diceware style pass phrase of 4-6 randomly generated words. It's not so much about ultimate security as many people having trouble memorizing decent fully random passwords. Key stretching and multifactor helps further of course. Longest normal English words are something like 21 characters before getting into niche science terms, so very conservatively 160 characters is probably going to fit even an extremely conservative edge case passphrase. That'd be 8x of some of the very longest words (unlikely to be randomly chosen) and match a 128-bit key which is plenty [0]. >* Backblaze also supports 2-factor authentication via SMS or Google Authenticator codes which personally I would highly recommend to customers also.* I hope you'll consider adding (via Webauthn online or OS or other toolkits to the application) standalone hardware token support (like Yubikeys or Nitrokeys). Those are enormously more secure, convenient, and also have the bonus of eliminating another set of 3rd party dependencies. If you looked at those in the past and skipped them due to lack of device support worth looking again, every major platform should have coverage at this point. ---- 0: Also, rather then thinking in terms of "years to crack" which inherently depends on the processor power thrown at it, might be better off considering in terms of combinations (or entropy). A standard symmetric key at this point is 256 bits, which means 2^256 combinations, but with stretching 128 bits is probably a very very safe seed for the password component. So that could be a "password" of [01] 128 characters long. That'd be roughly equivalent to [0-9] 38 characters long, or alphanumeric cased (26*2+10=62) 22 characters long. Current Oxford English dictionary edition I think has around 170000 words. If we figure a diceware program throws out ultra short, ultra long, and ultra weird words for convenience (whole point is something people can remember) so maybe it's cut down to the 70000 most common words >3 characters, that'd take 8. At a more typical 4-6 words, equivalent to maybe a 17 character cased alphanumeric password.
tinus_hn 5y ago
But what about the part where you said you were going to delete their files in a week? I don’t understand why someone would say that.

argc 5y ago

This conversation makes me think you care about your users and inspired me to go look at pricing for personal laptop backup, and it appears that linux is not supported. Any plans to support it in the future? EDIT I might have not looked hard enough and there are potentially options out there, I just found https://help.backblaze.com/hc/en-us/articles/217664628-How-does-Backblaze-support-Linux-Users- https://help.backblaze.com/hc/en-us/articles/217664628-How-d...

teraflop 5y ago
For many years, they were consistently and very diplomatically saying that they had no plans to offer Backblaze Personal Backup to Linux users, because Linux users would use a disproportionately large amount of storage and it wouldn't make sense to offer them a flat-rate alternative to the pay-per-GB B2 option. e.g. https://www.reddit.com/r/backblaze/comments/jsrqoz/personal_backup_linux/gc1peyh/ https://www.reddit.com/r/backblaze/comments/jsrqoz/personal_... It seems that they may be changing their tune, at least as of a few months ago: https://www.reddit.com/r/backblaze/comments/m3xynu/backblaze_on_linux_yet_again/ https://www.reddit.com/r/backblaze/comments/m3xynu/backblaze...
- Chilinot 5y ago
  As a linux user, i have just setup my own backup solution to backblaze using Rclone and their S3 compatible storage.
  - tallanvor 5y ago
    Which is fine and all, but then you're paying per gb/month. Depending on how much you want to back up, it can cost you a lot more than the personal plan.
    - Chilinot 5y ago
      Eh, im storing about 1.3TB of photos, its costing me around $10/month. That is an acceptable cost IMO.

selestify 5y ago

Is there a reason there’s a short limit on how long my Backblaze password can be? That’s what put me off using it before, because who knows what kind of encryption you guys are using if it can’t handle what my email provider is able to handle, all the while securing more sensitive data ;)

brianwski 5y ago
> Is there a reason there’s a short limit on how long my Backblaze password can be? The current limit is 50 characters. There are reasons we don't let it get super long like 2,000 characters but we could easily double or triple the maximum length it if it was requested. Is there a number of characters you have in mind? I found a chart here: https://i.imgur.com/trR2u8g.jpg https://i.imgur.com/trR2u8g.jpg that says a randomly generated 17 character password would take 93 trillion years to crack. The chart doesn't even go up to 50 characters. Backblaze also supports 2-factor authentication via SMS or Google Authenticator codes which personally I would highly recommend to customers also. > who knows what kind of encryption you guys are using Backblaze has two product lines: "Backblaze Backup" where we wrote the app that encrypts data on your laptop before uploading into our storage cloud, and "Backblaze B2" where you use any third party tool (or write your own) so the encryption in that case is all under your control. You can see a list of 3rd party tools here: https://www.backblaze.com/b2/integrations.html https://www.backblaze.com/b2/integrations.html (make sure you scroll down). There are little pictures of penguins by the software that supports Linux, little pictures of an apple for software that support Macintosh, and a little Window icon for the software that support Windows. For "Backblaze Backup", we use a well known design where we use symmetric AES-128 to encrypt the file, but each file is encrypted with a different AES-128 key, and that key and an Initialization Vector (IV) is then encrypted by a 2048 bit RSA public/private key. You can read about the encryption flow we use in this blog post: https://www.backblaze.com/blog/how-to-make-strong-encryption-easy-to-use/ https://www.backblaze.com/blog/how-to-make-strong-encryption...
- xoa 5y ago
  Love Backblaze and it's my go-to backup recommendation, seeing this very late so not sure if you'll see my reply but a few thoughts: >The current limit is 50 characters. There are reasons we don't let it get super long like 2,000 characters but we could easily double or triple the maximum length it if it was requested. Is there a number of characters you have in mind? I found a chart here: https://i.imgur.com/trR2u8g.jpg https://i.imgur.com/trR2u8g.jpg that says a randomly generated 17 character password would take 93 trillion years to crack. Usually the reason people want longer "password" options is because they're using a diceware style pass phrase of 4-6 randomly generated words. It's not so much about ultimate security as many people having trouble memorizing decent fully random passwords. Key stretching and multifactor helps further of course. Longest normal English words are something like 21 characters before getting into niche science terms, so very conservatively 160 characters is probably going to fit even an extremely conservative edge case passphrase. That'd be 8x of some of the very longest words (unlikely to be randomly chosen) and match a 128-bit key which is plenty [0]. >* Backblaze also supports 2-factor authentication via SMS or Google Authenticator codes which personally I would highly recommend to customers also.* I hope you'll consider adding (via Webauthn online or OS or other toolkits to the application) standalone hardware token support (like Yubikeys or Nitrokeys). Those are enormously more secure, convenient, and also have the bonus of eliminating another set of 3rd party dependencies. If you looked at those in the past and skipped them due to lack of device support worth looking again, every major platform should have coverage at this point. ---- 0: Also, rather then thinking in terms of "years to crack" which inherently depends on the processor power thrown at it, might be better off considering in terms of combinations (or entropy). A standard symmetric key at this point is 256 bits, which means 2^256 combinations, but with stretching 128 bits is probably a very very safe seed for the password component. So that could be a "password" of [01] 128 characters long. That'd be roughly equivalent to [0-9] 38 characters long, or alphanumeric cased (26*2+10=62) 22 characters long. Current Oxford English dictionary edition I think has around 170000 words. If we figure a diceware program throws out ultra short, ultra long, and ultra weird words for convenience (whole point is something people can remember) so maybe it's cut down to the 70000 most common words >3 characters, that'd take 8. At a more typical 4-6 words, equivalent to maybe a 17 character cased alphanumeric password.

tinus_hn 5y ago

But what about the part where you said you were going to delete their files in a week? I don’t understand why someone would say that.