This isn’t the most important question, but we’re putting it first because it’s one of the most commonly asked. Most providers like to put impressive-sounding terms like ‘128-bit encryption key’ on their websites. But what do they really mean?

An encryption key is the set of instructions used to transform your data into a series of random numbers and letters, and back again. The number of bits that your encryption key contains is the number of different values that each character can potentially have. If you have a one bit key, the only (binary) possibilities are 0 or 1. If it’s two bits, it can be 00, 01, 10 or 11. Three-bit encryption has eight possible variations, four-bit has 16, and so on.

Every time an extra bit is added, the number of potential values are doubled, making it extremely difficult for anyone without the key to decrypt your data simply by trial and error. If you use 128-bit encryption, there are a staggering 340282366920938463463374607431768211456 possible variations, which would take millions of years to break if the only technique your hackers use is to wait until they hit upon the right combination (also known as a brute force attack).

Of course, that’s not the only way that someone can gain access to your data. When companies using 128-bit encryption are compromised, it’s not because someone’s broken the key; it’s because they’ve found a backdoor that allows them to get to your files another way, or because you’ve chosen a password that’s easy to guess.

What about 256-bit encryption keys?

Some providers offer more than 128-bit encryption - typically 256-bit, or occasionally higher. But if shorter keys are impossible to break, why bother?

This question has been explored at length over time, but the simplest answer is that there isn’t really any concrete reason to choose a longer encryption key, except for the fact that it can’t hurt. However, with concerns growing about the NSA’s capabilities, those in the know are increasingly turning to longer keys to safeguard against future breakthroughs.

On the whole, strong security is just as much about setting a strong password and being picky about other privacy features as it is about opting for the service with the longest encryption key. At present, 128-bit should be enough for most personal users, although longer keys are likely to become much more desirable further down the line.

It might look promising when backup companies claim that they encrypt your data, but beware of any that don’t tell you exactly how and when they do it.

Two important stages of encryption you need to know about:

The problem

Even when your data is encrypted during transfer and at rest, the problem remains that the encryption key (which is also thedecryption key) is set by your backup provider. So what’s to say that they won’t just decrypt your data whenever they feel like it?

Although it’s very unlikely that any company would take that risk (not to mention that employee access to files is usually highly regulated), it can be a problem if a third party requests access to your files. If your provider wants to comply, or is legally obliged to, then this means that your data and information can change hands without you ever being consulted.

So what can you do about it? The best solution is to stick to providers that offer end-to-end encryption.

What is end-to-end encryption?

End-to-end encryption is the name given to encryption that starts on your computer and is based on a password known only by you. This password forms the basis of an encryption key that will turn your words and sentences into a random array of letters and numbers before they even leave your computer. As your password is never sent to the provider’s servers in plain text form, there is no way for them to access the key themselves, so you can relax in the knowledge that the only person with the information required to decrypt your files is you.

As a result, your files are locked down before your backup provider gets their hands on them, and remain private until you use your password to decrypt them again.

Just how secure is it?

Very. Your encryption key is generated by taking the characters in your password and hashing them - assigning them a fixed-length numerical code which does not relate in any way to the characters you used.

That code is then salted - adding extra characters to make it longer and more difficult to break. What you get in the end is a key that’s entirely random, without any obvious correspondence to your original password, and which never reaches the eyes of your provider.

Great! But what if you forget your password?

This is the one downside of end-to-end encryption. As your provider is never aware of your password, there’s no way for them to reset it or send you a reminder if you forget. It’s extremely important to make a record of the password and keep it in a safe place as, if you can’t remember it, you’ll lose access to your files forever.

Looking for end-to-end encryption? We’re pleased to say that plenty of backup services do offer it. Some of the best include CrashPlan, SpiderOak, and IDrive

When it comes to encryption, there’s one more thing to take into account - what ciphers used to encrypt it.

What is a cipher?

A cipher is the algorithm that is used to create your encryption key - essentially, the code that turns your files from plain text into a series of random characters. Which means that it’s pretty important, because if your code is weak, then it’s going to be easier to break.

Fortunately, there are a few ciphers that are used by most backup providers, all of which have been proven to be pretty strong. They all have their own advantages and disadvantages though, so keep reading for more information.

Three common ciphers

Blowfish

Blowfish is one of the oldest ciphers going, and has been in use since 1993. Although generally still thought to be secure, it has a reputation for using weak encryption keys, and is known to struggle when it comes to processing larger files. While a number of backup companies still use Blowfish for encryption, more and more are now turning to more modern alternatives.

AES

Advanced Encryption Standard (AES) has grown in popularity over the past few years, and has now overtaken Blowfish as one of the most popular ciphers used today. Famously used by the US government, it uses higher level security measures that are updated regularly to keep on top of any new threats or emerging weaknesses. It’s better at handling big files, and usually comes in 128-bit or 256-bit form.

RSA

RSA is a type of cryptosystem (the name given to the whole system that connects you securely to another server), which uses its own cipher to establish encryption and verify SSL certificates.

While initially considered unbreakable, and used by many online services for as long as 20 years, it was proven in 2010 that the most commonly used 1024-bit RSA encryption could be cracked. As a result, Google and many other major sites (including backup providers) are now using the more secure 2048-bit RSA key, which is still considered secure today. While this should be good enough for most personal users, there are benefits to a provider that’s using a longer key, on the grounds that they’ll be a few steps further ahead of the NSA and other organisations wishing to break into encrypted systems.

NIST

One issue worth being aware of when it comes to ciphers is that all of the major ones, including RSA and AES, have been developed or approved by the United States National Institute of Standards and Technology (NIST).

Why is this a problem?

Because, unfortunately, NIST is well known to work hand-in-hand with the NSA, with the latter having a significant, and widely criticised, input into the development of ciphers.

Considering that the NSA is allegedly evading online security measures by creating back doors in other companies’ software it is understandable that this has raised concerns over the integrity of NIST-approved ciphers.

Has anything been done?

A bill was passed by Congress in 2014 freeing NIST from the obligatory involvement of the NSA when forming encryption standards. However, although this stopped NIST from being forced to consult with the NSA, it didn’t make them stop communicating altogether, leaving plenty of room for concern that the two organisations still work together*.

What can you do about it?

At the moment, not very much. Unfortunately, there are very few ciphers currently being used that don’t have a connection to NIST, but as new solutions are created, it’s worth being aware of the benefits of choosing one that’s been developed independently.

* It’s worth noting that the RSA cryptosystem is not related to RSA Security LLC - the company mentioned in the TechDirt article above.

HTTP (without the S) is the way that your computer communicates with any website that it’s connected to. If you’re using an HTTP connection, then there’s no encryption included, so your data will be directly accessible to anyone that hacks into your connection.

What can you do about it?

Make sure that you pick a backup service that uses a HTTPS connection. The extra S stands for Secure, and means that all of the communications between you and the website’s servers are encrypted, and will therefore be kept private.

Who uses HTTPS?

Most websites that handle personal information now use HTTPS connections - you can find out whether a site uses a secure connection or not by looking for the padlock icon in your address bar, along with the ‘https://’ (rather than ‘http://’) at the beginning of the URL.

Does HTTPS have anything to do with SSL?

Yes. SSLis the protocol that is most commonly used to secure your connection. If you can see the S, then you can be sure that SSL or an equivalent such as TLS is being used.

Who uses HTTPS/SSL? We’re pleased to say that most backup providers do. It’s a widely-advertised feature largely because it’s a given for all confidential online activity, but it’s still a very important thing to have.

To make extra sure that the only person that can log into your account is you, more and more services are now implementing two-factor authentication. This means that any time you want to access your account but aren’t logged in, you’ll need to not only enter your password, but also provide a secondary form of authentication.

In most cases, this takes the form of a text or call that delivers a verification code to your phone. All you need to do is pop the information into their website at sign in time, and you’ll get access straight away.

It might not be the most sophisticated security measure, but two-factor authentication has an excellent track record when it comes to keeping accounts secure, and is a very good way to keep unwelcome visitors away from your data.

When you store files with an online backup provider they’re sent to company-owned data centers, where they’re kept on secure servers until you want to retrieve them again. But what happens if the server holding your data is damaged?

Obviously, any backup service that loses files they’re being paid to keep safe is going to get into a lot of trouble, so many providers take extra measures to prevent against data loss - most of which fall under the heading of data redundancy.

So what is data redundancy?

Data redundancy is a blanket term used to describe the fallback measures that protect your backed up files if the drive that they’re being stored on fails. In this respect, redundancy really provides backups of your backups - ensuring that you can always access your data, even if one copy of it becomes irretrievable.

How do online backup companies use redundancy?

Most online backup providers use redundancy to protect your files while they’re stored on their servers - so that if something happens to a drive that they’re being kept on, you won’t lose everything. This is achieved by creating multiple copies of your data, and spreading them across several different hard drives - a process usually achieved by using RAID technology.

What is RAID?

RAID is a popular way of achieving data redundancy. Officially ‘Redundant Array of Inexpensive Disks’, it takes the form of several hard drives that are kept within a single server, or a cluster of servers, all working in tandem to ensure your data is recoverable should a drive fail.

When your files are sent to a RAID array, they’re stored across all of the available disks so that, if one drive fails, another will immediately take its place - and you can keep going without a hitch. In fact, in a data center scenario, servers are often configured so that they can withstand more than one drive failing!

Obviously, failed drives will have to be replaced, but at the moment when things go wrong, your data won’t be sacrificed. In essence, RAID buys time for failed drives to be replaced without any data loss.

Other redundancy measures

Redundancy measures are not only about the drives your data is stored on. Data center server hardware often includes other redundancy features such as failover power supplies, to make sure that everything’s rock-solid if/when components fail.

Another technique often used by backup providers is to create a mirrored copy of the entire contents of their data center, and replicate it in one or more different physical location(s). This way, in the unlikely event that disaster such as fire or flood strikes the place where your files are stored, there’ll still be a copy of everything safe and sound.

So what should you be looking for?

Smaller organisations running on-site backups often use RAID 1 or RAID 5 to keep their backups backed up - the former creating a mirrored copy on a second drive, and the latter spreading data across a minimum of three disks. Larger organisations, including most online backup services, are likely to have much more sophisticated measures in place - if you want to find out more, check providers’ FAQs or contact them directly, or take a look at this great RAID Made Easy article from PCWorld.com.

When backup companies take hold of your data they promise to keep it safe, using various combinations of the measures we’ve discussed above. However, how do you know that they’re keeping their word?

This might sound a little paranoid, but with the NSA allegedly gathering their information by means of backdoors in major companies’ security policies, there’s real cause for concern. There are several ways to protect yourself from this, such as using end-to-end encryption, and choosing a backup provider that uses open source software is another important one.

When software is open source, its source code is available for anyone to view, and copy or change as they wish. Some companies even use it as a platform for community feedback, working together with external programmers to create the best possible product.

So why is this good for privacy?

It’s good because, if a company has included anything dodgy in their program, it can (theoretically) be detected and brought to public attention by outsiders with no investment in hanging on to undesirable extras.

Is there a catch?

Unfortunately, yes. Hunting through source code for problems is a big job that requires a lot of technical skill to perform, and doesn’t have much (or anything) by way of financial reward. So just because your provider’s software is open source, it doesn’t mean that it’s definitely been checked. However, there’s still a lot to be said for a company’s willingness to open their code to public scrutiny, especially as so many organisations still opt to use proprietary software that keeps a tight lid on everything that goes on behind the scenes.

And finally…

If you’ve got your eye on a particular provider but their security isn’t as good as you’d like, don’t panic! There are third party encryption services that you can use to protect your files before you send them anywhere. Unfortunately, not all Cloud storage providers support pre-encrypted files, so make sure to check in advance if you want to give this technique a go.