Backup to Cloud - Security risk

Gary Wood wrote:

[...] When you go to that interface, it asks you for your encryption key, which is presumably transmitted to the server and stored in memory there. That's a security risk, because it means that the key has left my machine.
[...]

There are different ways to manage and protect credentials and keys through web applications, and, at the end of the day, you have to trust the service provider that their implementation is following best practices.
That said, it is not because you enter a password or a key into a web interface that the key "leaves" the computer. In SSL/TLS implementations, the keys are encrypted before being stored. The resulting hash is compared with the hash stored on the server. If the 2 are similar, the password is correct. While there a unique hash for each password, it is impossible to determine the password using the hash.

Second, within the web interface, I've noticed that if I click the "settings" icon alongside my files, I have the options "Share on Twitter" and "Share on Facebook". Clicking on these generates a link that I can post online to let others access the file. Does the action of clicking the link change a property of the file to make it shared, or are all my files really shared with obscure links as soon as they are uploaded? Either way, how does this fit with the encryption Acronis advertises as meaning that not even its staff can access my files without the encryption key? If I get a sharing link, no encryption key is needed to access the files. Does this mean that either the files aren't really encrypted, or the key is really stored on the server?

Since you access your files *after* having entered your encryption key, when you click on the sharing link, you must create a copy of the file that is decrypted for sharing. It is possible that you still share some token within the sharing link, so maybe the file is still encrypted but you are sharing another key with anybody having the link. This is my assumption, not a statement.

Pat L wrote:

Since you access your files *after* having entered your encryption key, when you click on the sharing link, you must create a copy of the file that is decrypted for sharing. It is possible that you still share some token within the sharing link, so maybe the file is still encrypted but you are sharing another key with anybody having the link. This is my assumption, not a statement.

I'd appreciate clarification from Acronis on this, but I'd be happy if this is the way it works. So, essentially, as long as I don't click to create any sharing links, my files are protected. Another cause for concern, though, is this section from the EULA for the cloud product:

Acronis wrote:

Acronis will not decrypt your files unless (a) it reasonably believes that it must do so to troubleshoot problems with the Software or Services; or (b) it reasonably believes it must do so in order to comply with any law, subpoena, warrant, order, or regulation.

How is that possible, if the data is encrypted in such a way that it's not even accessible to Acronis staff?

EDIT:
A further question has occurred to me as I've experimented with the trial version further. When I restore from the web portal, the file zip of the files to be restored downloads through my browser, completely independently of True Image. I can then open the zip normally, without having to supply a password, so it is clearly not encrypted. Therefore, I wonder what security is in place to protect my data as I download it back from the cloud. Does it rely simply on SSL and no encryption? (A related question, also, is whether the data are uploaded in the same way during backup; more specifically, does encryption of the backed up data happen client- or server-side?).

I'd really appreciate clarification on these questions, Acronis. I like True Image from my testing thus far, and the upload speed for backups to the cloud is brilliant. But, it's only a viable solution for my needs if I can have 100% confidence in its security.

I've had a reply to an email to Acronis that addresses some of my questions:

"Acronis" wrote:

We use AES 256-bit encryption and we check with the experts that we can not decrypt the encryption password.
And we are also waiting for an update why it is documented on the EULA that we can decrypt it.

I've been promised an update the latter point and answers to my other questions by next week and will update this thread again when I get the, in case this information is helpful to others.

I still haven't heard back from Acronis with an answer on this. If there are any Acronis staff in these forums, please could you look into this for me, and help to clarify?

This forum is infrequently visited by Acronis staff. It looks like you already have contacted Acronis support, which is your best bet. It looks like you have hit on an interesting issue...

Thanks, Pat. I'm still hoping I'll hear back from Acronis support about this, and will keep this thread updated, if that happens.

It's frustrating, really, because I've been trialling Acronis True Image 2015 for cloud backup with some dummy data and it's one of the fastest cloud backup solutions I've found. I'd really like to adopt it as my backup solution, but can't do that at the moment until these questions about data security have been addressed.