There is no AES encryption option for cloud backups

Bernard, welcome to these User Forums.

Please see the ATI 2018 User Guide: Online backup protection which has the only information about the encryption used to protect Cloud backups.

To protect your data on Acronis Cloud from unauthorized access, you can use encryption. In this case, your data will be stored on Acronis Cloud in an encrypted form. To encrypt and decrypt your data, the program needs the password, that you should specify when you configure the online backup. You can specify any set of characters you like. Note that the password is case-sensitive.

 Warning! A password of an online backup cannot be retrieved. Please memorize the password that you specify for backup protection.

While attempting to access the encrypted data, the program asks you to enter the password.

Password protection is not the same as AES encryption.  I essentially got the same answer from support, and they referred me to documentation which explains using AES encryption.  But this only works with a local backup.

Can you tell me if cloud backups are AES encrypted?   I'm guessing not.

Sorry Bernard, only Acronis development can confirm the type and strength of encryption used to protect Cloud backup files.

This article is the closest information regarding AES encryption for cloud backups I have found.  I'll have to try and get a definitive answer from support.

https://www.acronis.com/en-us/articles/data-security/

Bernard,

When you configure a cloud backup in the Options Advanced section under backup protection you have the option to tic the Use encryption for enhanced Protection box and additionally assign a password.  This enables encryption of your backup so, your question then is at what level is this encryption? 

The article you point to indicates that encryption can be set by the user to the 3 defined levels you mention.  Are you saying that you are unable to select the encryption option and therefore cannot encrypt your backup?

Be advised that to use encryption that option must be selected during the first setup of the backup task.  Once the backup setup has been done and the task run the option to enable encryption becomes unavailable.  This is expected default behavior.

Bob, I think the issue here is the difference between options offered for local/network backups versus those offered for backups to the Cloud, where there are no settings to choose the level of encryption used, just either use encryption or not!

See Steve Smith's response, he is correct, and the reason for my post -- You cannot select AES encryption for a cloud backup, only password protect it.  So is AES encryption used for cloud backups?  Can someone at Acronis view my backed up files?  I need answers to these questions, and so far have not been able to get an answer from Acronis support.

Bernard, assuming that you have used a trivial or over simple password (i.e. password etc) then no one else can open or view your backups in the Cloud.

You can make your password as complex or complicated as you want to ensure the greatest level of protection.  I was able to post the whole text of your previous post in the password field for a new Cloud backup - so 64 words / 352 characters, which would take an extremely long time for a range of computers to break!

So the real question is at what encryption level is the backup created?

The transfer of data over the internet is done using SSL and to the best of my knowledge is encrypted using AES 256 prior to upload of the data.

Initial data content security as is available for local backups giving choices of AES 128, 192, and 256 are not necessary in the Cloud context because the AES 256 encryption is applied prrior to data transmission. 

The password applied is how the user protects access to the data once in the cloud.  Read and write authority is tied to the user whom created the cloud backup.

If you create a Cloud backup and select the encryption option you cannot proceed until a password is applied.  Once the options are configured the main GUI indicates that the backup is set for encryption.  If you then change your mind about it you have the option on that window to turn encryption Off.  Once you run the backup the encryption applied is set and cannot be changed.  Access to the backup can only be gained by the creating user and the applied password.

I fail to see any security problem with this!  I suppose a clearer statement about data transfer over the internet might be warranted.

You sound reasonably sure that 256 bit AES encryption is applied to the cloud backup prior to uploading to the cloud.  If this is the case, then cloud backups are indeed secure, and cannot be viewed by Acronis personnel, which was my main concern.   Thanks for your help regarding this issue.

See Enchantech's reply regarding cloud backups being encrypted with 256 bit AES encryption prior to uploading to the cloud.  That's the answer I was looking for, and can rest assured that Acronis personnel are unable to view my backups.

-Thanks

Cloud backup capability has existed in Acronis Business products prior to offering it at the consumer level.  Acronis did not re-invent the wheel for cloud storage for consumers, they simply ported the ability to the consumer product (True Image).

The source of my information can be found HERE

Finally, a definitive answer to the cloud encryption question!  After much ado, that is the first article I read which explicitly states that 256 bit AES encryption is used for the cloud backups.  Even back and forth with Acronis support did not yield an answer to this question (yet).

Thanks again for clarifying this issue.

Security

• Data Transfer Security

  Customers are identified by username (e-mail address) and a password. Authentication information is sent securely over SSL. All backup data is encrypted using government grade 256-bit AES before uploading to the Internet.

https://kb.acronis.com/content/14188

Actually, I was premature in thanking you for clarifying encryption methodology for True Image 2018.  The article your referred me to (https://kb.acronis.com/content/14188) does not refer to Acronis True Image 2018, ONLY Acronis Backup.  So I still have not seen any definitive documentation regarding encryption for cloud backups, so the question remains, how is encryption handled for Acronis True Image 2018 cloud backups?

As I stated, Acronis did not reinvent the wheel here, they simply added the existing cloud feature found in the business products lineup to True Image.  The referenced article should apply to 2018, there is no reason to think otherwise.

I hope you are right, but I have no reason to believe they use the same encryption methodology for Acronis True Image as they do for Acronis Backup.  If they did then why not list ATI with the article you pointed me to regarding Acronis Backup encryption?  I would not place my files in the cloud unless I know for certain the type of encryption mechanism used.  Considering how difficult it is to get a straight answer from the documentation, support, and this forum, I have my suspicions about ATI encryption.

You'd be paranoid too if everyone were after your files!

Here is the response from Acronis support.  Now I can sleep better at night!

Hello Bernard,

Thank you for your response.

Based on your concern, for the Cloud backup by default it will use AES 256 bit encryption. You cannot change the encryption type for the Cloud backup. For the local backup you change the encryption.

Please let us know if this answers your query. Feel free to get back to us if you have any difficulties . We are always here to help you.

Here is the response from Acronis support.  Now I can sleep better at night!

Hello Bernard,

Thank you for your response.

Based on your concern, for the Cloud backup by default it will use AES 256 bit encryption. You cannot change the encryption type for the Cloud backup. For the local backup you change the encryption.

Please let us know if this answers your query. Feel free to get back to us if you have any difficulties . We are always here to help you.

I'm glad you got an answer to your inquiry. 

I definitely understand your encryption concerns.  I do see an issue with the current cloud AES system.  Since you don't assign a password "key" for the cloud AES encryption, they must be using some form of your account ID and/or username/password to encrypt the data. Since passwords can be retrieved if lost, you have no real data protection. This only makes the data as safe as your email security is.  For example, you broke the law. Now the police have a court order to view your information. All it takes is Acronis support to change the email and send a password reset request.  or gmail to give them access to your email and they perform a password recovery.

Local backups give this warning when using AES (There is no way to recover encrypted backups if you lose or forget the password.)  This is the same reason LastPass and other online encryption services make it known that if you forget that unlocking password, it's game over. No way to recover..  

If you truely want encrypted cloud based storage. You need to encrypt the data first locally with a program like VeraCrypt then have Acronis upload that data.

SixSies, welcome to these User Forums.

Sorry but I do not believe that you are correct in your statement: "Since you don't assign a password "key" for the cloud AES encryption, they must be using some form of your account ID and/or username/password to encrypt the data."

The end user must provide a valid password with which the Cloud backup will be encrypted, and that password will only be known by the end user.  It has no relationship to any Acronis account ID, user name or account password.  If the user forgets their assigned password, then no-one can recover the data for their encrypted backups in the Acronis Cloud (or locally).

The strength of the password chosen / used by the user is up to each person to decide.  It can be a whole paragraph of jumbled words, mixed characters, special characters etc, or a pass-phrase etc. 

Acronis cannot allow any other party to view your data in the Cloud backup regardless of any legal court orders asking them to do so - they do not have access to do this themselves and cannot give it to others.