The cautionary nightmare

I had a dream. Rather, I had a nightmare last night. It went as dreams go, mixing reality and fantasy. When I awoke, completely stressed out for the day before morning light could stream through my window, I decided I would not let the dream happen. Here is the gist.

In that dream, my brand new laptop that I left in the car was stolen. Actually the car itself was stolen, but found later with only the laptop missing. The laptop sleeve was still in the car, though. Clearly that was the first sign this was ridiculous: who would take the time to take the laptop of its protection sleeve before stealing it? Anyway, my laptop is a few years old and I don't even own a car. Details.

I got home, frustrated that I lost this new piece of equipment. In the end, it's only material and that's a problem money can fix. We will live on. Only to discover that my tower computer was gone too! Arg, thieves broke in the flat and extracted that one piece of hardware. Bad luck, for real. Those sweet SSD and NVMe drives are gone. But, in the end, they were encyrpted and so it's only a matter of replacing the hardware.

Now, I was not alarmed beyond measure because I have a (almost) solid back-up plan. That laptop and that tower computer were primary sources of data, their full states backed up to the NAS. So all my data is fine, I thought, proud of myself. I only went to my "office" to discover the NAS was also missing. No way! What kind of bad day can this be? Besides the fact it was yet again more money that evaporated, it can be "easily" replaced with an equivalent off the shelf, this time my whole data was out there.

I still had my last line of defense in the name of offsite back-ups: the most important data was recoverable, I only lost what I deemed expendable. No, the actual problem was that the NAS is holding raw data. Whatever lands there unencrypted stays there unencrypted. And I feel very uncomfortable with the idea of my whole life being completely exposed. Not that I deal in top secret projects, nor hoard sensitive information. It's just my private life. I am not wiring public CCTV in my homer for the same reason, it's my own life and my own affair.

All of this prose to come to the following points. First, I am confident in my back-up strategy whether my flat burns down or all my hardware gets stolen. What data really matters is also stored elsewhere, I can recover. Second, I am not satisfied with how my data is stored at rest on the NAS. Both primary and ternary data sources are encrypted (computers are using either full disk encryption or logical partition encryption; offsite back-ups are encrypted before leaving my NAS) while the data hoarding source that is my NAS is removing the encryption layer from the primary sources that get synchronised. The data is kept in sync at a file-level, not block-level, so the file-system/partition encryption of the source simply does not apply to the replicate.

I will have to sacrifice performance for privacy since the NAS does not offer much hardware acceleration in the cryptography area. But again, the trade-off seems acceptable because I am not hoarding files for the sake of archiving. My daily computer back-ups will end up on an encrypted ZFS dataset. That way I can still benefit from the features offered by ZFS (which is why I am pushing files and not blocks in the first place) while resting easy about my private data. The largest files on the NAS (media files) are not backed up because I don't deem them very important, so I also won't go through the hassle of encrypting them.