[Duplicity-talk] how might you keep remote backups safe given a hacked machine?

[Rob Browning]

While thinking of the security issues, it occurred to me that
duplicity's current facilities might not provide a way to protect a
given machine's backups if that machine were compromised (a situation
where you really *need* your backups :>)

It looks like duplicity only supports "push" options, so if an
attacker compromises a given machine, it seems like they could then
use whatever method the machine was using to run its duplicity backups
to destroy those backups on the remote machine (i.e. scp /dev/null,
etc.).

A "pull method" where the server copies the data *from* the client,
and a well protected backup server, would help avoid this problem, but
I'm not sure it would be easy to add such a thing.

How do other people handle this issue, if at all[1]?

Thanks

[1] I perhaps offsite and offline backups are a suitable answer, but I
    suspect for many it may not be easy to keep those quite as fresh
    as they do their duplicity-style backups.

-- 
Rob Browning
rlb @defaultvalue.org, @linuxdevel.com, and @debian.org
Previously @cs.utexas.edu
GPG starting 2002-11-03 = 14DD 432F AE39 534D B592  F9A0 25C8 D377 8C7E 73A4