From 8e13924cf55633fd435a4967cf8480eb8bf6ba93 Mon Sep 17 00:00:00 2001 From: Thomas Waldmann Date: Wed, 9 Sep 2026 17:03:41 +0200 Subject: [PATCH] docs: fix init epilog about what none mode can (not) detect The "About modes without encryption" paragraph claimed that only modes other than "none" let borg detect accidental corruption or malicious tampering. That is only half true: "none" mode still verifies the CRC32 of every repository object and the SHA-256 chunk IDs (e.g. on extract or with "borg check --verify-data"), so accidental corruption is detected. What "none" mode cannot detect is malicious tampering, because none of these checks involve a secret key. Co-Authored-By: Claude Fable 5.1 --- src/borg/archiver.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/src/borg/archiver.py b/src/borg/archiver.py index 7f584042ce..ede7b5d569 100644 --- a/src/borg/archiver.py +++ b/src/borg/archiver.py @@ -4755,12 +4755,15 @@ def diff_sort_spec_validator(s): **About modes without encryption:** Avoid using ``none`` mode. If you think about using ``none`` mode, - please reconsider and be absolutely sure. Using any mode other than - ``none`` allows Borg to detect accidental corruption or malicious - tampering with the repo. It also prevents denial-of-service attacks - against clients. Instead of ``none`` mode, you likely want to use - ``authenticated`` mode, or ``repokey`` or ``keyfile`` modes with an - empty passphrase instead (see below). + please reconsider and be absolutely sure. ``none`` mode still detects + accidental corruption (via CRC32 and the SHA-256 chunk IDs, e.g. when + extracting or running ``borg check --verify-data``), but as no secret + key is involved, it cannot detect malicious tampering with the repo. + Any other mode allows Borg to detect such tampering (as long as the + attacker does not have the key and its passphrase) and also prevents + denial-of-service attacks against clients. Instead of ``none`` mode, + you likely want to use ``authenticated`` mode, or ``repokey`` or + ``keyfile`` modes with an empty passphrase instead (see below). If you don't want to encrypt your data, use ``authenticated`` or ``authenticated-blake2`` modes. These modes require a passphrase in