I asked myself a similar question about a year ago.
Here's my similar use case, (I imagine it's a common scenario):
I own a decent amount of crypto currency, know how to do crypto taxes, etc. (For me it's a hedge against the possibility of hyper inflation + diversification of my index funds.)
After doing tons of research I came to the conclusion that hardware cryptocurrency wallets are dumb, and I prefer something called a "paper wallet". The idea is you have a really long password that you could hypothetically write down on a piece of paper and it's a seed that can deterministically recreate the public private key pair associated with your crypto wallet AKA recreate your Crypto Currency Wallet from a deterministic seed. Alternatively you can store your "paper wallet" (it's just a long password) in a .txt and save it to the cloud to get redundancy.
The reason I'm sharing that background context is to point out that I too have "very sensitive family files" (if anyone get's access to my paper wallet / crypto wallets deterministic seed / really long password, they can steal all my crypto) and I too wanted:
- Safe long term geo redundant storage for disaster recovery. (If my house burns down, my data should still be accessible.)
- Bit rot protection (protection against quantum degradation)
- Legit security that'd be safe for decades (including post quantum cryptography proof)
- Good user experience (it should be easy enough for my entire family to use, not just me.)
Here's what I used to do and don't recommend:
(I'm sharing my real world experience about being a Veracrypt user for over 10 years and then permanently moving away from Veracrypt, mentioning it due to a comment above.) I used to use store my crypto paper wallets in a Veracrypt volume on dropbox, but over the course of 10++ years I discovered that dropbox and many others didn't correctly detect edits of files inside the Veracrypt volume (it used to in a really old version of dropbox, but then they changed some underlying algorithm and it stopped working.) I discovered I'd lose data when I'd upgrade computers as dropbox would have an old copy of the data, unless I diligently remembered to rename the Veracrypt volume after editing the contents inside to force a re-upload. (I tried dropbox and many other providers with similar results their scanning for edits algorithm just wouldn't consistently correctly detect changes.) (Also Veracrypt had a requirement for thick provisioning of volumes, and would sometimes need a complete reupload for a single small edit, so basically it's a terrible fit to try to store a Veracrypt volume (a file that you can mount as a virtual filesystem) on cloud volume storage.)
Here's my personal future proof solution:
I use cryptomator (FOSS, with an optional "supporter" license that you can buy.) In a nut shell it:
Is a cross platform app (Linux, Windows, Mac, etc.)
Has a great KISS UX
Follows Unix philosophy of do 1 thing and do it well / good separation of concerns: It pre-encrypts your data, then you can store it on an arbitrary untrusted backend that supports features like global redundancy and anti bit rot protection. (you let an arbitrary cloud file storage service like dropbox, google drive, one drive, box, sync.com, tresorit.com, or whatever you like, store your data. The great thing is it's a zero trust architecture, in theory you could even make your backend data publicly accessible on the internet and be fine.)
How does the separation of concerns work? It's similar to VeraCrypt in that it mounts a virtual file system, the main difference is its designed to work with cloud file storage backends. Instead of the encrypted virtual file system being represented by a single file. It uses FUSE / WebDAV file system virtualization to create a 1:1 mapping of encrypted files to cleartext files. In other words from say dropbox's perspective (The NSA, USA's Patriot Act "Big Brother" programs, dropbox staff, and hackers who have gotten unauthorized access to dropbox's files from historic data breaches who are all spying on your files you uploaded), they only see 1 encrypted file. But from the perspective of your local machine, where you typed your symmetric decryption key in and it was loaded into ram, and used to mount a virtual FUSED file system. You'd see 1 cleartext file that you can use and edit just like a normal file. When you edit your 1 cleartext file, the corresponding encrypted file stored in dropbox gets edited, so editing a cleartext file, edits it's corresponding encrypted twin file (this is critical as it means differential edits to encrypted files are correctly detected and sync'd to the cloud. + allows thin provisioning, and bandwidth saving.)
So yeah it does client side encryption / decryption of data in a seamless way, such that data is pre-encrypted before being sent to the cloud and only ever decrypted on your local machine, never decrypted on cloud servers.
Cryptomator uses NIST approved AES symmetric encryption. This next part is critically important for safe long term storage. You need to think up a password that you can memorize cold that's at least 43 characters in length. According to this SO Q&A. Me personally instead of memorizing gibberish I chose to memorize gibberish + an easy to remember phrase and since that's less random I chose to memorize a password over 70 characters in length. The point is that the length and complexity of my password ensure I have at least 256 bits of security.
(Key Concept: It's the length of your password that gives 256++ bits of security not the underlying algorithm). Once quantum computers become mainstream, they'll be able to run an quantum cryptography algorithm that can completely compromise current asymmetric encryption public private key pairs, but the quantum cryptography algorithms can at best cut the strength of symmetric keys in half. So in a post quantum computer world the 256++ bits of security in my password are more like 128++bits of security. (The cool thing is 128 bits of security is permanently brute force proof, see linked SE Q&A for details)
- TIP: If you can't remember a 43 character password, you could always use a secure password manager like bit-warden, enable MFA on the password manager, and store the the 43 character random gibberish in bit-warden, or first 38 characters of your symmetric key (AKA password) in bit-warden, then commit the last 5 character's to memory. Btw Bit-warden has a good feature where you can create organizations / family orgs and have shared passwords between family members. So you and your significant other can setup solid MFA protected access to bit warden, and set RBAC access to shared secrets. (It's worth noting that this person would need to be family as you couldn't revoke their access since it'd be a symmetric key, but there's cases where this could be desirable. Alternatively if you wanted to account for in the case of death you want a family member to be able to gain access to your data, you could always create a sealed will and have a written copy of the decryption key there.)
I like to use overkill level paranoia (mostly for fun / learning purposes), so I also do the following that I think could be optional for most people / defense in depth security.
- My personal computer can be considered a secure endpoint device, since I don't use Windows. Instead I use Debian with Cinnamon Desktop Environment (The user interface is similar to Windows 7, and it's way more secure than Windows. Technically OpenSUSE's MicroOS + KDE would be even more secure, but Fold-at-home's SUSE packages are currently broken, so I went with Debian.)
- AES has gone largely un-compromised for over 24 years now (published in 1998), but I like my tin foil hats. So I like to use trusted services to make sure I'm the only one who has access to my data. A nation state would need to get access to a copy of your encrypted data before they could even take a shot at trying to compromise it. I personally don't trust dropbox, Microsoft Drive, Google Drive, and many others. I trust sync.com, but they don't have a Linux client. So I started to use one of the most trust worthy in my personal opinion according to my own research + one of the most expensive*, (I personally pay $125/year, mostly to support them, but they do have a free tier plan as well), Tresorit.com. (they're a little slow, but they have cross platform clients first class support for linux, have Sweden based severs with legal protection against big brother snooping, solid reputation + history of existing since 2011.)