Short answer
Probably yes, unless you're a high-profile target.
Long answer
CrashPlan either encrypts data using password protected certificates, or no encryption at all. In this summary, you can think of a certificate as basically a frigging huge password stored in a file with your name attached to it. This certificate file is commonly encrypted, just to ensure that a quick copy of the file is not enough to access the data--you need the certificate file password too.
Most CrashPlan users likely use what is called escrow certificate storage, where Code42 stores the certificate files for you in encrypted form. When you provide your password, these certificate files are themselves decrypted, and are then used to decrypt your raw data. This is why the CrashPlan web interface can allow you to browse your data - after you provide the certificate password, their software can access the data using the certificate. The main security holes with this:
- You trust Code42+employees to store your certificate securely
- You trust Code42+employees not to ever store your certificate password insecurely
- You trust Code42+employees not to give your certificate file or password to any agency (such as a government) that requests (e.g. subpoena) it
- As I mention above, your certificate is a very big password. If anyone gets their hands on that file, the the only thing stopping them from using it is your certificate password, so if you made it
hunter42
you're pretty screwed. Basically, breaking your certificate password is likely fairly easy if someone is really motivated and you didn't choose a good password.
You can also use a "custom key" (e.g. when you provide the certificate file). This means that Code42 does not store their certificate on their servers. They still store encrypted data on their servers, but if you want to see it in the web interface then you need to provide their software with both the certificate file and the certificate password. Now here's the odd part: this offers almost no realistic additional security over the above option, it's mostly useful for a system with many user accounts that you want to keep separate. You still:
- Trust the CrashPlan application not to store or transmit your certificate file or certificate password
- Trust Code42 not to make any attempt to store this data
The main benefit here is that Code42 cannot reply to an external request for your certificate as easily as they could if you use escrow certificates, they would have to willfully instruct their local CrashPlan application to retrieve your certificate key from your computer and deliver it to them. This would naturally be a huge risk for them due to the business fallout if such a decision ever became public knowledge.
One more relevant point: They apparently always store your certificate file in unencrypted form on your local computer. So if you're a high-profile target, it's feasible someone could acquire your encrypted data from CrashPlan and then execute a simple attack on your personal computer to recover the unencrypted certificate file.
So the answer to your question boils down to "do you trust Code42 with protecting your data from both internal and external threats?" If the answer is no, then encrypting your data using something like TrueCrypt as a second layer of protection is a great idea.
PS - For what it's worth, I love that CrashPlan encrypts quite heavily by default, so don't interpret this as a bashing CrashPlan post--I just want to help users understand who they are trusting :-)