3 ms·

This is a great idea but I often have this problem the other way around. I regularly want to send encrypted data to companies that don't know how to decrypt it

This is a great idea but I often have this problem the other way around. I regularly want to send encrypted data to companies that don't know how to decrypt it. The number of firms that ask for sensitive info to be emailed across (or not much better - use dropbox) is crazy. Anyone got any good solutions to this?

burkaman 10y ago
Does a password-protected zip file work?
- taco_emoji 10y ago
  Password-protected ZIP shared on dropbox, with password communicated via phone or SMS?
  - jsingleton 10y ago
    I've resorted to this before, but there must be a better way!
    - zokier 10y ago
      That is essentially corporate policy at my workplace. We use in-house file-sharing system, and I think the recommendation is to prefer 7z over vanilla zip. Typical channel for sending password is via SMS. Its not elegant, but in the end I find it reasonably good compromise between security and practicality.
- jsingleton 10y ago
  This is the most basic step, but even this is non-trivial. There are multiple ways of password protecting a zip, ZipCrypto is insecure and not all software supports AES-256. Self-extractors will get stopped by AV and sometimes even password protected zips (as the AV can't read them). You then have to communicate the password out-of-band, as emailing it would defeat the purpose. It may be hard to read over the phone and you have to trust it was not written down and the file is not then stored/forwarded unencrypted. Explaining the process to someone non-technical may be challenging. Symmetric crypto is a mess, asymmetric would be great if secure key exchange could be easy. If only the software was as ubiquitous as zip handling is in the OS.
  - srpeck 10y ago
    Microsoft solves this with RMS for Individuals: https://portal.aadrm.com/ https://portal.aadrm.com/ (also called the RMS Sharing App, now getting rebranded to Azure Information Protection). The recipient's identity is the key to opening the content - no need to communicate anything out-of-band. Depending on the file format chosen, you get DRM features limiting granular actions on the file beyond view/edit. To open the protected files, your recipients will have to download/install the (free) app from Microsoft. This is generally pretty painless. Definitely worth checking out, especially good for consultants' workflows.
    - jsingleton 10y ago
      This actually looks like it might be the least-worst solution, thanks! This is the product page: https://www.microsoft.com/en-us/cloud-platform/azure-information-protection https://www.microsoft.com/en-us/cloud-platform/azure-informa...
jpdlla 10y ago
Same thing here. This + HawkPost would be interesting.
dethos 10y ago
Thats an use case that we also encounter often, we are still thinking about a solution (be it through Hawkpost or something else). The other way around is definitely an harder problem, if we want to keep it simple for the non-tech savvy user.
matt4077 10y ago
Protonmail has the ability to send a password-encrypted message to anyone. They just get a link and you have to give them the password through other means. All encryption is handled client-side in js (they recently became maintainers of that library as well, iirc). The message can also expire after x days and the recipient can reply. I'm not sure if I like how they're basically inventing their own encryption scheme for emails instead of supporting pgp, but for these use-cases it's quite slick.
- jsingleton 10y ago
  Interesting. The feature is buried at the bottom of this page: https://protonmail.com/security-details https://protonmail.com/security-details Could be quite useful. The biggest problem is the recipient not having a compatible decompresser that can decrypt the archive.

burkaman 10y ago

Does a password-protected zip file work?

taco_emoji 10y ago
Password-protected ZIP shared on dropbox, with password communicated via phone or SMS?
- jsingleton 10y ago
  I've resorted to this before, but there must be a better way!
  - zokier 10y ago
    That is essentially corporate policy at my workplace. We use in-house file-sharing system, and I think the recommendation is to prefer 7z over vanilla zip. Typical channel for sending password is via SMS. Its not elegant, but in the end I find it reasonably good compromise between security and practicality.
jsingleton 10y ago
This is the most basic step, but even this is non-trivial. There are multiple ways of password protecting a zip, ZipCrypto is insecure and not all software supports AES-256. Self-extractors will get stopped by AV and sometimes even password protected zips (as the AV can't read them). You then have to communicate the password out-of-band, as emailing it would defeat the purpose. It may be hard to read over the phone and you have to trust it was not written down and the file is not then stored/forwarded unencrypted. Explaining the process to someone non-technical may be challenging. Symmetric crypto is a mess, asymmetric would be great if secure key exchange could be easy. If only the software was as ubiquitous as zip handling is in the OS.
- srpeck 10y ago
  Microsoft solves this with RMS for Individuals: https://portal.aadrm.com/ https://portal.aadrm.com/ (also called the RMS Sharing App, now getting rebranded to Azure Information Protection). The recipient's identity is the key to opening the content - no need to communicate anything out-of-band. Depending on the file format chosen, you get DRM features limiting granular actions on the file beyond view/edit. To open the protected files, your recipients will have to download/install the (free) app from Microsoft. This is generally pretty painless. Definitely worth checking out, especially good for consultants' workflows.
  - jsingleton 10y ago
    This actually looks like it might be the least-worst solution, thanks! This is the product page: https://www.microsoft.com/en-us/cloud-platform/azure-information-protection https://www.microsoft.com/en-us/cloud-platform/azure-informa...

jpdlla 10y ago

Same thing here. This + HawkPost would be interesting.

dethos 10y ago

Thats an use case that we also encounter often, we are still thinking about a solution (be it through Hawkpost or something else). The other way around is definitely an harder problem, if we want to keep it simple for the non-tech savvy user.

matt4077 10y ago

Protonmail has the ability to send a password-encrypted message to anyone. They just get a link and you have to give them the password through other means. All encryption is handled client-side in js (they recently became maintainers of that library as well, iirc). The message can also expire after x days and the recipient can reply. I'm not sure if I like how they're basically inventing their own encryption scheme for emails instead of supporting pgp, but for these use-cases it's quite slick.

jsingleton 10y ago
Interesting. The feature is buried at the bottom of this page: https://protonmail.com/security-details https://protonmail.com/security-details Could be quite useful. The biggest problem is the recipient not having a compatible decompresser that can decrypt the archive.