4 ms·

Dropbox Encryption with TrueCrypt

33 points by foxhop 16y ago

iam 16y ago
I don't profess to know much about security, but unless TrueCrypt does block-level encryption, AND dropbox does block-level syncing, wouldn't this scheme work out really poorly for storing large TrueCrypt volumes?
- foxhop 16y ago
  That is a great question, If you find the answer let me know. At this point I have been playing around with 700mb file volumes. When I make an addition to the volume, it takes about 2 minutes to sync. I have not tested deletions yet.
  - hedgehog 16y ago
    I used to store use TrueCrypt + Dropbox to store some important files. Dropbox will detect and sync only the changed portions of your TrueCrypt volume. It takes a while (I think it does some sort of rolling checksum thing to detect differences so it has to read through the entire thing locally) but works ok. It would only sync when the volume was unmounted though.
- psykotic 16y ago
  Assuming a strong form of encryption with minimal information leakage, avalanching would imply that flipping even a single bit of plaintext in a volume of N bits would force ~N/2 bits of ciphertext to change with a distribution approaching maximum entropy. Flipping any number of bits should have the same statistical effect. Of course, that's infeasible for file system encryption and isn't how TrueCrypt works. An idea is to use a one-to-one mapping between TrueCrypt blocks and DropBox files. Write a file system watcher script that picks up changes to files in the DropBox folder and mirrors the changes to the corresponding blocks in a TrueCrypt volume that lives outside the DropBox folder. The other way around, too. Do you see anything obviously wrong-headed with this approach? I admittedly don't know the details of TrueCrypt's crypto. If it already does file-level rather than block-level encryption, these tricks wouldn't be necessary. But file-level encryption would seem to leak way too much information to satisfy the truly paranoid.
knight99 16y ago
I am wondering how/if TrueCrypt would properly handle being synced if mounted on multiple machines at the same time. One of the biggest benefits of DropBox to me is the access the files instantly on all my computers. If I have to unmount and mount the TrueCrypt volume to change files, that benefit goes away.. What happens if I forget to unmount the volume at home, can I safely change the files while away?
- foxhop 16y ago
  I guess more testing would be required to know for sure. Its good news that both services are free so it wouldn't be difficult to test out your circumstances. I use Dropbox more like a thumbdrive for temporary transfers and I like to have the warm and fuzzies that my data at rest is protected with strong encryption.
- danieldk 16y ago
  I tried this, and got multiple versions of the truecrypt volume file, filling up my Dropbox account. Pretty nasty, since I had to merge the changes of each variation back in one volume by hand. This article resembles the recent posts about using git on Dropbox - I wonder if people actually tried this for a longer period, because it just doesn't work, unless you mount the volume only one machine simultaneously and always sync after unmounting (easy to forget after mobile use).
  - jerrya 16y ago
    Yes, I took the plunge one day and put a truecrypt volume on dropbox and then put my quicken files in that truecrypt volume, and, .... Major lossage ensued when I found dropbox gave me multiple versions of that truecrypt volume.
- hedgehog 16y ago
  Nope, you can only mount the disk one place at a time. It wouldn't be an easy thing to build.
- Groxx 16y ago
  They're not. While the data spaces may not overlap, the file table very likely will (as much of it will fit in a single encryption block), so any parallel changes collide there in even the best circumstance. I program out of my TrueCrypt volume while in Windows, unmount it, and let it sync. It's a super-easy backup, and DropBox is the only one I've used that handles a 1GB file correctly, and it does it without a hitch. Worst-case-scenario is you do cause a collision, and you just mount both volumes at once and copy stuff to the one you want to keep.
chanux 16y ago
My take on encrypting stuff on Dropbox.. http://chanux.wordpress.com/2010/10/10/portable-encrypted-virtual-disk http://chanux.wordpress.com/2010/10/10/portable-encrypted-vi... (It's not not just aiming Dropbox but the only place I actually use it on is Dropbox.)
albertzeyer 16y ago
TrueCrypt doesn't really work because you can't mount it from several places at the same time. I looked up for other solutions which allow this (for example by doing the encryption separately for each file; but I could also think about other things). I only found http://www.arg0.net/encfs http://www.arg0.net/encfs so far but I didn't tried yet. It does the encryption separately for each file.
- dermatthias 16y ago
  I use encFS for the sensitive files inside my Dropbox and it works really well. Because it is a per file based encryption and most of my sensitive files are rather small (<1MB), there are no (noticeable) speed problems. In combination with some (really simple) bash scripts for mount- and unmounting, this is imho a good way to encrypyt files inside your Dropbox.
- cookiecaper 16y ago
  You can do this with ecryptfs, which is built into the kernel. It transparently encrypts each file in a "lower" directory; this directory is mounted to a "higher" directory where the files are transparently encrypted/decrypted as needed. It's a great solution for this kind of stuff and it lives in the kernel. You don't have to deal with FUSE or any of that.
- pbh 16y ago
  encfs didn't work for me either. See this comment from a year and a half ago: http://news.ycombinator.com/item?id=895660 http://news.ycombinator.com/item?id=895660 Dropbox supposedly encrypts server side. If you want to encrypt client-side, use SpiderOak or TarSnap. These hacks on top of Dropbox don't mesh with the semantics of Dropbox properly and will cause problems days, weeks, or months down the line unless managed extremely carefully.
  - albertzeyer 16y ago
    Yes, I already thought about that case. But I don't think it should be complicated to extend EncFS to handle that well (to just provide both versions to the end user in that case).
Locke1689 16y ago
Instead of attempting a nasty (and possibly insecure) workaround like this, you should use http://www.tarsnap.com/ http://www.tarsnap.com/
- deleted 16y ago
  [deleted]
- aceofspades19 16y ago
  If you could use tarsnap in Canada, I would totally use it
Derbasti 16y ago
Also, this clearly breaks web access and mobile device access to your files. That said, I have been using this scheme for my most valuable data sets for about a year without problems.
vibhavs 16y ago
I store sensitive data in Dropbox using an OS X encrypted disk image in my Dropbox directory. It's not an elegant solution, but it gets the job done. I mount the password-protected disk image when needed, access the data, and unmount when finished. Upon unmounting, Dropbox syncs the encrypted blocks to S3, other computers, etc. (Encrypted disk-images can be fairly handy. I picked up the trick from a friend and colleague who used them to protect email and other sensitive documents on his laptop. E.g. he sym-linked Mail.app's mail directory, ~/Library/Mail, to the disk image.)
- sunchild 16y ago
  Doesn't this prevent backup/syncing while the image is open?
  - daydream 16y ago
    Sure, but in practice for a single-user dropbox account it's not a big deal, IF you unmount the volume when you're done with it. I do the same thing that the GP does - mount the disk image, work with the files, then unmount. It's been working great for me for a while, though as the GP says it's not very elegant.

33 points by foxhop 16y ago

iam 16y ago

I don't profess to know much about security, but unless TrueCrypt does block-level encryption, AND dropbox does block-level syncing, wouldn't this scheme work out really poorly for storing large TrueCrypt volumes?

foxhop 16y ago
That is a great question, If you find the answer let me know. At this point I have been playing around with 700mb file volumes. When I make an addition to the volume, it takes about 2 minutes to sync. I have not tested deletions yet.
- hedgehog 16y ago
  I used to store use TrueCrypt + Dropbox to store some important files. Dropbox will detect and sync only the changed portions of your TrueCrypt volume. It takes a while (I think it does some sort of rolling checksum thing to detect differences so it has to read through the entire thing locally) but works ok. It would only sync when the volume was unmounted though.
psykotic 16y ago
Assuming a strong form of encryption with minimal information leakage, avalanching would imply that flipping even a single bit of plaintext in a volume of N bits would force ~N/2 bits of ciphertext to change with a distribution approaching maximum entropy. Flipping any number of bits should have the same statistical effect. Of course, that's infeasible for file system encryption and isn't how TrueCrypt works. An idea is to use a one-to-one mapping between TrueCrypt blocks and DropBox files. Write a file system watcher script that picks up changes to files in the DropBox folder and mirrors the changes to the corresponding blocks in a TrueCrypt volume that lives outside the DropBox folder. The other way around, too. Do you see anything obviously wrong-headed with this approach? I admittedly don't know the details of TrueCrypt's crypto. If it already does file-level rather than block-level encryption, these tricks wouldn't be necessary. But file-level encryption would seem to leak way too much information to satisfy the truly paranoid.

knight99 16y ago

I am wondering how/if TrueCrypt would properly handle being synced if mounted on multiple machines at the same time. One of the biggest benefits of DropBox to me is the access the files instantly on all my computers. If I have to unmount and mount the TrueCrypt volume to change files, that benefit goes away.. What happens if I forget to unmount the volume at home, can I safely change the files while away?

foxhop 16y ago
I guess more testing would be required to know for sure. Its good news that both services are free so it wouldn't be difficult to test out your circumstances. I use Dropbox more like a thumbdrive for temporary transfers and I like to have the warm and fuzzies that my data at rest is protected with strong encryption.
danieldk 16y ago
I tried this, and got multiple versions of the truecrypt volume file, filling up my Dropbox account. Pretty nasty, since I had to merge the changes of each variation back in one volume by hand. This article resembles the recent posts about using git on Dropbox - I wonder if people actually tried this for a longer period, because it just doesn't work, unless you mount the volume only one machine simultaneously and always sync after unmounting (easy to forget after mobile use).
- jerrya 16y ago
  Yes, I took the plunge one day and put a truecrypt volume on dropbox and then put my quicken files in that truecrypt volume, and, .... Major lossage ensued when I found dropbox gave me multiple versions of that truecrypt volume.
hedgehog 16y ago
Nope, you can only mount the disk one place at a time. It wouldn't be an easy thing to build.
Groxx 16y ago
They're not. While the data spaces may not overlap, the file table very likely will (as much of it will fit in a single encryption block), so any parallel changes collide there in even the best circumstance. I program out of my TrueCrypt volume while in Windows, unmount it, and let it sync. It's a super-easy backup, and DropBox is the only one I've used that handles a 1GB file correctly, and it does it without a hitch. Worst-case-scenario is you do cause a collision, and you just mount both volumes at once and copy stuff to the one you want to keep.

chanux 16y ago

My take on encrypting stuff on Dropbox.. http://chanux.wordpress.com/2010/10/10/portable-encrypted-virtual-disk http://chanux.wordpress.com/2010/10/10/portable-encrypted-vi... (It's not not just aiming Dropbox but the only place I actually use it on is Dropbox.)

albertzeyer 16y ago

TrueCrypt doesn't really work because you can't mount it from several places at the same time. I looked up for other solutions which allow this (for example by doing the encryption separately for each file; but I could also think about other things). I only found http://www.arg0.net/encfs http://www.arg0.net/encfs so far but I didn't tried yet. It does the encryption separately for each file.

dermatthias 16y ago
I use encFS for the sensitive files inside my Dropbox and it works really well. Because it is a per file based encryption and most of my sensitive files are rather small (<1MB), there are no (noticeable) speed problems. In combination with some (really simple) bash scripts for mount- and unmounting, this is imho a good way to encrypyt files inside your Dropbox.
cookiecaper 16y ago
You can do this with ecryptfs, which is built into the kernel. It transparently encrypts each file in a "lower" directory; this directory is mounted to a "higher" directory where the files are transparently encrypted/decrypted as needed. It's a great solution for this kind of stuff and it lives in the kernel. You don't have to deal with FUSE or any of that.
pbh 16y ago
encfs didn't work for me either. See this comment from a year and a half ago: http://news.ycombinator.com/item?id=895660 http://news.ycombinator.com/item?id=895660 Dropbox supposedly encrypts server side. If you want to encrypt client-side, use SpiderOak or TarSnap. These hacks on top of Dropbox don't mesh with the semantics of Dropbox properly and will cause problems days, weeks, or months down the line unless managed extremely carefully.
- albertzeyer 16y ago
  Yes, I already thought about that case. But I don't think it should be complicated to extend EncFS to handle that well (to just provide both versions to the end user in that case).

Locke1689 16y ago

Instead of attempting a nasty (and possibly insecure) workaround like this, you should use http://www.tarsnap.com/ http://www.tarsnap.com/

deleted 16y ago
[deleted]
aceofspades19 16y ago
If you could use tarsnap in Canada, I would totally use it

Derbasti 16y ago

Also, this clearly breaks web access and mobile device access to your files. That said, I have been using this scheme for my most valuable data sets for about a year without problems.

vibhavs 16y ago

I store sensitive data in Dropbox using an OS X encrypted disk image in my Dropbox directory. It's not an elegant solution, but it gets the job done. I mount the password-protected disk image when needed, access the data, and unmount when finished. Upon unmounting, Dropbox syncs the encrypted blocks to S3, other computers, etc. (Encrypted disk-images can be fairly handy. I picked up the trick from a friend and colleague who used them to protect email and other sensitive documents on his laptop. E.g. he sym-linked Mail.app's mail directory, ~/Library/Mail, to the disk image.)

sunchild 16y ago
Doesn't this prevent backup/syncing while the image is open?
- daydream 16y ago
  Sure, but in practice for a single-user dropbox account it's not a big deal, IF you unmount the volume when you're done with it. I do the same thing that the GP does - mount the disk image, work with the files, then unmount. It's been working great for me for a while, though as the GP says it's not very elegant.