5 ms·

Does anybody have suggestions for an alternate tool? Preferably one that also encrypts at the file level so that it plays nice with Dropbox and similar services

by akerl_ 13y ago

Does anybody have suggestions for an alternate tool? Preferably one that also encrypts at the file level so that it plays nice with Dropbox and similar services (while obviously providing more security).

zokier 13y ago
Just use full-disk encryption, eg. dm-crypt.
- icebraining 13y ago
  How does that play nice with Dropbox and similar services?
- akerl_ 13y ago
  I do use full-disk encryption for my local disk as a whole, but for things inside syncing services like Dropbox, block-level encryption kills a number of the useful features and ends up wasting way more transfer to sync changes. I know they could potentially do cute de-duping tricks on their end, similar to tarsnap, but even if they passed those space savings on to me I'd still lose the file-level features. That's why I chose EncFS to begin with, and asked for potential other file-level tools to replace it. Realistically, I'd prefer if this expedited EncFS 2.0 and 2.0 fixed the noted issues.
  - peterwwillis 13y ago
    You could use a revision control filesystem like Git on top of the block encryption of dm-crypt [in a loopback]. Git takes care of de-duplication and compression for you, so the blocks you transfer are just changed ones. Of course, this also means your Dropbox will never shrink, so I hope you really like keeping old copies of files ;)
phaer 13y ago
GnuPG can encrypt files and is more secure.
- onli 13y ago
  GnuG can not encrypt files while working on the decrypted files in parallel, can it? That is what I would mean with "working good with Dropbox".
  - akerl_ 13y ago
    That's also what I mean. If I have to think about the encryption during day-to-day operation, the encryption has failed. That's why I <3 full disk encryption: it seamlessly works.
    - onli 13y ago
      Yeah, I too, though it does not help with things like Dropbox. You need to add a second encryption inside your full disk encryption separately for everything that has direct access to the files. And that is exactly where encfs shines (even though I also use it for home, but that is a different story).
    - atmosx 13y ago
      Dropbox will sync the files in plaintext if you use full disk encryption. If TC + Dropbox is not an option, maybe owncloud + private hosting +SSL certs should be used instead... OR SSHFS with private keys.
aroch 13y ago
A truecrypted image can be incrementally backed up (changed blocks only)
rakoo 13y ago
Here's a pretty good comparison table: https://wiki.archlinux.org/index.php/Disk_Encryption#Comparison_table https://wiki.archlinux.org/index.php/Disk_Encryption#Compari...
- akerl_ 13y ago
  Yea, that's what I researched to initially get the idea to use EncFS. I forget why I discounted ecryptfs, it may be because that page doesn't make it look great for cross-platform support.
- tptacek 13y ago
  This is a frustrating table; it's got irrelevant details (like which of a variety of ciphers are supported) but nothing on what constructions and modes are used, which KDFs are supported, how nonces are handled, &c. It would be one thing if all these systems used roughly the same XTS construction, like modern full disk encryption systems. But they don't; they use '90s constructions like block-addressed CBC.
nabla9 13y ago
I use Truerypt and Dropbox. They play well together. ps. I have repeatedly encountered people who falsely assume that Truecrypt does not allow incremental backups with Dropbox. The thinking behind this seems to be assumption cipher-block chaining (CBC) is used. Truecrypt uses XTS mode.
- mike-cardwell 13y ago
  Does Truecrypt sync changes when a file inside the container is changed, or when the container its self is unmounted? I seem to recall having issues with this a few years ago when I tried it out. Probably something to do with Truecrypt maintaining a filesystem lock or something? Needless to say, with encfs on Dropbox, files are synced as soon as they are changed.
  - huhtenberg 13y ago
    TC containers are not accessible while mounted.
    - mike-cardwell 13y ago
      Thought so. Truecrypt is no use for me then. I need something that will sync changes as they happen, or at least shortly afterwards. I don't want to have to unmount and remount my Truecrypt container once an hour or whatever to sync changes.
      - deleted 13y ago
        [deleted]
      - icebraining 13y ago
        Assuming the size of the files isn't that big, you could always keep an unencrypted copy that you actually work on, and then periodically a script would mount the container, rsync the unencrypted directory to it, and unmount it so it can be synced. Sure the unencrypted copy would be exposed, but not to any process that couldn't already access the mounted directory, as far as I can see.
limmeau 13y ago
ecryptfs is also file-level, though more difficult to set up. (The "e" is for "enterprise", so you spend time entering token into keyrings etc).

by akerl_ 13y ago

zokier 13y ago

Just use full-disk encryption, eg. dm-crypt.

icebraining 13y ago
How does that play nice with Dropbox and similar services?
akerl_ 13y ago
I do use full-disk encryption for my local disk as a whole, but for things inside syncing services like Dropbox, block-level encryption kills a number of the useful features and ends up wasting way more transfer to sync changes. I know they could potentially do cute de-duping tricks on their end, similar to tarsnap, but even if they passed those space savings on to me I'd still lose the file-level features. That's why I chose EncFS to begin with, and asked for potential other file-level tools to replace it. Realistically, I'd prefer if this expedited EncFS 2.0 and 2.0 fixed the noted issues.
- peterwwillis 13y ago
  You could use a revision control filesystem like Git on top of the block encryption of dm-crypt [in a loopback]. Git takes care of de-duplication and compression for you, so the blocks you transfer are just changed ones. Of course, this also means your Dropbox will never shrink, so I hope you really like keeping old copies of files ;)

phaer 13y ago

GnuPG can encrypt files and is more secure.

onli 13y ago
GnuG can not encrypt files while working on the decrypted files in parallel, can it? That is what I would mean with "working good with Dropbox".
- akerl_ 13y ago
  That's also what I mean. If I have to think about the encryption during day-to-day operation, the encryption has failed. That's why I <3 full disk encryption: it seamlessly works.
  - onli 13y ago
    Yeah, I too, though it does not help with things like Dropbox. You need to add a second encryption inside your full disk encryption separately for everything that has direct access to the files. And that is exactly where encfs shines (even though I also use it for home, but that is a different story).
  - atmosx 13y ago
    Dropbox will sync the files in plaintext if you use full disk encryption. If TC + Dropbox is not an option, maybe owncloud + private hosting +SSL certs should be used instead... OR SSHFS with private keys.

aroch 13y ago

A truecrypted image can be incrementally backed up (changed blocks only)

rakoo 13y ago

Here's a pretty good comparison table: https://wiki.archlinux.org/index.php/Disk_Encryption#Comparison_table https://wiki.archlinux.org/index.php/Disk_Encryption#Compari...

akerl_ 13y ago
Yea, that's what I researched to initially get the idea to use EncFS. I forget why I discounted ecryptfs, it may be because that page doesn't make it look great for cross-platform support.
tptacek 13y ago
This is a frustrating table; it's got irrelevant details (like which of a variety of ciphers are supported) but nothing on what constructions and modes are used, which KDFs are supported, how nonces are handled, &c. It would be one thing if all these systems used roughly the same XTS construction, like modern full disk encryption systems. But they don't; they use '90s constructions like block-addressed CBC.

nabla9 13y ago

I use Truerypt and Dropbox. They play well together. ps. I have repeatedly encountered people who falsely assume that Truecrypt does not allow incremental backups with Dropbox. The thinking behind this seems to be assumption cipher-block chaining (CBC) is used. Truecrypt uses XTS mode.

mike-cardwell 13y ago
Does Truecrypt sync changes when a file inside the container is changed, or when the container its self is unmounted? I seem to recall having issues with this a few years ago when I tried it out. Probably something to do with Truecrypt maintaining a filesystem lock or something? Needless to say, with encfs on Dropbox, files are synced as soon as they are changed.
- huhtenberg 13y ago
  TC containers are not accessible while mounted.
  - mike-cardwell 13y ago
    Thought so. Truecrypt is no use for me then. I need something that will sync changes as they happen, or at least shortly afterwards. I don't want to have to unmount and remount my Truecrypt container once an hour or whatever to sync changes.
    - deleted 13y ago
      [deleted]
    - icebraining 13y ago
      Assuming the size of the files isn't that big, you could always keep an unencrypted copy that you actually work on, and then periodically a script would mount the container, rsync the unencrypted directory to it, and unmount it so it can be synced. Sure the unencrypted copy would be exposed, but not to any process that couldn't already access the mounted directory, as far as I can see.

limmeau 13y ago

ecryptfs is also file-level, though more difficult to set up. (The "e" is for "enterprise", so you spend time entering token into keyrings etc).