61 lines
2.7 KiB
ReStructuredText
61 lines
2.7 KiB
ReStructuredText
Dropbox Encryption with TrueCrypt
|
|
#################################
|
|
:date: 2011-04-16 12:50
|
|
:author: Russell Ballestrini
|
|
:tags: Greatest Hits, Opinion, Security
|
|
:slug: dropbox-encryption-with-truecrypt
|
|
:status: published
|
|
:summary:
|
|
The best security acts like an onion.
|
|
|
|
`Derek Newton <https://dereknewton.com/2011/04/dropbox-authentication-static-host-ids/>`_
|
|
recently invoked discussion about insecurities in Dropbox authentication.
|
|
In his article he describes how an attacker could exploit Dropbox and gain access to unshared files.
|
|
The concerns he raised do appear accurate however we must remember that security is an onion.
|
|
|
|
|onion|
|
|
|
|
An onion, like security, has layers to protect its vital parts.
|
|
The vital parts are more vulnerable when its security model only possess one layer.
|
|
As we add layers to our security model, our system's protection grows exponentially.
|
|
|
|
In the case of Dropbox, the username and password act as the first
|
|
layer. Experts agree that a simple authentication layer will provide
|
|
enough protection for nonsensitive data. However when attempting to
|
|
protect sensitive data we must pair authorization with encryption.
|
|
|
|
Generally speaking file systems have maintained a sense of insecurity,
|
|
which makes them useful. Not encrypting files on Dropbox is akin to not
|
|
encrypting files on a shared PC. Sensitive data should always be
|
|
encrypted *regardless* of its location or media. We should treat
|
|
sensitive data-at-rest on Dropbox the same way we treat sensitive data
|
|
on local, optical or flash disk. *We should encrypt it!*
|
|
|
|
**So how does a user encrypt their Dropbox?**
|
|
|
|
My strongly opinionated solution uses TrueCrypt to create an encrypted
|
|
volume in the Dropbox directory. Simply treat the Dropbox like a normal
|
|
directory, follow the TrueCrypt documentation to build a volume, and
|
|
give Dropbox a chance to sync the data. When the sync completes, the
|
|
TrueCrypt volume will be mountable on each of your Dropbox enabled
|
|
computers.
|
|
|
|
I have to admit at first I was skeptical, but the software cooperates
|
|
surprisingly well and after the initial sync proceeding syncs occur
|
|
quickly! I prefer TrueCrypt because it is open source, cross platform,
|
|
and free (both in freedom and cost). TrueCrypt also functions and
|
|
performs better then any other solution including commercial products
|
|
like GuardianEdge or PGP both recently acquired by Symantec.
|
|
|
|
All security and encryption software should remain open sourced and peer
|
|
reviewed to prevent harmful tampering. Commercial software, written in a
|
|
black-box vacuum, prevents customers from viewing its code and
|
|
procedures. We cannot trust software for security when we cannot view
|
|
its source code.
|
|
|
|
You should follow me on twitter
|
|
`here <https://twitter.com/russellbal>`_
|
|
|
|
.. |onion| image:: /uploads/2011/04/onion.png
|
|
|
|
.. contents::
|