Protecting Dropbox files – Dropbox & encryption

cryptographydropboxSecurity

I'm using Dropbox to sync files. There's a big disadvantage that files are stored somewhere unencrypted. I'd like to encrypt and decrypt them on the client, but have no clue how to do it.

Tried Truecrypt, but it seems to be complicated to sync the Truecrypt volume file because of its size. Even a small change in the Truecrypt filesystem can cause big changes in the encrypted volume file.

Is there probably a good open source alternative to Dropbox that can be run on an own server?

Best Answer

SparkleShare looks interesting as a self-hosted Dropbox equivalent, though I haven't tried it. You can use encfs to encrypt the files on a Linux server, and it uses Git as its data store.

For transparent encryption of files within Dropbox, BoxCryptor looks quite good on Windows (you didn't mention a platform). It uses the same format and algorithm as encfs, which is available on MacOS X and Linux - here's an example of the Ubuntu setup for use with BoxCryptor. The only downside is that you then can't use the website to view files, nor can you use iPhone/Android clients (though Android might be possible if you set up encfs).

If you really need cross-platform encryption within Dropbox or similar, you could use either:

  • ZIP files with the Winzip AES encryption format (not the PKWare SES format), which is supported by zip and 7-zip on Linux, and almost all ZIP programs generally. Also has many iPhone clients such as iZip.com (not iZip).
  • 7-Zip .7z files - less widely supported but encrypt the filenames in the archive, unlike ZIP files, and iUnarchive on iPhone supports this.

Although TrueCrypt is mentioned a lot for encryption within Dropbox, I don't recommend it if you are using more than one computer (and if you aren't, why use Dropbox?)- you must be careful to unmount the TrueCrypt volume, so that the same volume contents is not mounted on two systems simultaneously, causing corruption. This turns Dropbox into much less of an "unconscious sharing" tool.

I found SpiderOak was quite unreliable when I tried it extensively in 2009 - syncing large number of files from two home PCs never completed, restores didn't work, and it was generally very hard to work out what was going on through its GUI (many undefined terms). Support was not able to solve the problems I reported. Perhaps it's better now, but I would try Wuala first if you want a commercial service.

Related Question