Securing Dropbox (and other cloud syncing services)

As the number of computers, laptops, and mobile devices we use grows, services that sync our important files between them grow in popularity. But are these services secure enough to store our confidential files? Recent news suggest not. One of the more popular file-syncing services, Dropbox.com, has experienced recent and significant security issues this year, including a brief lapse in their authentication system that made passwords optional for a 4-hour window. And not to pick on Dropbox – virtually all of these services carry some security trade-offs by design, including them having the keys to your encrypted files so that they can de-duplicate data to minimize storage requirements. Syncing confidential files in the cloud is not recommended without additional encryption.

All encrypted syncing solutions are not created equal

Searching the internet for “securing Dropbox” will result a myriad of blogs suggesting various ways to encrypt your cloud-synced files. What they all have in common is that they attempt to encrypt your files locally before they go into the cloud. But not all local encryption methods are best suited for cloud-synchronization. SystemExperts spent some time trying many of the suggestions found online, but experienced the following issues with most of them:

  • Tools that create encrypted volumes within the Dropbox folder create a single large file that must be synchronized every time a single file within it changes, making it very slow. And often times the size of the these volumes cannot grow, so a single large file must be created from the start. These problems were common to tools such as TrueCrypt (cross-platform) and encrypted disk images such as .dmg and .sparseimage files (both built-in for OS X only).
  • OS X has a disk image format called “sparsebundle” that it created precisely for syncing files to its Time Machine backup service. It solves the problem of syncing entire volumes by dividing it up into smaller “bands”. But this is not a cross-platform solution. Additionally, testing indicated that Dropbox had trouble detecting changes to the “bands” in real-time, and had trouble synchronizing them if the volume was mounted by multiple systems.
  • Encrypting individual files makes for faster syncing, but can be tedious if it must be done manually with tools such as zip-archiving tools.

EncFS to the rescue

SystemExperts found EncFS (or Encrypted File System)solutions best suited for the task. EncFS uses AES-256 encryption, is cross platform (Windows, Linux, and OS X – sorry, no mobile yet), and it encrypts individual files on the fly as they are placed into the mounted EncFS volume. As an added bonus, EncFS provides some protection for lost or stolen laptops. EncFS mounts the encrypted files on your file system and displays them decrypted at the mount point as a new drive or volume, so as soon as the system is powered off or the user logs out, the mount point is lost and the decrypted files are no longer available.

However, there are some caveats to EncFS:

  • The only Windows solution we found is a commercial application called http://boxcryptor.com/ which starts at $20 for commercial use, although it does offer a free version with some limitations
  • Although free, the OS X and Linux solutions are more technically challenging to install
  • Although the file contents are encrypted, anyone with access to the file system can see how many files and folders exist, their permissions, their approximate sizes, and their last accessed and modified timestamps.

Example usage of EncFS

In our test setup, we synchronized files across multiple OS X systems. Following these installation steps for OS X , we created a folder within Dropbox for our encrypted EncS files, and an EncFS mount point outside of our Dropbox folder. (Tip: On OS X and Linux, name the folder within Dropbox using a preceding . (dot) to make it invisible. This way you aren’t tempted to place unencrypted files within the encrypted EncFS folder by accident.) We named our new EncFS volume “eDropbox”, which showed up on our Mac as a new attached drive. After repeating the setup process on two additional systems, we began placing files within this new eDropbox drive. Files were immediately and transparently encrypted to the EncFS folder within our Dropbox folder, and then synchronized to our other systems, making the unencrypted file immediately available on all of the respective mounted eDropbox volumes. But anyone accessing our Dropbox account in the cloud (including the operators of the service itself) will now only find AES-256 encrypted files there.

Please let us know how EncFS works for you, if you find other solutions that work better, or how your company is addressing secure file synchronization.

52 replies
  1. BotLike
    BotLike says:

    Autoliker, Working Auto Liker, Autoliker, Status Liker, autoliker, auto liker, ZFN Liker, Auto Like, Autolike, auto like, Increase Likes, Status Auto Liker, Auto Liker, Photo Liker, Autolike International, autolike, Photo Auto Liker

  2. tinyurl.com
    tinyurl.com says:

    Hi there this is kinda of off topic but I was wondering if blogs use WYSIWYG editors or
    if you have to manually code with HTML. I’m starting a blog soon but have no coding
    expertise so I wanted to get advice from someone with experience.
    Any help would be greatly appreciated!

  3. tinyurl.com
    tinyurl.com says:

    Fantastic post however , I was wanting to know if you could write a litte more on this topic?
    I’d be very thankful if you could elaborate a little bit more.

    Bless you!

  4. coconut oil why
    coconut oil why says:

    Great blog here! Additionally your web site lots up fast!
    What host are you the use of? Can I get your associate hyperlink to
    your host? I desire my website loaded up as
    fast as yours lol

  5. plenty of fish dating site
    plenty of fish dating site says:

    Excellent post. I used to be checking constantly this blog
    and I’m impressed! Very helpful info specifically the closing section 🙂 I care
    for such information a lot. I used to be looking for this particular information for a very lengthy time.

    Thanks and good luck.

  6. ps4 games
    ps4 games says:

    That is a really good tip especially to those new to the blogosphere.
    Brief but very accurate information… Thank you for sharing this one.
    A must read article!

  7. quest bars cheap
    quest bars cheap says:

    Hey I am so thrilled I found your webpage, I really
    found you by mistake, while I was researching on Digg for something else, Nonetheless I am here now and would just like to say kudos for a marvelous post and a all round thrilling blog (I also love the theme/design), I don’t have time to browse it all at the minute but I have bookmarked
    it and also included your RSS feeds, so when I
    have time I will be back to read a great deal more,
    Please do keep up the awesome job.

  8. ps4 games
    ps4 games says:

    What’s up everyone, it’s my first visit at this web site, and post
    is really fruitful in support of me, keep up posting such articles or reviews.

  9. ps4 games
    ps4 games says:

    Asking questions are really pleasant thing if you are not understanding anything completely, but this piece of writing provides good understanding even.

  10. ps4 games
    ps4 games says:

    No matter if some one searches for his required thing, thus he/she needs to be available that
    in detail, therefore that thing is maintained over here.

  11. quest bars cheap
    quest bars cheap says:

    I simply could not depart your web site prior to suggesting that I extremely enjoyed the usual information a person supply to your visitors?
    Is gonna be again often in order to check out new posts

  12. ps4 games
    ps4 games says:

    I was suggested this blog by my cousin. I’m not sure whether this post
    is written by him as no one else know such detailed about
    my trouble. You’re wonderful! Thanks!

  13. ps4 games
    ps4 games says:

    Its like you read my mind! You appear to know a lot about
    this, like you wrote the book in it or something. I think that you can do
    with some pics to drive the message home a bit, but instead of that, this
    is excellent blog. A fantastic read. I will certainly be back.

  14. coconut oil
    coconut oil says:

    Thank you for the good writeup. It if truth be told was a enjoyment account it.
    Look complicated to more delivered agreeable from you!
    However, how could we keep in touch?

  15. coconut oil
    coconut oil says:

    Howdy! Quick question that’s totally off topic.
    Do you know how to make your site mobile friendly? My web site
    looks weird when browsing from my iphone 4. I’m trying to find a template or plugin that might be able to resolve this problem.

    If you have any recommendations, please share.
    With thanks!

  16. http://sinnedbeyondhelp.tumblr.com/
    http://sinnedbeyondhelp.tumblr.com/ says:

    Attractive section of content. I just stumbled upon your blog and in accession capital to assert that
    I acquire actually enjoyed account your blog posts.
    Any way I’ll be subscribing to your feeds and even I achievement you access consistently quickly.

  17. http://asksylphoflight.tumblr.com
    http://asksylphoflight.tumblr.com says:

    After I initially left a comment I appear to have clicked on the -Notify me when new comments are added- checkbox and from now on whenever a comment
    is added I recieve four emails with the same comment.
    Is there a means you are able to remove me from that
    service? Thanks a lot!

  18. sling tv
    sling tv says:

    An impressive share! I’ve just forwarded this onto a friend who was conducting a little research on this.

    And he actually ordered me dinner because I discovered it for him…
    lol. So allow me to reword this…. Thanks for the meal!!
    But yeah, thanx for spending the time to discuss this matter here on your internet site.

  19. match.com free trial
    match.com free trial says:

    Thanks for one’s marvelous posting! I quite enjoyed reading it, you will be a great
    author.I will be sure to bookmark your blog and definitely will
    come back someday. I want to encourage you to
    continue your great posts, have a nice weekend!

  20. http://tinyurl.com/sling-tv-45840
    http://tinyurl.com/sling-tv-45840 says:

    Hi there just wanted to give you a brief heads up and let you know
    a few of the images aren’t loading properly. I’m not sure
    why but I think its a linking issue. I’ve tried it in two different internet browsers and both show the same
    outcome.

  21. sling tv
    sling tv says:

    fantastic issues altogether, you simply gained a brand new reader.
    What would you recommend about your publish that you simply made a few
    days ago? Any positive?

  22. sling tv
    sling tv says:

    Simply want to say your article is as amazing.

    The clarity in your put up is simply nice and i could suppose you are an expert in this subject.

    Well along with your permission let me to grasp your feed to keep up
    to date with impending post. Thank you a million and please carry on the enjoyable
    work.

  23. sling tv
    sling tv says:

    I enjoy what you guys are usually up too. This sort of clever work and exposure!
    Keep up the fantastic works guys I’ve incorporated you guys
    to my blogroll.

  24. sling tv
    sling tv says:

    Awesome blog! Do you have any tips and hints for aspiring writers?

    I’m hoping to start my own site soon but I’m a little lost on everything.
    Would you propose starting with a free platform like WordPress or go for a paid option? There are so many options
    out there that I’m completely confused .. Any recommendations?
    Many thanks!

  25. sling tv
    sling tv says:

    Hey, I think your website might be having browser compatibility issues.
    When I look at your website in Ie, it looks fine but when opening
    in Internet Explorer, it has some overlapping. I just wanted to give you a quick heads up!
    Other then that, wonderful blog!

  26. sling tv
    sling tv says:

    Fantastic goods from you, man. I have bear in mind your stuff prior to and you are
    just extremely excellent. I really like what you’ve bought right
    here, really like what you’re saying and the best way through which you assert it.
    You’re making it entertaining and you still take care of to stay it wise.
    I can’t wait to learn much more from you. This is actually a tremendous web site.

Leave a Reply

Want to join the discussion?
Feel free to contribute!

Leave a Reply

Your email address will not be published.