Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to define a way for two parties to exchange a folder (files) securely. Encrypted zip format seems to be the most obvious but I have read some accounts of zip encryption being flawed. So I am trying to see if there are any other solutions out there.

My requirements are -

  1. It should be really easy (clicking the mouse and entering the key/passphrase).

  2. Need to be free software (should not mandate the either party to buy software as much as possible)

  3. Of course it has to be secure. If the encrypted file ends up in the wild the parties should be assured that its secure.

  4. The cross platform nature of it comes in because some of the users involved might use a Mac.

Is my only option to use gpg? I am averse to using it but I want to see if there is any other possibility. The only problem with gpg is I will then have to define a way to exchange the public keys and verifying the public keys are properly exchanged. I am looking for a solution where one party can send the file to the other and then get on the phone and say "double click on the file and enter this passphrase".

Thanks for your help!

share|improve this question
Does the file itself need to be secure, or only the exchange? – Ignacio Vazquez-Abrams Jan 13 '12 at 23:59
@Ignacio - The file has to be secure not just the exchange. – user220201 Jan 14 '12 at 0:09
You do know how easy it is to wiretap phones, I hope. – grawity Jan 14 '12 at 1:17
Just to understand it right: you need a person A to send some files to person B, and make sure that only person B will open the file? Send by email, etc, and not that they are in the same network ?And this encryption must run on windows and Mac ? – woliveirajr Jan 14 '12 at 1:30

I recently asked a very similar question, and wasn't able to find a truly simple, transparent, free, cross-platform solution. zip file encryption is no longer terrible, but Macs can't open encrypted zip files from the GUI (and worse, they give a misleading error that makes it sound like there's something wrong with the file).

Truecrypt is excellent, and isn't very difficult to use. However, it does require the user to install the software and learn what it means to mount an encrypted volume.

An additional advantage of truecrypt is that the files remain on the encrypted volume, and disappear off of the computer when the volume is unmounted. When you unzip an encrypted zip file, it creates a cleartext copy of the file on the hard drive, and the user has to remember to delete it themselves. This is the case for all file-level encryption that I'm aware of, and for that reason I'd recommend an encrypted partition system even if it's more complicated for your users.

share|improve this answer
I second the true crypt suggestions and raise you a SCP over SSH. SCP transfers are secure, there is a lot of free, easy to use software for mac and pc (macfusion/winscp) and it's not limited by email limits. And you can run an ssh server on windows with cywin for free. – skub Jan 14 '12 at 5:33

7-Zip supports 256 bit AES encryption.

7-Zip is a free and open source file archiver. 7-Zip operates with the 7z archive format, but can read and write several other archive formats. The program can be used from a command line interface, graphical user interface, or with Microsoft Windows shell integration.

enter image description here

share|improve this answer

You can use small truecrypt in-file-partition. You will have to install (free, opensource, multiplatform) truecrypt on each computer.

The benefit (compared to encrypted zip) is that you can operate on such secure filesystem in realtime (without decompressing/recomressing).

BTW, there is a nice easy to use GUI and it's really safe.

share|improve this answer

Is my only option to use gpg?

No. Second and better choice is to use S/MIME encrypted e-mailing

share|improve this answer
An where are the arguments proving that? – Tom Feb 20 '12 at 15:02
@Tom - symmetric vs asymmetric encryption, if it tells you something. From user-side - requirement to trusted exchange of public keys in case of PGP and no needs for it in case of S/MIME (nodes have just to exchange signed e-mails) – Lazy Badger Feb 20 '12 at 15:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .