How to copy files to an untrusted computer?

Question

I want to copy files securely from one computer to another, the other computer however isn't trusted and I don't have direct access to it other then giving the owner of the computer instructions. In addition to that this is a one-time only situation, so any cumbersome setup should be avoided. What would be the easiest and most portable way to do it?

What I have in mind would be a program with the following workflow:

1. The host with the files issues a hypothetical command to make the files available, protected with a password:

   file-offer -p PASSWORD file1 file2 file3 directory

2. The other issuse a hypothetical command with the password to receive a file (a GUI to select files would be welcome as well):

   file-receive -p PASSWORD file2

The closest thing I have right now is this hack, which works but isn't very comfortable and would give Windows users some trouble:

1. tar cf - [files]... | gpg -c --passphrase PASSWORD | nc -l -p 6666

2. nc host1 6666 | gpg --passphrase PASSWORD | tar xf - [files]...

Some more notes:

• neither of the users has root access (so no servers accessing ports < 1024)
• copying files prior to making them available should be avoided (i.e. no cp files /var/www/)
• ssh/scp doesn't work as that would require giving the password of one host to the other
• using rsync with rsyncd.conf mostly works, but is cumbersome to setup and doesn't provide a way to share a single file, only directories
• a ftp/http server that could be launched and configured with a single command line could work, https support for encryption would be welcome as well as a way to share single files instead of just directories, don't know any server that fits these criteria
• USB isn't an option as the other host might only be available over the network
• a file upload service isn't an option either (file size limits, upload to untrusted third party, user might be on LAN, not the Internet. etc.)

Answer 1

GnuPG encryption!

$ gpg -e mysecretfile
You did not specify a user ID. (you may use "-r")

Current recipients:

Enter the user ID.  End with an empty line: ben

Current recipients:
2048g/52FFA1E 2009-01-02 "Bob McBlah <bob.mcblah@example.com>"

Enter the user ID.  End with an empty line: 

$ ls *.gpg
mysecretfile.gpg

The file mysecretfile.gpg is now encrypted, in a way such that only the person (Bob McBlah) can decrypt the file (asymmetric or public-key crypto).

The file can safely be sent using any medium capable of sending a file (netcat, email, FTP, dropbox, mediafire.com etc etc), with practically no risk of interception.

If you use the -a "ASCII armour" flag, the encrypted file (which would be named mysecretfile.asc) is plain ASCII text, which can be sent in any medium that can send ASCII text, so answers to any other "how can I send an x MB file" question would applicable..

For a solution to your specific problem, perhaps a simple Python script could be written using the BaseHTTPServer module:

import sys
from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer

thefile = None

class MyHandler(BaseHTTPRequestHandler):

    def do_GET(self):
        global thefile
        try:
            if self.path == "/":
                f = open(thefile)

                self.send_response(200)
                self.send_header('Content-type', 'application/x-gpg')
                self.send_header('Content-disposition', 'filename="%s"' % thefile.replace("\"", ""))
                self.end_headers()

                self.wfile.write(f.read())
                f.close()
            else:
                self.send_error(404, 'File not found: %s' % self.path)

        except IOError:
            self.send_error(404,'File Not Found: %s' % self.path)

def main():
    global thefile
    if len(sys.argv) == 2:
        thefile =  sys.argv[1]
    else:
        print "Usage: %s [path to served file]" % sys.argv[0]
        sys.exit(1)
    try:
        server = HTTPServer(('', 8080), MyHandler())
        print 'Started server on port 8080'
        server.serve_forever()
    except KeyboardInterrupt:
        print 'Keyboard abort, shutting down server'
        server.socket.close()

if __name__ == '__main__':
    main()

Save it as servefile.py and run as python servefile.py /path/to/my/file.gpg

The above code is not exactly great, but should be fine for one-off transfers.

Answer 2

Is handing off a USB drive feasible? It might be too cumbersome, but it would solve the issue of connecting to a non-trusted computer. Also, it wouldn't be too difficult for users of any OS to pull the needed files with minimal instruction.

Answer 3

If both computers are hooked up to the internet, maybe something like DropBox would be acceptable.

Answer 4

• Create temp user with password but no shell access (e.g. with scponly).
• Give that user rights to files.
• Copy files with SCP.
• Once everything is done, remove that user.

Answer 5

If you're looking for a lightweight webserver this page at Wikipedia might help.

Answer 6

SSH can use public / private key authentication. This allows you to give the "untrusted" computer your public key. And then you keep your private key secret and password protected and then you can login to the other machine.

You can then scp the files as long as the user you ssh in has the appropriate permissions. And because you are using SSH all of the files are encrypted in transit.

Answer 7

You could also set up a free account on Inbox.com. One of their services (besides email) is file storage up to 5 GB (also free). Just create an account that both of you can share, upload your files, and let the other person download them. Afterwards, forget about the account, change the password and keep it, or do whatever you want with it.