Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

There are a lot of ways of transfer a file in a secure way, but it's difficult to find a way of doing it which is newbie-friendly.

For instance, suppose that Alice wants to send a confidential file to Bob. Once the file is encrypted (e.g. using GPG) it could be sent safely through the internet (mail, dropbox, whatever). This is good, but gives some difficulty when dealing with newbies: if Bob doesn't know anything about cryptography (and computers in general), and Alice cannot just ask him to install a software, there's no way for them to exchange the file safely.

Is there a way to encrypt some message (strong cryptography), and send it with a cryptography-ready envelope?

share|improve this question
1  
If you have no knowledge about the software installed on Bobs computer and you cannot expect him to install additional software, then I'm afraid that there is no portable way. Even a password protected ZIP file might fail if no archiver is installed. –  Marco Jul 23 '12 at 9:10
2  
Some archivers have an option to create self-extracting file which will prompt the user if the file is also password protected. I think one of them is 7-Zip. No sure about WinZip. I'm sure there are others. One problem it that can be difficult to email someone an executable file. Dropbox does not have that problem. –  martineau Jul 23 '12 at 11:01
1  
I'd say the way to do this is through Education. I mean, you say Bob wouldn't know anything about cryptography, and cannot be asked to install software... but you left out the parameter that Bob can't be instructed in how to do either of these necessary things either. So, you either use a method that doesn't require Bob to learn anything (Mail him a CD, etc.) or instruct him as to how to deal with file transfers and cryptography. –  Bon Gart Jul 23 '12 at 13:42
3  
I also think it's simpler to spend an hour with Bob to teach him on basic aspects of security (which he would use in the future) than blaming on his lack of knowledge. –  bytebuster Aug 14 '12 at 14:14
1  
@bytebuster, +1. I agree as long as Bob and Alice are related personally. Consider the case in which Bob is one of Alice's customers. She just cannot explain security to each and every Bob she works for. –  Dacav Aug 14 '12 at 18:04

2 Answers 2

up vote 4 down vote accepted

Bytebuster is right to a certain extent assuming you have a person able to learn the best method is to teach them a little bit about thngs.

The next most friendly method would be to host your own https page. If you are concerned about the files leaking enable the https server only when you are working with that person and have a password/session protected directory that you give them the password to over the phone, have it a random password that you create at that time and is long enough that normal password hacking would not break the password any time soon. Using an active page to allow upload/download like asp or php etc. Would allow short term sharing of files. The encryption could be set to the same level as what is used to process credit cards and changing the access password just before you turn it on for the session makes it so its not easily broken before your done.

The other way I could see is something like using cacert to make them a new free client certificate. With some planning and good directions you could do more or less what you were originally thinking.

The biggest thing is just document the heck out of what you want to do with the users I work with I probably hit 1 in 120 or so that I just cant explain through. Usually the problem there is they wont stop long enough to do what is needed.

If this is for end users then probably a client certificate type thing would work best. There is a reasonable amount of infastructure already in place able to use client certs. you just need a trusted repository for client certs to be managed many email programs web browsers and such already have things in place to use client certs to access encrypted items.

share|improve this answer

NoteShred is exactly what you need in this case.

It is a secure, encrypted message and attachment service that does not require the recipient to have an account to retrieve the message. A unique URL is created for each note which will destroy the contents after being read.

simply create the note and send them the link with the password. The note will shred after being read and email you telling you when and from where it happened.

If you've ever needed to send something private to a client or customer who is not tech savvy, this will save you some headaches.

https://www.noteshred.com

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.