3

I find it quite annoying that WinZip (and 7-zip, etc) does not encrypt the file names in the archive, just the file contents.

This is a glaring security hole as the file & folder names can contain quite a bit of information such as names, account numbers, account types, etc.

Are there any good alternatives out there? A good alternative should be easy-to-use, and hopefully backward-compatible with regular Zip utilities to the extent possible (for instance, by allowing file contents to be retrieved in WinZip/7zip even if that requires a separate rename step).

2
  • Double-zipping is a poor workaround, because then you lose the ability to quickly open specific files, especially if they're archived on DVD or other slow media.
    – Alex R
    Dec 22, 2009 at 0:59
  • 7-Zip does encrypt file name and header.
    – Molly7244
    Dec 22, 2009 at 1:32

5 Answers 5

2

The 7z format used by 7zip can encrypt filenames in the archive.

But you can't do this with Zip files until someone establishes a widely used update to the Zip file format.

The only way is to cheat and store a zip within a zip - so you'd create a zip file called (say) no-peeping.zip (or even rename it to something inconspicuous like "untitled.txt") with all your files inside, then add that to another zip file.

1
  • Thanks! Somehow, I had not noticed the checkbox before.
    – Alex R
    Dec 25, 2009 at 15:00
4

I'm not an expert, but judging from the description of the ZIP file format, it looks like having plaintext filenames is a limitation of all ZIP archives, not one of WinZip or any particular ZIP archiver.

One workaround to be fully compatible with current ZIP archivers would be to ZIP your files twice: Once to contain everything into a single ZIP archive, then again with a password. This way you cannot see filenames unless you decrypt the outer archive.

In other words, your archive may look like this:

MyFiles.zip.zip (password protected)
    |- MyFiles.zip
        |- file1.txt
        |- file2.txt
        |- ...

Be aware though that ZIP encryption may not be considered strong security; if you have serious security needs your best bet is to use a different file format.

3
  • +1 This is what we did when we had to use zip and be secret
    – Nifle
    Dec 22, 2009 at 0:58
  • Nothing in the zipfile format would prevent you from encrypting the filenames. You could use Hex or Base64 encoding to ensure the encrypted name would contain only "normal" characters.
    – Alex R
    Dec 22, 2009 at 0:58
  • 1
    You could encrypt file names, but then normal ZIP archivers like WinZip and the Windows shell wouldn't know what to do with the encrypted filenames. AlexZip might know that "IDSFNKCISF" means "file1.txt", but WinZip doesn't unless you convince the programmers to add that in. Dec 22, 2009 at 1:28
1

Winrar have an option to encrypt filenames (The encryption doesn't work with zip files, only with rar, despite the fact that winrar could handle zip files)

1

WinRAR does exactly this, but only for RAR files. You could create a self-extracting RAR if the person on the other end of the archive refuses to install it, or 7z. Plaintext filenames is, alas, a limitation of the zip file format, and the encryption algorithms leave a lot to be desired. Zip encryption is not security anymore!

0

I would suggest you to take a look at TrueCrypt: it's multiplatform and could handle files as well as entire partitions or drives.

I'm using it, and the security it provides seems to be of a very fine quality.

Regards

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .