3

There are a lot of ways of transfer a file in a secure way, but it's difficult to find a way of doing it which is newbie-friendly.

For instance, suppose that Alice wants to send a confidential file to Bob. Once the file is encrypted (e.g. using GPG) it could be sent safely through the internet (mail, dropbox, whatever). This is good, but gives some difficulty when dealing with newbies: if Bob doesn't know anything about cryptography (and computers in general), and Alice cannot just ask him to install a software, there's no way for them to exchange the file safely.

Is there a way to encrypt some message (strong cryptography), and send it with a cryptography-ready envelope?

6
  • 1
    If you have no knowledge about the software installed on Bobs computer and you cannot expect him to install additional software, then I'm afraid that there is no portable way. Even a password protected ZIP file might fail if no archiver is installed.
    – Marco
    Jul 23, 2012 at 9:10
  • 2
    Some archivers have an option to create self-extracting file which will prompt the user if the file is also password protected. I think one of them is 7-Zip. No sure about WinZip. I'm sure there are others. One problem it that can be difficult to email someone an executable file. Dropbox does not have that problem.
    – martineau
    Jul 23, 2012 at 11:01
  • 1
    I'd say the way to do this is through Education. I mean, you say Bob wouldn't know anything about cryptography, and cannot be asked to install software... but you left out the parameter that Bob can't be instructed in how to do either of these necessary things either. So, you either use a method that doesn't require Bob to learn anything (Mail him a CD, etc.) or instruct him as to how to deal with file transfers and cryptography.
    – Bon Gart
    Jul 23, 2012 at 13:42
  • 3
    I also think it's simpler to spend an hour with Bob to teach him on basic aspects of security (which he would use in the future) than blaming on his lack of knowledge. Aug 14, 2012 at 14:14
  • 1
    @bytebuster, +1. I agree as long as Bob and Alice are related personally. Consider the case in which Bob is one of Alice's customers. She just cannot explain security to each and every Bob she works for.
    – Dacav
    Aug 14, 2012 at 18:04

3 Answers 3

5

Bytebuster is right to a certain extent assuming you have a person able to learn the best method is to teach them a little bit about thngs.

The next most friendly method would be to host your own https page. If you are concerned about the files leaking enable the https server only when you are working with that person and have a password/session protected directory that you give them the password to over the phone, have it a random password that you create at that time and is long enough that normal password hacking would not break the password any time soon. Using an active page to allow upload/download like asp or php etc. Would allow short term sharing of files. The encryption could be set to the same level as what is used to process credit cards and changing the access password just before you turn it on for the session makes it so its not easily broken before your done.

The other way I could see is something like using cacert to make them a new free client certificate. With some planning and good directions you could do more or less what you were originally thinking.

The biggest thing is just document the heck out of what you want to do with the users I work with I probably hit 1 in 120 or so that I just cant explain through. Usually the problem there is they wont stop long enough to do what is needed.

If this is for end users then probably a client certificate type thing would work best. There is a reasonable amount of infastructure already in place able to use client certs. you just need a trusted repository for client certs to be managed many email programs web browsers and such already have things in place to use client certs to access encrypted items.

2

NoteShred is exactly what you need in this case.

It is a secure, encrypted message and attachment service that does not require the recipient to have an account to retrieve the message. A unique URL is created for each note which will destroy the contents after being read.

simply create the note and send them the link with the password. The note will shred after being read and email you telling you when and from where it happened.

If you've ever needed to send something private to a client or customer who is not tech savvy, this will save you some headaches.

https://www.noteshred.com

1
  • 1
    What's nice about Noteshred is you can have team accounts which allow you to see who has shared what with whom (not the passwords of course). May 31, 2016 at 23:31
1

The post is a bit old, but lets add some new ways of completing this task, maybe someone needs them:

You can use services like https://send.firefox.com (exactly this one is "probably more trusted" then the others, because of the company behind the service). You don't need an account to complete the send action (just for large files), you can limit download count/hours the file will be "alive", you can set an additional password for opening the file you send.
Another easy option is to use messengers. Almost all of them have secure messages e2e encrypted, sent without central server and logs. For example you can check Telegram, they have nice web interface + clients for every platform (even console one) and they allow you to send files up to 1.5GB in size.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .