0

Example situation:

  1. You have an external USB hard drive with a folder D:\Work\ encrypted with EFS, and you want to copy a few files from it to your colleague Bob's computer

  2. You plug the external USB hard drive on his computer

  3. You open the .pfx file on his computer, unlocking the files (Should I use the .pfx file created while encrypting or another file?)

  4. You can copy the data to Bob's computer, and even uncheck the Encrypt contents to secure data on his computer, thus he will be able to use the file even if he doesn't have the encryption key anymore

  5. Once the files are copied, you don't want Bob to keep full access to your hard drive anymore (especially D:\Private\), how to remove the authorization granted when opening the .pfx file on Bob's computer?

How to handle such a situation?


Of course, a power user could have a mechanism to copy secretly the PFX file (in the same way a power user could have a key logger when you enter a password). But still, removing the authorization granted by a PFX file could prevent all non-power-users to have the data if they just plug the disk on their computer. That's enough for my requirements.

  • 1
    Are you able to use other encryption methods besides EFS? And you shouldn't be putting files you never want Bob to see on a drive you give Bob. Doing that is needlessly creating a problem you shouldn't have in the first place. – I say Reinstate Monica Oct 24 '17 at 12:11
  • @TwistyImpersonator All is now encrypted with EFS, I'd like to stick with this method for now instead of using another encryption software. I dont give the disk to Bob, I just connect the disk to his computer while I'm with him. And I want to be able to stop the full access after the copying has been done. – Basj Oct 24 '17 at 12:21
  • With password it would go like this: you enter password on his computer. After a reboot the access is no more granted. I would like to do the same with EFS key: how to remove a EFS key certificate? – Basj Oct 24 '17 at 12:23
  • removing your key is not enough. His computer could secretly copy your key while it was installed. Once he has it, there's no guarantee he won't be able to keep it forever. – I say Reinstate Monica Oct 24 '17 at 12:25
  • I know, this is true in the same way that someone could have a key logger when you type a password in someone else computer. – Basj Oct 24 '17 at 13:14
0

Here is what I did:

  1. Launch

    certmgr.msc
    

enter image description here

  1. Go to Personal > Certificates, and delete the certificate that has been used (the Role column should display EFS Encrypted file system).

  2. Reboot the computer. If you don't reboot, the files on the external USB hard drive will still be accessible, even if you did the step 2. (I did a test and I can confirm).

  • How about just ask the IT department at work how to transfer files? Or just eject the usb drive, then it's not there to be read? Forcing a co-worker to reboot their computer while you hover over their shoulder, or you just rebooting it, seems like a good way to waste time & lose work. – Xen2050 Oct 27 '17 at 15:42
  • It could also be in holidays @Xen2050 "– Hey friend, can you give me that movie you told me about? – I don't have anything else with me than my encrypted USB external disk. – Pleaaaase find a solution :) – It's ok, I'll find a way, gimme your computer 2 minutes". Then you install the key, you copy the file to him, you right click and disable encryption of the file, and then you remove the certificate from the computer. Done! Of course if he's a bad friend, he can have a keylogger or a tool to secretely keep keys even when deleted, but don't want to be paranoid with friends :) – Basj Oct 27 '17 at 16:17
  • Talking about pirating movies on work computers isn't much more convincing ;-) Anyway movies are online, mostly for free... actually transfering files online is really easy too. Actually even if this "bad guy" gave you their own USB, using it on your computer you could still infect you with malware, the same as if you plug your USB into their computer it could become infected... so don't put your usb in plugs you don't trust, or stranger's usb's in your plug, "practice safe USB" – Xen2050 Oct 27 '17 at 16:41
  • @Xen2050 Pirating movies? So you can't share the video you recorded at the previous party / wedding of your friend? ;) PS: I agree with the other part of your comments "don't put your USB in plugs you don't trust"! – Basj Oct 27 '17 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.