2

I have approx 3Gb of data that my institution has obtained under a NDA. We are permitted to share it with a small number of partner institutions, but cannot make it publicly available. The users at some of the partner institutions may not be very technically savvy. I will not be able to spend any money to do this, and I am not able to set up new IT systems (so e.g. hosting a SFTP server is out). I am trying to figure out the best way to approach the problem.

An obvious option is to use a service such as Dropbox, and only send the download link to the appropriate people. In practical terms this is probably adequately secure, but in theoretical terms it isn't ideal, as Dropbox themselves can view the data.

I could encrypt it and upload the encrypted file to Dropbox or similar. However, I do not know of an encryption/decryption tool that is straightforward for a non-technical user on the receiving end. Suggestions for such a tool are welcome!

Another option, of course, would simply be to send a DVD to each partner in the post...

Is there a straightforward way of doing this that I haven't thought of?

Related, but not dupes:

  • This question gives answers where confidentiality is not a consideration.
  • This question gives answers that involve spending money or setting up new systems (and the most recent answer is from two years ago).

EDIT: For clarification, since some of the answers, while helpful, are heading into paranoid territory: The data in question is covered by NDA simply because the organisation who provided it charges for it, and would like to be able to sell it to other people. This is not an "evading-interception-by-the-government" level of secrecy (ie no need for plausible deniability, etc), it's a "take reasonable steps to not violate the agreement" level. There is no personal data about anybody, so ethical and legal concerns about personal data do not apply.

Improve this question
9
  • I would watermark the files with recipients names, then burn it to a CD and mail the CD. Optionally with all the data in one big encrypted archive (zip, rar, whatever). I can think of a lot more secure options, but for non-technical users those either will not work or they will get help and store the unencrypted data somewhere.
    – Hennes
    Commented Dec 3, 2013 at 15:08
  • Dropbox can only view the data when they are legally required to do so, i.e. a law enforcement agency acquires a warrant for the data - Dropbox need to be able to comply and retrieve the data. In your case, provided you're operating within your country's law, Dropbox cannot access your data as per their security statement:- dropbox.com/security - you could as suggested by @hennes create a self extracting archive (.zip/.rar etc) with a long complex password (64 chars, mix of case, alpha-numeric + symbols) which you share via a letter or fax beforehand.
    – sgtbeano
    Commented Dec 3, 2013 at 15:16
  • 1
    "We are permitted to share it with a small number of partner institutions, but cannot make it publicly available." This is one major reason why you should treat any third-party hosting services with extreme caution in this regard (you signed the NDA, it's your job to ensure the data is not compromised in the distribution process). Why not just throw the data into a TrueCrypt vault, and distribute the vault to the other institutions via USB keys (or even optical media like DVDs)?
    – Breakthrough
    Commented Dec 3, 2013 at 15:16
  • 1
    @sgtbeano - You raise valid points. One could even upload a small TrueCrypt storage container to Dropbox, which would mean that, although Dropbox would have "access" to the file ( provided they were forced to access it of course ) they could not view the contents of the file. I would personally encrypt the contents of a physical disk anyways. <sarcastic>After all the USPS has access to the contents of any mail you send.</sarcastic>
    – Ramhound
    Commented Dec 3, 2013 at 15:21
  • 1
    encrypted zip file would be much easier
    – Keltari
    Commented Dec 3, 2013 at 16:49

3 Answers 3

Reset to default
5

You could use a password protected ZIP file and send that over Dropbox. I don't know if that is secure enough for your needs, but is simple.

I think your proposed sneakernet option might be the easiest. Send a DVD in the mail.

Improve this answer
8
  • I would agree this is likely the best solution. In the case of say Winzip the combination of a password protected archive and encrypting the contents with AES would make the it virtually immpossible for anyone without the password(s) to view the contents.
    – Ramhound
    Commented Dec 3, 2013 at 15:17
  • 1
    @Flyto - Unless we are talking about Windows installation where the main storage device is using the FAT32 file system a 3GB archive file wouldn't be a problem. Winzip ( or any other archive program ) is smart enough on how to decompress the file and alternate between your RAM and writting to your storage device.
    – Ramhound
    Commented Dec 3, 2013 at 15:23
  • 2
    7-Zip is, and it's free.
    – Alan B
    Commented Dec 3, 2013 at 15:28
  • 1
    on "whatever" password encrypted stuff, e.g. "ZIP password protected" : duckduckgo.com/?q=zip%20password%20cracker could give one an idea. Look the name of the software up with additional keywords such as "crack" or "decrypt". Although 7z seems not bad: en.wikipedia.org/wiki/7z#Encryption
    – erch
    Commented Dec 3, 2013 at 16:16
  • 1
    Creating a self extracting encrypted archive with 7zip
    – Ƭᴇcʜιᴇ007
    Commented Dec 4, 2013 at 19:08
2

bitorrent sync might work here. It needs a client but doesn't use a central server, AES encrypts the traffic, and does a pretty good job at transferring large files. You could also use a 'simple' password encrypted self-extracting archive using 7zip. I'd see firewalls possibly freaking out at the torrent traffic however.

That said, sending a DVD to each partnet is likely the best, most PHB friendly solution

Improve this answer
4
  • 1
    While I agree that bitorrent sync might be a solution, not a great deal is known about how it actually works, for all we know there could be hidden backdoors in it. There is work being done to reverse engineer, open source work, but that work towards an open source client isn't close to being finished.
    – Ramhound
    Commented Dec 3, 2013 at 15:15
  • The fact that something like it isn't open source is a huge red flag.
    – Jon
    Commented Dec 3, 2013 at 15:26
  • If you are that skittish then Sneaker-net is probably the best option (Cool Glasses and trench-coats required). If it isn't an option (Distance? Too hot for trench coats?), you can still use the cloud. Encrypt the file using your favorite brand of Open Source Encryption where you have hand read each line of code... Throw it in the cloud - ala Drop Box or Bitsync... Decrypt it on the other end making sure the decryption software there wasn't intercepted and hijacked somehow.
    – WernerCD
    Commented Dec 3, 2013 at 19:18
  • @chipperyman573: I can't really think of something thats simple and opensource - I've suggested btsync here since there's no central server and you can easily, and fairly quickly sling around massive files and sets of files with fairly little work (installing a client and pasting in a code). That said anything not open source isn't automatically dodgy, and bitorrent hasn't really been accused of doing anything evil (yet). I'd be more worried about the firewalls freaking out than bitorrent sniffing, downloading and decrypting your data.
    – Journeyman Geek ♦
    Commented Dec 4, 2013 at 2:05
1

As this has a high potential for a flame war: As I'm not an expert in an ever evolving field of science, I am just summarizing some of my own thoughts about security and encryption here. Thus:

a) on "Dropbox" e.a.: How well could one know whom "service_name" belongs to and why the heck should one be willing to hand over control over sensitive data, especially about other people to "service name"?!¹ A least, one should try to ask around if somebody one trusts might have some online storage (server), with restricted access for only the people one trusts. Or could be held responsible if something happens on one's side.

b) On Password protected data: Just to give an idea how much people trust in companies

As everybody and his/her dog would swear that they wouldn't use such passwords - where do they come from? Also: Why fixed-length passwords (mainly 8 characters) are a bad idea.

c) On Encryption: I've heard very good things about GNU PG (wikipedia article) and quite good things about TrueCrypt (wikipedia). There also is a Stack Exchange on Security; in case you aren't aware of it ;)

ad c) On Ecryption in use: For every piece of software you hear about, look it's name up with an additional keyword like "hack", "crack", "decrypt", etc. This could give even the newest newbie an idea, of how save it might be. Also: As there is enough boasting that it could crack just everything, a little research might result in "just hot air with a hint of sugar and …" in the best case.

Answer Idea how to solve this: Burning the encrypted data on a DVD and transfer it via Sneakernet sounds nice. Doing the best one could do to protect data, especially if it's sensitive data ** about other people** (!) is a must, and nothing less. One reason I am very reluctantly willing to provide other people with my sensitive data is that I do know that security measures are in the most cases handled by "that dude(tte)" hardly ever someone, had spoken more than needed (if ever).

e) Bruce Schneier has written a lot about Trust(ing) - here an introduction

¹ I'm NOT here to roast ANY company about, well, anything - just mentioning "Dropbox" because you named it, as an example. I'm just questioning handing over sensitive data and giving up control to "an Internet service".

Improve this answer

Not the answer you're looking for? Browse other questions tagged .