My Digitized Thoughts - Ramen Mukherjee ...

So far we knew What is Cloud storage? How to get the best of FREE Cloud Storages?, How to Extract the maximum space form the best of cloud storages? and also knew How to manage your FREE cloud storage? but now the question is that are those really so secure as they claim to be? Well nothing is secure how it seems. Some services may have end to end encryption. Some encrypts the files itself. Some even encrypts the name of files but no single service provides all those services together.

All the cloud services uses almost same Amazon S3 Architecture, that’s why they are almost same internally. So the possible solution is to protect your files by yourself. The least you can do is to protect them with passwords. Like zipping them with passwords. But that zip can be broken. So the next step would be to encrypt your files. Now I assume that all of you know more or less what encryption is. And if anyone doesn’t know about it, simply google it or go to wikipedia.

Now as we are ONLY reviewing FREE things, from storages to managements. This article is also concentrating on the FREE services. So here it goes -

1) Cloudfogger: The current version is more versatile and easier to use than the original. You access most Cloudfogger functions from the right-click context menu in the file system (e.g., Windows Explorer). Security is of course the most important aspect of encryption software, and Cloudfogger has that well covered too with AES 256-bit encryption algorithm and PBKDF2 key derivation. It also provides client-side password recovery.

Cloudfogger provides client-side encryption for all files in any folders (up to 5 for the free version) you want to select. It integrates seamlessly with Dropbox, SkyDrive, Box, Google Drive, or any other cloud storage service. The cloud only sees encrypted files since that is all that actually exists in the folders. The files are visible locally as unencrypted files when you are signed in to the Cloudfogger app though. Cloudfogger implements these two views - internal and external - using on-the-fly encryption. Folders that you "Fogg" (auto-encrypt) serve as encrypted file containers. Fogging also applies a file system overlay that presents the folder contents to the user as unencrypted files.

Cloudfogger has quickly become part of my backup solution. I use Cloudfogger to encrypt a few selected folders in Dropbox, SkyDrive and Google Drive. Now my encrypted files are synced between all the computers that I install Cloudfogger on. Because Cloudfogger encrypts one file at a time, open files are synced as soon as you save them. Cloudfogger currently provides client apps for Windows, Mac OS X and Android, with iPad and iPhone coming soon.

You can also encrypt and decrypt non-synced folders or single files via the Windows Explorer context menu. That's handy when you only want to encrypt a few files. For example, when you want to take them with you on a USB drive.

Cons: your computer is your key. Anyone having physical access to your computer can encrypt and decrypt file using your login pin, which is your password for all files, by default. You cant change keys for files. Also the syncing function is not automated. You have to manually download and upload files. The Android app is useless. I didnt found my files decrypted with it in my android phone.

2) BoxCrptor: It has both free and paid versions. Free version can make only 1 drive. Means you can only sync encrypted files in one cloud storage. It supports Dropbox, Google Drive, SygerSync and Skydrive. Custom folders can also be created and can be synced with any service through app and without the app. The interface is easy. The wizard mode is simple. It has iPhone and Android app too.

BoxCryptor provides most the same functions as Cloudfogger does. It is integrated with the file-system in a different way though. BoxCryptor uses an encrypted virtual-drive interface that is linked to an ordinary folder. Cloudfogger encrypts a single folder that it augments with a virtual-folder overlay to give cleartext access. I prefer the single folder solution, but other users prefer the virtual drive. For Windows, Mac, iPhone, iPad, and Android

However, the BoxCryptor approach leaves users open to fatal mistakes. All files to be encrypted must be placed in the virtual drive or they will not be encrypted. Any files placed directly in the "encrypted folder" [their name] are not encrypted. You must go through the virtual drive to encrypt the files. That could be hard to remember, and there is no indication of mistakes. Of course files you see in the "encrypted folder" that were inserted there by the virtual drive are encrypted.

Cons: can only encrypt a volume having 2 GB of file size. Also has a mobile app which works better than cloudfogger but still useless. Double storage of files. Like if you want to encrypt 2 GB file. You have put it in the mounted drive. Then it will create another encrypted 2GB+ (as encryption needs more storage than the unencrypted files) file in your cloud sync folder. So here for a 2 GB file you need to waste 4 GB+ space of your HDD. Though cloudfogger removes this problem by directly encrypting the file on the fly.

3) TrueCrypt: This is a top-rated product for most uses, but there is a potential backup trap when it is used for files that will be synced or stored in the cloud. Encryption programs that create encrypted "volumes" (files that contain encrypted files) do not change the size of the volume (container file), and often - intentionally - do not change the modified date of the volume, even though files in the volume have been changed or added. The result can be that your cloud service does not recognize that the volume file has changed, and will fail to update the online copy.

TrueCrypt is an example of an encryption program that does not change the modified date of volume files (encrypted file container). However, some cloud backup services - Dropbox for example - check the hash value of volume files, not the date, and if that changes Dropbox stores the latest copy of the volume file. If you're using Dropbox, that makes TrueCrypt an excellent way to implement client-side encryption for your most sensitive files. SkyDrive, monitors the modified date - not a hash value - so TrueCrypt volumes are not updated in the cloud by SkyDrive after their content changes client-side.

Cons: No mobile app. Sync is painful. As the volume will be uploaded as a whole times after times. It will waste the bandwidth.

4) Ensafer: Similer service like boxcryptor. Though its in beta stage. A new player in market. Has applications for all desktop softwares but surprisingly no mobile app yet.

5)7zip: It offers strong encryption, but it is not convenient to work with for cloud applications. But yes it uses the same AES 256 bit protection. also it can encrypt the file names also. but then again while downloading it will be very difficult for you to identify it.

Cons: you have to delete, download and upload/sync files again and again to make your dropbox secure. No app for mobiles. Even the best 7Zipper app on android market failed to open encrypted 7Zip archives.

6)SecretSync: This is similar to BoxCryptor and Cloudfogger, but it requires Java, which has suffered a continuous string of newly revealed vulnerabilities. Evidently it also only works with Dropbox.

The Problems with Above Softwares -

1) Wastage of bandwidth.
2) Double storage space consumed in your HDD.
3) Have to rely on the Sync function of client software.
4) Manual update procedure if you use 7Zip or any zip utility.

The Needed Solution -

The only possible solution is enabling of encryption within the cloud services. And inbuilt the capability in their clients. Then only your files will be fully protected and secured. But this again creates problems with cloud storage's regulations. If they enable this service anyone can start to utilize this and start doing piracy, which is not wanted.

So the second solution is to share your encryption key with your cloud storage provider. By which they can check the files. Which then again start the question of privacy. But anyway it will be better than keeping totally unencrypted files there. But what if someone steals it from the service providers? Cloud storages are not so safe as we think they are. Recent dropbox problems proved that once again. Isnt it?

So?

The third solution would be to mix and match the above solutions. And then enjoy a relatively good service.

© Ramen Mukherjee, 2012