10

At the moment I'm doing the following:

  1. add to zip and encrypt files
  2. send the encrypted zip to the recipient
  3. create a note through noteshred.com
  4. share the link through out-of-band SMS
  5. noteshred is also protected by a password

But it's a big hassle, and today security folks can block zip files that cannot be inspected.

Is there an easier method? What would happen if I encrypt the complete email and send it to the recipient?

Luc
  • 31,973
  • 8
  • 71
  • 135
dal
  • 101
  • 1
  • 4
  • 2
    Completely encrypting the email through PGP (or any other method) can still cause the email to be blocked by email filters because it essentially creates an "encrypted attachment" that will not be able to be inspected just like your .zip files. – DKNUCKLES Apr 21 '17 at 14:48
  • 6
    Let's take a step back. Do the files need to be sent via email? Could you upload them some place, email the link to the user, and have the user download the files? Regardless, it would also make sense to reach out to the "security folks" and see if they have a preferred method of secure transfer. They can block traffic all sorts of different ways, so it may be better to work with them, rather than against them. – Dan Landberg Apr 21 '17 at 16:38
  • 1
    actually, no i can use dropbox, box, drive, etc to share files. but again, you have the share the link or the password to the link and you end up with the same issue. how would you solve the out-of-band part then ? – dal Apr 21 '17 at 17:32
  • Maybe I misunderstood your question. When you mean confidential data, were you referring to the key to decrypt the zip file, or the contents of the zipfile itself? – Dan Landberg Apr 21 '17 at 21:08
  • I mean confidential docs – dal Apr 22 '17 at 10:51
  • 1
    Just meet once with your peer and generate 100000 numbered passwords, print out two copies... Use a number to refer to the password used. – user2497 Sep 20 '17 at 00:34

7 Answers7

2

When communicating vulnerabilities to clients, the report is provided through a website under our control. The URL and their username is sent through email, and send the password via SMS. It's not much of a hassle if the steps are simple and largely automated (uploading the file, creating a user, sending the password to a phone number) and the recipient does not need to be tech savvy.

Alternatively, PGP encryption can be used for people who have a public key and the fingerprint has been verified. There are very few people who prefer this, typically only other security teams (and even then, not always).

Note that when encrypting zip files, as you do, the filenames are still readable. This might inadvertently leak information.

Luc
  • 31,973
  • 8
  • 71
  • 135
  • PGP get a big Security Breach, i would not recommanded – Cédric Boivin Aug 15 '18 at 21:02
  • @CédricBoivin I'm not sure what you are referring to. PGP is still secure. – forest Aug 16 '18 at 03:21
  • @forest something like https://securityaffairs.co/wordpress/72487/hacking/pgp-s-mime-tools-flaws.html or like https://www.theinquirer.net/inquirer/news/3032200/pgp-is-leaking-plaintext-versions-of-your-emails-and-theres-no-known-cure there is a lot of article on that – Cédric Boivin Aug 16 '18 at 13:54
  • 1
    @CédricBoivin Those were bugs in client implementations of both S/MIME and PGP. This does not make PGP insecure as a method or protocol. That is the same as saying that is not secure because it once had a vulnerability. Also, don't confuse S/MIME with PGP. – Luc Aug 16 '18 at 14:02
  • 1
    @CédricBoivin As Luc says, that was a specific vulnerability with certain implementations of OpenPGP and S/MIME. The problem was due to a vulnerability made possible via the cryptographic properties of the mode of operation they use (a modified version of CFB). Unless you are using a vulnerable application, PGP is still secure (i.e. it provides confidentiality and integrity). – forest Aug 17 '18 at 05:35
1

Your current setup is not the most secure because the noteshred.com may intercept your password and url. Even though they claim to be secure or whatever, they could have been hacked or have malicious intentions.

Encrypt the file with symmetric encryption using Zip password, Veracrypt or OpenSSL. Upload the file to a file sharing service. Send the file url and password using asymmetric encryption via email with PGP or for convenience use something like the FlowCrypt extension for Chrome.

Alternately, if speed is not an issue, you can use OnionShare, which lets you transfer files using Tor. This also makes it unnecessary to encrypt the file because it is not on some third party server, and all traffic is encrypted, and it cannot be discovered because it uses tor and a random password is included in the url. You still have to encrypt the URL though.

https://github.com/micahflee/onionshare/wiki/Security-Design

Daniel Grover
  • 872
  • 5
  • 10
1

There is some tool already exist on the market that will let know send some confidential information's by email.

Tool like Privnote, XMedius SendSecure, SendInc or Secure Exchanges.

From my point of view i prefer Secure Exchanges. It's fully integrated with Microsoft Outlook, Gmail or Office 365 and it's very cheeps in term of fees. Something like 2$ or 3$ CAD per month. They other solution cost a little bit Higer.

There are also Gmail that are working on a encrypted solution, but to be honnest, i think Gmail (Google) already get to much information's on us ..

Cédric Boivin
  • 126
  • 3
1

You may want to consider using EncryptedSend to send/receive files and messages with end-to-end encryption. Information that you send through this service is encrypted using javascript running in the sender's web browser, and decrypted using javascript running in the recipient's web browser, so that only encrypted information passes through the service's servers. This is a good solution for non-tech-savvy people who don't have the technical know-how to use tools like GPG, PGP, etc. In fact, the sender does not even have to be registered with the service.

mti2935
  • 19,868
  • 2
  • 45
  • 64
0

Just a remark on today security folks can block zip files that cannot be inspected. Currently, all filters I know let pass plain text mails. If you have to pass a crypted message through a mail server that blocks crypted mails and/or crypted attached zip files, there is a stupid simple way:

  • encode the zip file in base64. uuencode/uudecode can do that on any Unix-like system, and UUEnview/UUDeview does the same on Windows
  • remove the initial begin line and the terminal end line or replace them with something different that will not trigger MIME decoders (<<< and >>> for example)
  • use that as the body of a mail

Ok, as it is willingly not automatic, the recipient will have to do same operations in reverse order:

  • save the mail to a file
  • edit it to remove optional preamble/postamble and restore the begin and end lines
  • decode the file to an encrypted zip file
  • unzip the file
Serge Ballesta
  • 25,636
  • 4
  • 42
  • 84
  • This does not work, I have seen security scanners reject plaintext mails with uuencoded or base64 bodies, and they even reject DOC files if the content is (styled) base64/uuencode. There might certainly be ways to hide it better, but the naive approach does often result in blocked emails. – eckes Jul 21 '17 at 04:29
  • Is this similar to pgp encrypting with ASCII armor, then copying/pasting the body without the begin/end line? Just trying to make sure I understand what you're getting at. – user8675309 Dec 19 '17 at 22:02
-1

Use a message encryption service. If you use Office 365 for your email, it has one built in. This works well because you can pair it with a transport rule to automatically apply encryption to messages that meet certain criteria (e.g. The user puts CONFIDENTIAL in the subject).

https://products.office.com/en-us/exchange/office-365-message-encryption

Barracuda has a similar service: https://www.barracuda.com/products/emailessentials

So does Symantec: https://www.symantec.com/products/information-protection/encryption/gateway-email-encryption

And many others do as well.

Using a service like this, the message is sent to the recipient as an encrypted attachment. The recipient must login to a portal to view the message. (The message isn't actually held by the third party, they just provide the "decoder ring".)

myron-semack
  • 488
  • 4
  • 8
-3

security folks can block zip files that cannot be inspected.

"Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem."

While there are lots of ways of transferring files, you explicitly asked about sending files via email.

There are lots of ways of sending encrypted messages via email; you have already described one.

The most common solution is to use PGP encryption - that depends on asymmetric encryption - you can publish your public key for anyone to use - but only you can decrypt the messages they send you encrypted with that key. But this depends on both correspondents having PGP software and a keypair which they can use.

There is a variation on this using x509 certificates - but IME it is not as widely used / supported as PGP.

In terms of seting up the trust (exchanging keys) there is some pain, but you only need to do this once.

If you are concerned that your email may be blocked by security because it cannot be inspected, then (although its surprisingly easy to fool such tools) you are attempting to break a security policy and hence your question is off topic.

symcbean
  • 18,278
  • 39
  • 73
  • 1
    I'm not arguing the off-topic-ness one way or the other... merely noting that "_blocked because we can't access/inspect it_" is as likely to be "_because we don't know any better_" than explicitly because of a security policy. – TripeHound Sep 20 '17 at 14:30
  • 2
    @symcbean Your reasoning is silly. Not only was this a small remark regarding a caveat of using encrypted zip files, but even if it were only about bypassing such blocks, it is a question about "breaking the security of a **specific** system." Now, if the OP asked how to bypass a specific McAfee product email filter, and gave no indication that they understood the underlying concepts, it may be off-topic. But merely _mentioning_ that his technique can get blocked by a generic, broad class of techniques is absolutely _not_ off-topic. – forest Dec 19 '17 at 14:03