How to send a few Gb of confidential data to non-technical users?

I have approx 3Gb of data that my institution has obtained under a NDA. We are permitted to share it with a small number of partner institutions, but cannot make it publicly available. The users at some of the partner institutions may not be very technically savvy. I will not be able to spend any money to do this, and I am not able to set up new IT systems (so e.g. hosting a SFTP server is out). I am trying to figure out the best way to approach the problem.

An obvious option is to use a service such as Dropbox, and only send the download link to the appropriate people. In practical terms this is probably adequately secure, but in theoretical terms it isn't ideal, as Dropbox themselves can view the data.

I could encrypt it and upload the encrypted file to Dropbox or similar. However, I do not know of an encryption/decryption tool that is straightforward for a non-technical user on the receiving end. Suggestions for such a tool are welcome!

Another option, of course, would simply be to send a DVD to each partner in the post...

Is there a straightforward way of doing this that I haven't thought of?

Related, but not dupes:

This question gives answers where confidentiality is not a consideration.
This question gives answers that involve spending money or setting up new systems (and the most recent answer is from two years ago).

EDIT: For clarification, since some of the answers, while helpful, are heading into paranoid territory: The data in question is covered by NDA simply because the organisation who provided it charges for it, and would like to be able to sell it to other people. This is not an "evading-interception-by-the-government" level of secrecy (ie no need for plausible deniability, etc), it's a "take reasonable steps to not violate the agreement" level. There is no personal data about anybody, so ethical and legal concerns about personal data do not apply.

file-sharing

Flyto

Posted 2013-12-03T15:00:30.813

Reputation: 516

I would watermark the files with recipients names, then burn it to a CD and mail the CD. Optionally with all the data in one big encrypted archive (zip, rar, whatever). I can think of a lot more secure options, but for non-technical users those either will not work or they will get help and store the unencrypted data somewhere. – Hennes – 2013-12-03T15:08:32.267

Dropbox can only view the data when they are legally required to do so, i.e. a law enforcement agency acquires a warrant for the data - Dropbox need to be able to comply and retrieve the data. In your case, provided you're operating within your country's law, Dropbox cannot access your data as per their security statement:- http://www.dropbox.com/security - you could as suggested by @hennes create a self extracting archive (.zip/.rar etc) with a long complex password (64 chars, mix of case, alpha-numeric + symbols) which you share via a letter or fax beforehand.

– sgtbeano – 2013-12-03T15:16:30.363

1"We are permitted to share it with a small number of partner institutions, but cannot make it publicly available." This is one major reason why you should treat any third-party hosting services with extreme caution in this regard (you signed the NDA, it's your job to ensure the data is not compromised in the distribution process). Why not just throw the data into a TrueCrypt vault, and distribute the vault to the other institutions via USB keys (or even optical media like DVDs)? – Breakthrough – 2013-12-03T15:16:35.313

That would be the most secure way. But I suspect that it fails the non-technical users part. – Hennes – 2013-12-03T15:19:23.423

1@sgtbeano - You raise valid points. One could even upload a small TrueCrypt storage container to Dropbox, which would mean that, although Dropbox would have "access" to the file ( provided they were forced to access it of course ) they could not view the contents of the file. I would personally encrypt the contents of a physical disk anyways. <sarcastic>After all the USPS has access to the contents of any mail you send.</sarcastic> – Ramhound – 2013-12-03T15:21:14.700

@Breakthrough Because I'm not going to ask the people on the other end to deal with Truecrypt. They're busy, and will not be interested in aquiring, installing and understanding new software. Otherwise, my first thought would have been Truecrypt + Dropbox, as per ramhound's suggestion. – Flyto – 2013-12-03T15:23:07.000

@Flyto my point was more to avoid sending anything over the Internet, and TrueCrypt vaults were not meant for this purpose (I know you can make the containers dynamically expand to mitigate the size increase, but this will affect your plausible deniability). Certainly you can look into this sort of thing, but you're not going to find any satisfactory solution in this context outside of rolling your own (self-hosting it), or physically distributing the media yourself. Does your institution not have provisions for sharing sensitive information/data? – Breakthrough – 2013-12-03T15:50:06.813

@Breakthrough not as far as I know, sadly. Plausible deniability really isn't needed, though - this isn't "evade interception by governments", it's simply "take reasonable measures not to breach the NDA" ;-) – Flyto – 2013-12-03T16:42:06.953

1encrypted zip file would be much easier – Keltari – 2013-12-03T16:49:23.907

Answers

You could use a password protected ZIP file and send that over Dropbox. I don't know if that is secure enough for your needs, but is simple.

I think your proposed sneakernet option might be the easiest. Send a DVD in the mail.

daxlerod

Posted 2013-12-03T15:00:30.813

Reputation: 2 575

I would agree this is likely the best solution. In the case of say Winzip the combination of a password protected archive and encrypting the contents with AES would make the it virtually immpossible for anyone without the password(s) to view the contents. – Ramhound – 2013-12-03T15:17:04.677

I did wonder about this myself, but I thought that there might be issues with a ZIP file of 3Gb uncompressed size? (e.g. unzipping on a 32-bit Windows installation) – Flyto – 2013-12-03T15:20:48.917

1@Flyto - Unless we are talking about Windows installation where the main storage device is using the FAT32 file system a 3GB archive file wouldn't be a problem. Winzip ( or any other archive program ) is smart enough on how to decompress the file and alternate between your RAM and writting to your storage device. – Ramhound – 2013-12-03T15:23:29.903

27-Zip is, and it's free. – Alan B – 2013-12-03T15:28:06.190

on "whatever" password encrypted stuff, e.g. "ZIP password protected" : https://duckduckgo.com/?q=zip%20password%20cracker could give one an idea. Look the name of the software up with additional keywords such as "crack" or "decrypt". Although 7z seems not bad: https://en.wikipedia.org/wiki/7z#Encryption

– erch – 2013-12-03T16:16:52.300

One thing I like about the 7-Zip archive format which is better than ZIP's is that you can also encryption the names of the files in the achive. – martineau – 2013-12-03T19:07:58.377

As far as I know all those password crackers just attempt to bruteforce the password. Make it long and complex and you're good. – Jon – 2013-12-04T17:41:26.320

1Creating a self extracting encrypted archive with 7zip – Ƭᴇcʜιᴇ007 – 2013-12-04T19:08:03.490

bitorrent sync might work here. It needs a client but doesn't use a central server, AES encrypts the traffic, and does a pretty good job at transferring large files. You could also use a 'simple' password encrypted self-extracting archive using 7zip. I'd see firewalls possibly freaking out at the torrent traffic however.

That said, sending a DVD to each partnet is likely the best, most PHB friendly solution

Journeyman Geek

Posted 2013-12-03T15:00:30.813

Reputation: 119 122

1While I agree that bitorrent sync might be a solution, not a great deal is known about how it actually works, for all we know there could be hidden backdoors in it. There is work being done to reverse engineer, open source work, but that work towards an open source client isn't close to being finished. – Ramhound – 2013-12-03T15:15:17.273

The fact that something like it isn't open source is a huge red flag. – Jon – 2013-12-03T15:26:10.163

If you are that skittish then Sneaker-net is probably the best option (Cool Glasses and trench-coats required). If it isn't an option (Distance? Too hot for trench coats?), you can still use the cloud. Encrypt the file using your favorite brand of Open Source Encryption where you have hand read each line of code... Throw it in the cloud - ala Drop Box or Bitsync... Decrypt it on the other end making sure the decryption software there wasn't intercepted and hijacked somehow. – WernerCD – 2013-12-03T19:18:21.633

@chipperyman573: I can't really think of something thats simple and opensource - I've suggested btsync here since there's no central server and you can easily, and fairly quickly sling around massive files and sets of files with fairly little work (installing a client and pasting in a code). That said anything not open source isn't automatically dodgy, and bitorrent hasn't really been accused of doing anything evil (yet). I'd be more worried about the firewalls freaking out than bitorrent sniffing, downloading and decrypting your data. – Journeyman Geek – 2013-12-04T02:05:57.323

As this has a high potential for a flame war: As I'm not an expert in an ever evolving field of science, I am just summarizing some of my own thoughts about security and encryption here. Thus:

a) on "Dropbox" e.a.: How well could one know whom "service_name" belongs to and why the heck should one be willing to hand over control over sensitive data, especially about other people to "service name"?!¹ A least, one should try to ask around if somebody one trusts might have some online storage (server), with restricted access for only the people one trusts. Or could be held responsible if something happens on one's side.

b) On Password protected data: Just to give an idea how much people trust in companies

As everybody and his/her dog would swear that they wouldn't use such passwords - where do they come from? Also: Why fixed-length passwords (mainly 8 characters) are a bad idea.

c) On Encryption: I've heard very good things about GNU PG (wikipedia article) and quite good things about TrueCrypt (wikipedia). There also is a Stack Exchange on Security; in case you aren't aware of it ;)

ad c) On Ecryption in use: For every piece of software you hear about, look it's name up with an additional keyword like "hack", "crack", "decrypt", etc. This could give even the newest newbie an idea, of how save it might be. Also: As there is enough boasting that it could crack just everything, a little research might result in "just hot air with a hint of sugar and …" in the best case.

~~Answer~~ Idea how to solve this: Burning the encrypted data on a DVD and transfer it via Sneakernet sounds nice. Doing the best one could do to protect data, especially if it's sensitive data ** about other people** (!) is a must, and nothing less. One reason I am very reluctantly willing to provide other people with my sensitive data is that I do know that security measures are in the most cases handled by "that dude(tte)" hardly ever someone, had spoken more than needed (if ever).

e) Bruce Schneier has written a lot about Trust(ing) - here an introduction

¹ I'm NOT here to roast ANY company about, well, anything - just mentioning "Dropbox" because you named it, as an example. I'm just questioning handing over sensitive data and giving up control to "an Internet service".

erch

Posted 2013-12-03T15:00:30.813

Reputation: 240