This note is intended mainly for users of a laptop computer to protect their data from the action of thieves.

Privacy

Privacy is the ability to protect your data from being read without your authorization.

A good way to prevent a thief or other nosey parties from reading your data is creating an encrypted volume in your Dropbox folder with FreeOTFE or TrueCrypt, and storing there the data you want to keep secret. See their website for instructions on creating and mounting an encrypted volume.

If you use FreeOTFE or TrueCrypt, you must unmount the volume before it can be uploaded by Dropbox. You will need to remount (and supply the password again) to view any files in the volume. You should also avoid making changes to the volume on more than one computer at the same time, since Dropbox would be creating a conflicted copy of the entire volume, rather than one single file, if multiple conflicting changes are made at the same time. The security of this approach depends almost entirely on the strength of your passphrase!

On Mac OS X you can also create an encrypted Disk Image (.dmg) using Disk Utility (normally found in  /Applications/Utilities). Alternatively, you may encrypt your entire home directory using !FileVault (System Preferences -> Security -> !FileVault).

Creating an Encrypted Sparse Disk Image will only allocate the space needed to hold the current contents of the image (plus the file-system overhead), so a 50MB Sparse Disk Image, with 300 MB. files will take up roughly 350 MB. space. Creating an Encrypted Sparse Disk Bundle (instead of a Disk Image) may improve performance, since it allocates its disk space in 8mb fragments.

Another solution is to use file-by-file encryption. One such solution exists and is called EncFS. This is a plug-in for the open source Fuse project for which also a Mac version is available: MacFUSE. A Windows equivalent is BoxCryptor which is compatible to EncFS so that folders encrypted with BoxCryptor can also be used with EncFS. BoxCryptor is also available for Android.

A tutorial for Ubuntu Linux describing how to secure Dropbox with EncFS is available here. Another tutorial to EncFS on OSX to encrypt-decrypt Dropbox content realtime. An easy-to-use one-click installer for EncFS on Mac OS X is available here. Yet another in a German blog describes how to setup EncFS and gnome-encfs (for mounting encrypted folders on Gnome login) running Ubuntu Linux and provides a script for an easy configuration of an encrypted Dropbox folder.

Another file-by-file encryption is the program SecurStick, which was written for the German IT-magazine ct.  It runs without installation and is available for different flavours of MS Windows, Mac OS X and Linux. SecurStick is a small WebDAV server running locally without admin rights and encrypts on-the-fly files using the operating system’s WebDAV implementation. See also here.

SECURITY NOTE REGARDING SECURSTICK: The author of SecurStick has decided against releasing full source code for this application. The presence of undocumented commands and options has been confirmed. Given the closed-source nature of the application, there may be other undocumented features that would result in insecure encryption or other unanticipated operation. The reader is encouraged to evaluate whether this information is significant for the proposed use.

SecretSync (now Viivo) is a file-by-file solution available for Windows and Linux. This is a Java-based tool and an OS X version is promised in the future. While encryption is client-side, they manage the keys on their servers. Technically, the keys and encrypted files can only come together on the client unless the two companies merge together. A client-side key known only to the user may also be used.

Safety

Since Dropbox automatically connects to your account, anyone who can access your user profile (on the OS) is able to access your Dropbox files. They can also access your web interface, so although they cannot lock you out of your own account (Dropbox’s password reset needs the current password, which is not compromised), they can inflict significant damage by deleting and purging important files.

The only secure way to prevent this is to encrypt your entire hard drive using something like FreeOTFE or TrueCrypt, however, these guidelines should be sufficient to protect your computer in your temporary absence.

  • Disable automatic user login on your computer;
  • Set up a Strong Password for your user account (test your password strength using PasswordMeter) ;
  • Make your computer prompt for the user password after waking from screen-savers, sleep, or hibernation.

On Windows Vista

Instead of setting a “strong” password which is a pain to remember, it may be more convenient to set a satisfactory password with an account lockout policy. This will, for example, allow 3 incorrect incorrect attempts before denying all login attempts for 15 minutes (12 tries per hour), rendering it virtually impossible for any human to guess the password during your temporary absence.

To do this, run “secpol.msc” (Start –> Run) then navigate to Security Settings > Account Policies > Account Lockout PolicyAccount lockout threshold is the number of incorrect attempts to allow before locking the user. Account lockout duration is the amount of time to maintain the lockout, and Reset account lockout counter after should be the same as Account lockout duration, unless you want some rather interesting effects.

Note: Vista Home Basic and Premium do not have this feature so follow Method 2 in this guide to enable: Enable account lockout in Vista Home Basic and Premium

This will, however, be utterly ineffective against erasing the Windows password on boot. Strong passwords are similarly ineffective against such an attack. You can remedy this by disabling booting from removable media in the BIOS. you will also need to set a strong BIOS password to prevent attackers from changing this setting.

The BIOS password is also easily erasable by removing the BIOS battery for a short period, this is extremely easy to do on a desktop, but relatively harder on a laptop. To reiterate a previous point, all of this will only protect your data from your temporary absence. The only way to truly secure your data is to encrypt it. Even disk-wide encryption (on the OS disk, anyway) can be broken into relatively easily compared to encrypted volumes, but it is far more effective than a Windows password.