Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am looking to give some files to my accountant, who is not computer-savvy. I am going to put the files on a flash drive encrypted. I assume, accountant has no software other than standard Windows for decryption. I cannot rely on accountant being smart enough to download and install tools like truecrypt or 7-zip. I am also assuming accountant will be reluctant to run self-extracting executable, or at least I hope he is not that careless.

At this time, the best that option that comes to my mind will be to pack the files into a password protected zip file. This will, however divulge the file names, which I also want to hide, so I will have to zip the files twice - once into an non-encrypted archive, and second time into a secure one. I think there is a header encryption in newest zip format, but I could not find free tools that would do it (7-zip doesn't). Also I don't know if Windows is capable of decrypting such archive.

Can anybody think of a better option?

share|improve this question
3  
You will see from the answers so far that the core recommendation is that at least one of your assumptions is changed, either help the accountant install a tool, work with him to minimise risk of self decrypting archives or use an external web server. –  Rory Alsop Jan 6 '12 at 9:46
add comment

4 Answers

You could put the files in a TrueCrypt volume, and include a portable copy of TrueCrypt on the drive. I'm pretty sure the portable version of TruecCypt could then be configured to automatically load your volume (prompting for password, of course) on execution. I know TrueCrypt can also be configured to automatically open a file browser in the volume, once it's mounted.

Once all this is set up, just give the flash drive to your accountant. Send him the password out-of-band. Tell him to run TrueCrypt from the flash drive, using that password when prompted, and TrueCrypt will handle the rest.

share|improve this answer
    
Yes, but the question stated: “I am also assuming accountant will be reluctant to run self-extracting executable” (ok, that wouldn't be a self-extracting executable, but the issue is the same). –  Gilles Jan 5 '12 at 19:27
    
Well, absent a pre-established encryption tool of choice existing on both the sender's and recipient's systems, portable cryptography software is pretty much a necessity for this purpose. Otherwise, we end up with an unsolvable problem. There's got to be some software somewhere in the process, that both parties have access to, which can handle the encryption/decryption. –  Iszi Jan 5 '12 at 20:56
    
You can put the software on a web server, for example. –  Gilles Jan 5 '12 at 21:00
    
@Gilles The asker here is specifically looking for a flash drive based solution. Otherwise, I completely agree that a secure web delivery system may be preferable. –  Iszi Jan 5 '12 at 21:05
    
@Iszi, there is a pre-established encryption tool, it's a zip built-in to the explorer since windows xp, which I already brought up as a possible solution. I am asking if anyone can think of a better one. –  galets Jan 13 '12 at 18:13
show 1 more comment

Working at an accounting firm presently, we have that problem of needing to securely transmit files with no expectation of "smarts" by any of the parties involved.

We handle this by establishing (contracting out to a 3rd party) an SSL website that files are uploaded to. The client is sent an email with an authentication code (or we can suspend sending by email and provide the code over the phone, in person, etc). They get one shot to download the file. As soon as that code is used, the system deletes the file.

share|improve this answer
    
While I do not disagree with this approach being preferable over USB drives, the question is targeting flash drives as the asker's specific case. So, this answer does not address the question. –  Iszi Jan 5 '12 at 21:01
2  
+1 -- the OP is asking the wrong question. The real question is "How can I give files to my non-computer-savvy accountant?" The flash drive is a distraction. –  bstpierre Jan 6 '12 at 1:55
add comment

7-zip can make a self extracting password protected zip with encrypted file names, you just need to set the correct settings.

  • Set the archive format to 7z
  • check the box for "Create SFX archive"
  • Set a password
  • Check the box for "Encrypt file names"

enter image description here

share|improve this answer
1  
"I am also assuming accountant will be reluctant to run self-extracting executable, or at least I hope he is not that careless." -Original question. –  Jeff Ferland Jan 6 '12 at 7:48
    
@JeffFerland Sorry, did not see that line. but it does answer the question about 7zip encrypting header information. And if the accountant will not trust a self extracting exe you give him why would he trust something he would need to download and install/run off of the usb stick? If the accountant is willing you could put a portable version of 7zip on the drive, but why not just have it be self extracting if he is willing to do that. –  Scott Chamberlain Jan 6 '12 at 14:29
add comment

Easiest way I believe it to be AESCrypt. It is less than 1MB, free, very easy to use and won't get anybody confused about extra functionality (like 7zip). After installing AESEncrypt, you just have to Zip all files under one compressed file, right click on the file, select "AES Encrypt", select a password,

Prompted for a password

a new file with .aes extension is created which you can email to you accountant.

Your accountant opens the file by double clicking on the .aes file and will be prompted for the password.

Password for decryption

share|improve this answer
    
"I assume, accountant has no software other than standard Windows for decryption" –  galets Jul 2 '12 at 4:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.