Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It's my understanding files kept on Google Drive are not protected. I would like to have them encrypted so that to be able to view or modify them one must enter a password. I foresee a potential dilemma: the computer must have the encryption/decryption tool to do this, thus defeating the portability of Google Drive. A scenario is I'm working on a library computer where I do not have permission to install software.

Are there any online solutions to encrypting Google Drive that are open source? Is anything online (I'm avoiding the word "cloud") ever open source? To me it seems absurd to arbitrarily trust another company online to encrypt/decrypt files more than one would trust Google in the first place.

I noticed new versions of Microsoft Office have the option to save to online storage services, such as Google Drive and Skydrive. If this is going to be my default choice to save files to, I would like to have them encrypted.

share|improve this question
3  
Do you trust that library computer more than Google's servers? I feel the argument you might not have the tools to decrypt is redundant because you should only be using trusted computers to read the content if you're genuinely worried about their contents. –  deed02392 Mar 12 at 10:28
2  
@deed02392: Question is which is worse, some kid in the library installing malware and reading your private love letters, holiday photos and bomb plans, or Google sending a copy of everything to the NSA as a standard process. But yeah, I agree... it's kind of pointless to worry who might be reading your stuff when you use a totally compromised computer :) –  Damon Mar 12 at 10:48
    
You guys seem to be missing the point. I don't want to have to trust google or the library computers. @deed02392 you say I shouldn't have an untrusted school computer read sensitive data, that's different. I know when I upload a file to google drive it's being stored on their servers. When I use a USB device with my files on it, likely no data gets copied to the schools servers (it's not like the library computers keep copies of all data on all removable media inserted in them; I mean it is possibly but unlikely, you know google drive is keeping your files). –  Celeritas May 15 at 8:39
3  
@Celeritas You are wanting something illogical. You are saying you don't want to trust a computer that you want to use sensitive files on. Yes it's annoying when you can't have both convenience and confidentiality, but that is the way security works - it's a constant trade-off of these two elements. To be blunt, you simply have to get over it. –  deed02392 May 15 at 8:45

9 Answers 9

In general: You need to trust the machine on which you are decrypting the files. This trust is usually only warranted if you have full control over this machine which also means that you can install software on it. So if you are really concerned about the contents of your files then use an offline encryption/decryption tool on a trusted machine and upload the encrypted data to Google Drive or any other cloud file sharing service.

Then how do you access encrypted data on the library computer? Well, you don't. That machine might have malware on it that sends copies of your data and/or your key to somebody who is not supposed to have them. Once this happens your entire encryption is useless.

This also explains why there are no "online solutions to encrypting Google Drive". I'm not really sure what you mean by "online" here but I am assuming you mean "transparent" i.e. the data is encrypted but you don't really have to care about how it is done and don't need to worry about installing software. Here's why this is so hard to do:

Encryption of data always requires two main ingredients:

  • The algorithm used to encrypt the data and
  • the key used to encrypt the data.

The key must never be known by an untrustworthy entity. But you need to supply the key to the algorithm and an untrustworthy algorithm might just send the key to an untrustworthy entity. So you want the algorithm to be trustworthy. This, however, means that you should not use an algorithm provided by an untrustworthy source.

Applying this to your Google Drive situation

Since you want to store data so that Google can't read it we are going to define Google as untrustworthy.

Transparent encryption without additional software on the client side would have to be done either on the Google servers or in your browser.

  • When it is done on the Google servers it is obvious that you need to supply Google with your encryption key so they can decrypt your data on their servers. So now they have your key which means they can decrypt which means you might as well have stored your data in plain text all along.
  • The other option would be decryption in your browser. This, however, would have to be implemented by Google so they can serve it to you on their page. Again, you would have to hand the key to an algorithm that is from Google and that algorithm might send the key back to Google.

A trusted third party

After all that talk about how it is impossible to do transparent Google Drive encryption here comes a way how it might be possible. However, this requires that you trust some other party to see your sensitive data.

Google Drive has an API that allows viewing and uploading of files. In theory it would be possible to build a website that accesses your Google Drive using that API and encrypts and decrypts data before it is written or read. This means that Google would never see your plain data and you would still be able to access it without installing additional software.

However, now you have a different website owner who provides the decryption algorithm and might therefore have your key. And you have also handed him your Google Drive login so now he is the one who will be able to download and decrypt everything in your Google Drive.

The sad conclusion

If you really want to make sure that nobody sees unencrypted data, then you can't show your unencrypted data to anyone. This, however, means that you need to do the encryption on a trusted machine and that usually mandates that you install additional software. Also you can't decrypt data on untrustworthy machines such as library computers.

share|improve this answer
    
Basically means you need to have some specific trustworthy 3rd party non-google app that can encrypt/decrypt. 7-zip can do it but it makes an archive and you'd have to delete the original I guess or just send google drive a 7-zip copy. –  Dexter Jun 9 at 3:19

Just use 7-zip's password-protect feature.

share|improve this answer
1  
1)computer may not have 7-zip –  Celeritas Mar 12 at 7:58
1  
Like the other person answered, use portable 7-zip –  atdre Mar 12 at 9:59
    
Using portable 7-zip requires the ability to access the portable executable from local attached storage (thumb drive, floppy, cd, etc.) or from network sources (download from portableapps.com, Google Drive, dropbox, etc.). It also requires the ability to execute a non-native, non-standard installed, or non-approved executable. We get that you are trying to give a to-the-point answer to a problem, but it doesn't really answer the concept of the question @Celeritas is asking. –  0xSheepdog May 15 at 5:43

In Microsoft Office Word, Excel and PowerPoint it is possible to encrypt files with AES-128 encryption by setting a password. Note that encryption in Microsoft Office < 2003 is not secure, and in 2003 only if you manually pick a stronger encryption algorithm, because it defaults to the insecure Office 97/2000 Compatible encryption.

As others have suggested, you can use 7-Zip (Portable) for other files.

share|improve this answer

One open source solution which I found should solve your problem is the Cryptsync. Website is - http://stefanstools.sourceforge.net/CryptSync.html

Also,

Another method which I can suggest is, how about you convert your files to an SFX (Self Extracting) Archive and set a password with a nice encryption on it? I guess for this method you do not need any Installed Software on the remote desktop or even on an Android phone (No idea, about iOS) to decrypt the files.

As far as encryption is considered without using any software, you can use the Iexpress utility built inside every copy of Windows since Windows XP to create an SFX archive and use the above open source tool for encryption. I did some googling and it seems that IExpress cannot encrypt the files with a password.

More about the usage of Iexpress can be read here - http://lifehacker.com/384658/use-a-built-in-windows-utility-to-create-self-extracting-archives

So, I would suggest is use 7Zip on a computer where there are no restrictions or use a portable version of the 7Zip to encrypt the SFX archive. Once the SFX archive is created you can directly upload to Google Drive and can access the files from anywhere.

share|improve this answer

You can encrypt by using the open source Truecrypt software to create an encrypted container. An encrypted container is a file that Truecrypt uses and sort of pretends is a disk drive. It is formatted like a drive, and everything that is written to it is totally encrypted. When you mount it in Truecrypt, you get a drive letter on your computer and everything written to it is stored inside the container totally encrypted.

On the plus side, since everything written to the container is encrypted, this means that all the data going over the Internet to Google Drive is totally encrypted. Also, Truecrypt is available in portable versions that fit on a USB stick.

On the down side, Google drive doesn't support synchronizing portions of a file. This means every time you make a change to files in your container and dismount it, your computer has to send the whole container file to Google Drive, even if only a tiny part changed. For large containers, this can take quite a long time. For ease of use it's best to:

  1. Use multiple smaller containers
  2. Keep a container mounted, make all the changes you are going to make to the files in it, then unmount it. You can even keep it mounted all the time, only dismounting it once a day for it to synchronize.

It's unfortunate that Google Drive does such primitive synchronization, but it may be in an effort to combat people doing just as I suggest. Tools like rdiff have synchronized portions of a file over a network for 20 years now. Incidentally, Dropbox does partial file synchronization - only synchronizing the part of a file that changes. The technique of using an encrypted container on Dropbox works very well, and after the initial one, synchronization occurs very quickly and takes time in proportion to how many files are changed while the container is mounted.

share|improve this answer

For encrypting in Google Drive use plugins. For example Prot-On, free Tool for Google Drive. You can encrypt and decide who and when access.

http://www.prot-on.com

share|improve this answer

To me it seems absurd to arbitrarily trust another company online to encrypt/decrypt files more than one would trust Google in the first place.

Not sure I agree: Google simply does not encrypt, so performing an encryption with third party software provides very real, tangible security which Google does not offer out of the box.

There are many options to encrypt uploaded files such as Boxcrypt and Armor for Google Drive or even using classic 7zip encrypted files.

You could also try alternative services that provide encrypted cloud storage such as Wuala.

share|improve this answer
    
But it stores the files on it's servers using very high grade encryption, right? –  Pranav Jituri Mar 12 at 7:45
    
There was some mention of Google starting to store all data encrypted in the coming months somewhere after Snowden in 2013 (coincidental timing I'm sure) but I'm not sure what protection it offers: Google maintains the keys and as soon as you are logged into Google Drive decryption happens on the fly. In most scenarions a file on Google drive needs to be encrypted while have an "open" google drive itself. Not to mention possible governments access to Google Drive regardless of the encryption Google uses itself. –  user3244085 Mar 12 at 7:49
    
Good discussion. If you were to use one of those mentioned services such as Boxcrypt then your unencrypted files will be passing right through there servers. I see no reason to trust Boxcrypt anymore than Google? –  Celeritas Mar 12 at 8:01
    
@Celeritas :- I first included the Boxcrypt only but then changed it because I read later that Data will be passing through their servers. –  Pranav Jituri Mar 12 at 8:05
    
I agree and would personally never use those services for truly confidential data, but for the scenario in the question it should suffice: files are encrypted on your Google Drive. –  user3244085 Mar 12 at 8:05

There is a problem here: you are using a library computer which of all the computers in the world, is probably the type of system you can least trust. You should first be more worried about the library computer then about google.

But that's not your question, so let me answer your question:

I use Axcrypt on Dropbox. According to the Axcrypt website, it's a perfect tool for Google drive as well. The problem is you can't install it on your library computer. So you need a way to access it remotely. The way to do this is to install it on a thumb drive, take the thumb drive with you to the library and run it off of that:

http://www.axantum.com/axcrypt/

share|improve this answer

SpiderOak.com does what you want. It uses your login password to strongly encrypt all data before it's uploaded. So you get client side encryption and portability. As any client can access the data so as long as you enter the password.

Google Drive now provides encryption but it seems the keys lie with Google. So this is Google taking control of your data. Personally, I'd rather take control of my own data.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.