9

Boxcryptor https://www.boxcryptor.com is not Open Source. Can I trust this? Is it secure? No government backdoor?

Because there is no alternative for OS X and iOS.

Improve this question
5
  • as @Mark touched upon, we don't really have any more information than you. how would we know if it's backdoored, if it's not free and open source software?
    – strugee
    Commented Jul 21, 2014 at 1:19
  • 1
    I'm using SpiderOak, their encryption method seems pretty secure (and is well documented), and it runs on OSX and iOS.
    – mdeous
    Commented Jul 21, 2014 at 1:23
  • 3
    The fact that it's closed source should raise a red flag. So no, you probably shouldn't trust this software.
    – Expedient
    Commented Jul 21, 2014 at 3:18
  • encfs can be used on OSX why ins't that an option? maketecheasier.com/install-encfs-mac
    – YoMismo
    Commented Jul 21, 2014 at 11:05
  • Here are the things I worry about with BoxCryptor: Not open source, and no audit. Encryption is not authenticated. However, perhaps dropbox provides some kind of integrity check? I don't know. Just be aware that possibly your ciphertext could be modified by an attacker that has access to your files. So, you will have to make your own judgment call as to how much you trust the company. (I posted this as an answer, but apparently it doesn't qualify. I question if this has "an answer")
    – DrEntropy
    Commented May 27, 2015 at 19:30

2 Answers 2

Reset to default
14

That's a judgment call you'll have to make for yourself, but their technical overview has what I consider a huge red flag:

Which data is stored on the Boxcryptor Key Server

Private RSA key (encrypted with the user's password)

The fact that your private key is stored on their server, even if it's encrypted with your password, greatly weakens security. It means that, at best, the security is as strong as your password, rather than being as strong as the underlying encryption.

Improve this answer
1
3

The storage of the encrypted private key on their servers mentioned by Mark is optional - you can choose to use the local account and distribute the keys yourself.

Improve this answer
4
  • 1
    Done. The EncFS compatibility is there only for the Boxcryptor Classic, which is still available, but unfortunately not supported anymore.
    – numo68
    Commented Jan 3, 2016 at 13:32
  • Have an upvote :-)
    – Rory Alsop ♦
    Commented Jan 3, 2016 at 14:06
  • 1
    Sad that boxcryptor classic is dead. I'll be moving on to something else.
    – Jus12
    Commented Mar 26, 2016 at 11:20
  • @Jus12: What did you move to now? Cloudfogger? I know it's not supported anymore, but I don't think it needs many major updates regarding security - I mean encfs is an pretty old algorithm and as far as it was already implemented correctly, no need to update it. Only feature wise it would be nice.
    – tim
    Commented May 28, 2016 at 16:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .