15

I have a Dropbox account subscription so I have a lot of space to use and I basically put everything there. There are somethings (personal health / finance) that I want to keep protected myself so I want to use Veracrypt.

What are the best practices I should follow for keeping Veracrypt files on Dropbox? Should I use one large Veracrypt container and put everything there? Should I split up my files into smaller containers? Is there a difference? Is there significant security loss for having an encrypted file that is changing often and it's history is potentially recorded by Dropbox?

Improve this question
3
  • 4
    you may look into this link, cryfs.org/comparison
    – arif
    Commented May 26, 2017 at 8:10
  • 4
    Do not host an encrypted container using XTS mode on a remote server, see this article for an explanation of how this leaks a huge amount of information.
    – forest
    Commented Jan 9, 2018 at 2:56
  • You might want to look into Cryptomator (cryptomator.org) or rclone (rclone.org)
    – Mahn
    Commented Jan 31, 2021 at 0:04

4 Answers 4

Reset to default
4

Unfortunately, I think the answer should be: Don't use a VeraCrypt container with Dropbox, at all.

According to https://www.veracrypt.fr/en/Modes%20of%20Operation.html

The mode of operation used by VeraCrypt for encrypted partitions, drives, and virtual volumes is XTS.

And also

In 2010, XTS mode was approved by NIST for protecting the confidentiality of data on storage devices [24]. In 2007, it was also approved by the IEEE for cryptographic protection of data on block-oriented storage devices (IEEE 1619).

However, Dropbox is not a regular "storage device" or "block-oriented storage device"!

In conclusion, as long as VeraCrypt is using XTS, it shouldn't be used with Dropbox. Also, see this question Is it safe to have a TrueCrypt container file synced with DropBox? as well as the blog post You Don't Want XTS.

To quote from the latter mentioned blog post:

Remember that disk encryption is designed to counter an attacker with very limited capabilities. That’s why it falls to “Evil Maids”: the threat model doesn’t really accommodate attackers with multiple bytes at the (physical) apple. But whatever margin of safety XTS gets you on physical media probably goes out the window when you stick a Truecrypt volume on Dropbox. From the vantage point of Dropbox, attackers have far more capabilities than the XTS designers planned for.

Improve this answer
3

There is something designed for exactly this purpose. It's called a sparse image bundle. This is basically a disk image split into multiple small files making sync efficient (you do not need to sync the whole image file, if something in it changes). These "images" can also be encrypted.

On OSX, you can use disk utility to create such an image. This post describes the details: http://blog.fosketts.net/2015/07/22/how-to-use-mac-os-x-sparse-bundle-disk-images/

I am sure there are solutions for this on other platforms as well.

Improve this answer
3

I use a large 10 GB Veracrypt container on dropbox and I don't have any issues with it syncing, as Dropbox uploads data in small chunks. With alternatives such as; OneDrive, there is an issue because it has to reupload the entire file every time you make a change.

Even if the Veracrypt container becomes corrupted, you can still access older versions with the version history option.

Improve this answer
0
1

A large empty container would waste bandwidth. If you absolutely have to use Dropbox instead of a secure encrypted fileserver service, I'd encrypt each batch of uploaded files individually. And since Veracrypt isn't designed for encrypting small numbers of files, I'd just use an encrypted zip file.

Improve this answer
6
  • I thought of this, but the disadvantage is that I need to open each file individually then. Also, if I open an encrypted zip file, then depending on where I open it, it might get synced as plaintext. I'm not familiar with any secure encrypted fileserver, Dropbox says they're secure, why would I trust another service over Dropbox?
    – user668074
    Commented Apr 26, 2017 at 4:56
  • Also, correct me if I'm wrong, but Veracrypt encrypts in independent sectors so while the initial upload might be large, it will only upload diffs when the container changes, right?
    – user668074
    Commented Apr 26, 2017 at 5:08
  • If I correctly remember, encrypted zip did not have a very good reputation... But I do agree with you: Veracrypt is not designed for that use!
    – Serge Ballesta
    Commented Apr 26, 2017 at 8:14
  • @SergeBallesta, what do you mean when you say Veracrypt is not designed for that use? For use with a cloud sync program? For splitting up folders amongst different Veracrypt container files?
    – user668074
    Commented Apr 26, 2017 at 10:01
  • You could try mega.co.nz They make a specific point of not having your keys, and all encryption is done before uploading. It seems to be exactly what you want, encrypted Dropbox.
    – Rudy
    Commented Apr 28, 2017 at 0:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .