1

In the last few weeks I wrote several proposals to the government, to my professor, etc. I want to make a copy of this filled proposals and save them.

Instead of scanning it with my printer, making a pdf-document, writing it to an usb stick I want to use the iPhone app 'Genius Scan' and directly save the files into my google drive so that I have access to the documents from every device I am using.

I am able to encrypt the files with the app with RC4 128bit key. I read about RC4 encryption on the internet and found out that this is not the best encrytion technique at the moment. I don´t know how it works but is it enough to have this 'bad' encryption for my documents? The most personal information are my address and maybe IBAN/BIC code. Bad or good idea? Any possible ways to do it better?

  • RC4 is deprecated by RFC 7465. It is still in use in Windows 10 (but unices deprecated it successfully). Since you are going to store this information for long time, it is best to use cipher which is considered safe at this moment, for example, AES or 3DES. Anyway, even it's still in use in Windows, it's not safe to use it. – Aria Oct 9 '17 at 11:07
  • 2
    Try requesting a copy of your submitted proposal to see whether all, part, or none of your information is available as a public record. – Spencer Joplin Oct 9 '17 at 12:25
  • @SpencerJoplin Good point; there's no reason protecting what's already public! – Mike Ounsworth Oct 9 '17 at 14:27
  • 1
    Hands down, any software offered in 2019 that offers RC4 as the best encryption option is written by someone who a) doesn't know better, b) doesn't care, or c) isn't updating it any more. None of these options seem compatible with what one probably hopes to get out of security software. – Stephen Touset Nov 12 '19 at 18:56
  • Or someone that will sell you the version with AES later... – ThoriumBR Nov 12 '19 at 19:14
4

RC4 is insecure

From wikipedia/rc4:

While remarkable for its simplicity and speed in software, multiple vulnerabilities have been discovered in RC4, rendering it insecure.

It's not the most broken of ciphers (see DES), so your data is getting some protection, but not ideal. You would be better off finding something that supports AES-128 or AES-256 as those are the modern go-tos.

If the authors of that app have not bothered to update from RC4, then what else is the app going wrong? Basically, it does not speak highly of the overall quality of the app.

What's the actual risk?

The Electronic Frontier Foundation has a brilliant 5-point questionnaire for gauging your personal risk:

  1. What do I want to protect?
  2. Who do I want to protect it from?
  3. How bad are the consequences if I fail?
  4. How likely is it that I will need to protect it?
  5. How much trouble am I willing to go through to try to prevent potential consequences?

How much effort would it be to put it through a tool that supports AES? Is protecting this data worth the extra effort?

Any of the common zip programs found on Windows, OSX and Linux should do this, I presume iOS zip tools will too.

One closing point; if you're going to go to the trouble of choosing a strong cipher, make sure you choose a strong password to go with it. If your password is easily guessable, then it really doesn't matter which cipher you're using.

  • +1 for noting that the algorithm is only one potential weakness of a cryptographic system. – Spencer Joplin Oct 9 '17 at 19:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.