0

Looking to send an excel log file to a third party securely, any sensitive data will be obfuscated.

Initially was looking to use PGP but the third party does not have this and time is a constraint.

Was thinking of password protecting the excel file and sending this as normal email. What then would be a secure way of sending this password, either SMS or via a conference call which is not recorded?

  • 4
    Yes, sending the password through a different communication channel is a good idea. What version of Except are you using? The encryption of an old version may be insufficient. – Daisetsu Oct 9 '18 at 18:57
2

The appropriate level of security depends on the threats involved, so you to make some judgment calls. Password-protected Excel files have not been that secure in past versions and there are tools to break the older protections.

If you need a GUI-based, easy-to-use, Windows-based solution (I'm making assumptions), then many Windows file compression tools offer encryption (7zip is also a popular option and easy to use). You zip the file, then add encryption with a password. This process would protect the contents of the file but often exposes the file name (if that's a concern).

But you asked about sharing the password. The general idea is that you share the password through a different channel than the channel you used to share the file. So if you are emailing the file, you SMS or phone the recipient with the password, for example. This protects against someone who has access to the recipient's emails (or the email stream between you and the recipient) gaining both the file and the password.

  • 1
    Office has used AES-128 or higher for more than a decade. Office 2016 uses AES-256, which is the same algorithm as 7zip. Let me know if you have info to the contrary. – mgjk Oct 10 '18 at 14:34
  • @mgjk no different info, but a decade is not that long in Office time. I work with organisations that still use Office 2003. – schroeder Oct 10 '18 at 14:37
  • 2
    7zip's custom .7z format can also encrypt the file name, by the way, if you're willing to require your recipient to install 7-zip to open the file. – Ben Oct 10 '18 at 15:49
0

You can start by password protecting your Excel, putting it in a Rar or Zip archive, then password protect it, and indeed send it as a self-destruct message on Gmail's confidential mode or Telegram containing both passwords. (Or you can use a different communication channel for each password)

PS: I would change the file extension before zipping it so it does not look like an excel file - this is useless if you want to keep it out of "IT" persons.

  • The average person has a lot of trouble dealing with file extensions, from my experience. – schroeder Oct 10 '18 at 13:32
  • You're right it was just "a trick" for maybe someone else :) – Soufiane Tahiri Oct 10 '18 at 13:38
  • Yeah, I keep wanting file extension editing to be more natural for people. Also note that the version of Excel matters for the password protection to be sufficient protection. – schroeder Oct 10 '18 at 13:43
0

Excel encryption is fine for most cases. A strong password is needed, this makes it awkward for emailing a file and SMSing the password.

https://en.wikipedia.org/wiki/Microsoft_Office_password_protection

A tool like Hushmail* is designed to simplify this kind of problem.

*There is a historical case of Hushmail being compromised by law enforcement. If you're doing something illegal, Hushmail is not the solution for you.

-1

As someone pointed out, it depends on the level of threat. But one that will be useful to you anytime you need encryption and anonymity is onionshare service.

Onionshare ( Github respository ) ( Official website )

Its anonymous and encrypted file sharing service that runs on tor network. It's also open source and end to end encrypted.
Now what's great about this is that the files you want to share never leaves your system, instead onionshare starts a temporary web server on your system which contains only those files you want to share and makes it available as onion service and provides you with a unique URL that is accessible only through tor browser.

It simply means you are hosting your files on your own system that can be accessed through tor network with a unique and unguessable url. Another major feature is the automatically shutting down option of the server when the files are downloaded. It's like it never does exists.


There's also another security feature in onion share called stealth mode. When activated it generates another string along with url called "HidServAuth ..." which the recieving party has to set inside the tor browser config to access the url. This works like a password.

What's an Onion service ?

It's just a name. Technically its a service hosted on a server hidden inside the tor network. As an onion have layers to peel, so does the tor network ( layers of encryption ), hence the name. You can read more about this on official site

Weakness

The only weakness in all this is how you share that URL. PGP is of course the recommended way but you can also use end to end encryption services instead of ISP cellular ( they can easily snoop ). Another weakness that you may find is the exit node, but that doesn't apply here as your temporary server is inside the tor network.


Mitigation

  1. Use stealth mode. You will have two vectors to mitigate risks ( URL and Auth string ). Share it through different mediums.

  2. For anonymity you can use the hardened operating systems available. Search on google.

  3. PGP is still everywhere.

  4. And you can also use stegnography for hiding them in plain sights. You can use Openpuff for that.

Onionshare is available as gui on windows, linux and Mac OS on the official website. If you want custom build, you can follow the wiki

Signal for end to end encryption

The one that you can use is Signal developed by Open Whisper Systems. These are the guys that designed the signal (end to end encryption) protocol for mobile systems. They got some high profile endorsers. Even whatsapp uses it for end to end cryptography. The major benefit is that its open source. Read more about on wiki. Signal is available on Android, IOS and Desktop.

Signal Official website
Signal github repository

And of course you don't know exactly how any of the end to end providers servers are implemented and what they are retaining, so there's that....

Now the anonymity aspect of tor depends upon the underlying Operating systems and the network configurations and several other aspects but the privacy is still there. So, i would recommend onion share.

  • 2
    If PGP is a barrier in the scenario, I'm pretty sure that all this will be far beyond the capability of the stakeholders. Cool tool though. – schroeder Oct 10 '18 at 14:39
  • Yeah it does seem complicated but all you need is onionshare for sender and tor browser for receiver. Given the advantages, seems good to download. Maybe this answer doesn't belong here. I got carried away haha. – dgwaves Oct 10 '18 at 14:49
-1

There are two possible simple way to send file securely

  1. Using Gmail Confidential Mode
  2. Using Outlook, message encryption setting

Gmail Confidential Mode Setting:

  1. First Click on Compose mail
  2. Turn ON confidential Mode that is in SAVE button row.
  3. Now Choose option for PASSCODE (NO SMS passcode OR SMS passcode)
  4. If SMS Passcode is selected then we can mention receipent Mobile number to share secret passcode.

Outlook message encryption setting: You can send the Excel file securely in Outlook by using message encryption.

Please see below settings:

Encrypt a single message

In message that you are composing, click File > Properties.

Click Security Settings, and then select the Encrypt message contents and attachments check box.

Compose your message, and then click Send.

Also you have to share the secret with recipient in another mail.

For more details follow below link https://support.office.com/en-us/article/encrypt-email-messages-373339cb-bf1a-4509-b296-802a39d801dc

-2

If you want to send this file in a really secure way, start with compressing the file (such as tar, 7zip). Then use OpenSSL to encrypt the compressed file. You can send the file whatever channel you want after that. But make sure to send your password through another channel. You can use encrypted smartphone applications, or better yet, you just call and give the information.

Here is some examples:
Encryption: openssl des3 -in yourfile -out encryptedyourfile

Decryption: openssl des3 -d -in encryptedyourfile -out yourfile

  • 1
    If PGP is not an option for the recipient, I'm pretty sure command line options like openssl will also be a barrier (if they could use openssl, they could use just as easily use pgp). – schroeder Oct 10 '18 at 11:27
  • @schroeder I am wondering if you have used OpenSSL before, or have you tried typing the commands written there. You are commenting on something without even trying. You are also discouraging new members in this site. If you type the command there, it will ask you a password. Try it you will see. – Blacklion Oct 10 '18 at 16:41
  • You are correct, I did not try it out because I do not have a system that has openssl on it. I was working solely with your text that suggested that you only needed to tell the recipient the "algorithm" used, not the password. I have now edited your answer to include that part. – schroeder Oct 10 '18 at 16:48
  • I have also edited my comment to remove that part. – schroeder Oct 10 '18 at 16:50
  • 3
    Triple DES is also old (not broken, just not recommended), and the openssl cli isn't intended for production use, especially the enc tool, there are numerous problems with it. – AndrolGenhald Oct 10 '18 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.