0

In the last months I very often was in a position where I needed to send an email attachments with sensitive content to someone whom I didn't know well personally (so that I could talk to them how set up encryption), but about whom I knew that they had little IT background and barely knew how to operate a mail client. I'm not an expert myself, but I do know there is such a thing called PGP and with some time&pain I can get it to work.

(Imagine the receiver to be a non-tech person from a big company who little no time to deal with encryption and me being an non-IT engineer, who is technically minded, but does not have deeper IT/infosec knowledge and wants to protect his privacy as much as is possible.)

Because it is not clear to me that the email that I send will be send via TLS between server (and it is also not clear to me why I should trust those intermediate servers), it seems a very bad idea to a pdf with send sensitive content as a standard mail attachment.
Out of desperation I have resorted to uploading the pdf on a file sharing platform (which we shall assume to be trusted, so that my data is safe there). Then I send the download link to that file via (unencrypted) mail. The link has an expiration date and is password-protected and I'm sending the password along the link; this may seem stupid at the first glance, but please read along.

In this way the receiver of the email can still easily access the file without further IT knowledge on his side, but my privacy is slightly enhanced: Whiile I know that if someone would be after me and is intercepting my mail, it would still be very easy for him to get his hands on my pdf, if he is fast enough to download it before the link expires (which is usually a few days). But my threat model is not about protecting against that type of attack, but rather about protecting myself against automatic data collection & hoarding (think, e.g., government authorities snooping on subway cables).
I would assume, since getting the pdf involves some human action, such as filling in a password, that even if my data is collected, it will take too long until a human looks at at and by that time the link will have expired.

My question is:

  • Is this a good solution for my very moderate threat model described above? My file sharing platform doesn't use Captchas when one introduces a password to download a file. I assume that, if they would, that I would be 100% secure against such automated data collection, since even if such software would also automatically extract the password from the mail (which I doubt would happen, because if you hoard millions of mails that have passwords in them, you would need a very large amount of computational power to run automated NLP algorithms on them, to get the correct string that is the password, perhaps more than is available), it could not go past a Captcha?

  • Do you know any other way to securely send the email attachment (including any improvements to my solution above), so that the receive can still download it with minimal IT knowledge and time investment?

(Note that there was another question here regarding sending of links in mails, but my use case is different and more specific.)

Improve this question
9
  • Have you thought about using a secondary channel for the password exchange? e.g. via Phone or SMS?
    – Valentin
    Commented Apr 23, 2020 at 8:20
  • "secure" and "user-friendly" often find themselves diametrically opposed. Email is one of those cases.
    – Shadur-don't-feed-the-AI
    Commented Apr 23, 2020 at 8:29
  • You might want to look at encryptedsend.com. You can use this tool to send your file to the recipient with end-to-end encryption, and it's simple to use.
    – mti2935
    Commented Apr 23, 2020 at 11:32
  • @Valentin it is not feasible since I only have the email contact
    – MyCatsHat
    Commented Apr 24, 2020 at 16:18
  • @Shadur yes, but there must be something that can be done that is still user-friendly, while being at least a bit more secure than the current status quo (even if that solution is still not really 100% secure)
    – MyCatsHat
    Commented Apr 24, 2020 at 16:19

2 Answers 2

Reset to default
1

If you have access to Adobe Acrobat DC, you can set a password on the PDF files themselves when you create them. It's 128 bit AES, so strong enough. Very easy for the end user. They only need Adobe Acrobat Reader at their end. (So a potential issue is if they are using something else.)

Your argument that the threat model does not require you strongly secure the password makes sense but still makes me shudder! My usual goto for this is SMS texting the password; almost everyone can handle and understand this and it's easily automated.

Improve this answer
2
  • This is a good idea, since it's easiest for the end user. But how secure is such an encrypted pdf? Is it really unbreakable if someone obtains a copy of it? I somehow have never trusted pdf encryption, since it doesn't seem to be opensource, so it's hard to tell if it's even correctly implemented. Would you agree that if the sharing platform had a captcha, I would be perfectly safe against my threat model even if I send the password in the same email (I guess sending it from a different email would not really increase security'?...).
    – MyCatsHat
    Commented May 4, 2020 at 15:06
  • (BTW: Accepted your answers and awarded the bounty to the other one in order to try to spread the rep points somewhat evenly.)
    – MyCatsHat
    Commented May 4, 2020 at 15:07
1
+50

In the past when dealing with non-technical people, or people in environments that preclude them from installing custom software, the lowest common denominator fallback has always been Encrypted Zip.

Nearly everyone has the builtin ability to double click an encrypted zip and enter the password.

This begs the question of how to exchange the password. Typical possibilities include:

  • Direct phone call
  • a Separate email
    • Hinted: The name of the person's cat we talked about
    • Direct content- Password: OpenSessamee
    • An email from a third party
Improve this answer
4
  • Could you please also address how secure my approach would be in comparison to yours? Only direct-content password (as in my approach) or an email from a third paarty (which I also could incorporate in my approach) would be viable means.
    – MyCatsHat
    Commented Apr 25, 2020 at 19:38
  • The encrypted content is strong! The only risk is the password transport. If you like, you can use your method for just the password one time. After that, it never has to be repeated.
    – user10216038
    Commented Apr 25, 2020 at 23:55
  • IIRC, the Windows 10 native zip file support can't handle AES encrypted zip files, so it may not be a great fallback. (To be fair, same probably is true about native PDF support, and hence my answer, although Acrobat is a bit easier to get and install than many zip programs.)
    – Graham Hill
    Commented Apr 27, 2020 at 15:05
  • I agree with the encrypted zip solution, rather than adobe's. As long as the password is sent separately/securely, there's no problem.
    – Overmind
    Commented Apr 28, 2020 at 7:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .