Boxcryptor https://www.boxcryptor.com is not Open Source. Can I trust this? Is it secure? No government backdoor?

Because there is no alternative for OS X and iOS.

  • as @Mark touched upon, we don't really have any more information than you. how would we know if it's backdoored, if it's not free and open source software? – strugee Jul 21 '14 at 1:19
  • 1
    I'm using SpiderOak, their encryption method seems pretty secure (and is well documented), and it runs on OSX and iOS. – mdeous Jul 21 '14 at 1:23
  • 3
    The fact that it's closed source should raise a red flag. So no, you probably shouldn't trust this software. – Expedient Jul 21 '14 at 3:18
  • encfs can be used on OSX why ins't that an option? maketecheasier.com/install-encfs-mac – YoMismo Jul 21 '14 at 11:05
  • Here are the things I worry about with BoxCryptor: Not open source, and no audit. Encryption is not authenticated. However, perhaps dropbox provides some kind of integrity check? I don't know. Just be aware that possibly your ciphertext could be modified by an attacker that has access to your files. So, you will have to make your own judgment call as to how much you trust the company. (I posted this as an answer, but apparently it doesn't qualify. I question if this has "an answer") – DrEntropy May 27 '15 at 19:30
up vote 14 down vote accepted

That's a judgment call you'll have to make for yourself, but their technical overview has what I consider a huge red flag:

Which data is stored on the Boxcryptor Key Server

Private RSA key (encrypted with the user's password)

The fact that your private key is stored on their server, even if it's encrypted with your password, greatly weakens security. It means that, at best, the security is as strong as your password, rather than being as strong as the underlying encryption.

The storage of the encrypted private key on their servers mentioned by Mark is optional - you can choose to use the local account and distribute the keys yourself.

  • 1
    Done. The EncFS compatibility is there only for the Boxcryptor Classic, which is still available, but unfortunately not supported anymore. – numo68 Jan 3 '16 at 13:32
  • Have an upvote :-) – Rory Alsop Jan 3 '16 at 14:06
  • 1
    Sad that boxcryptor classic is dead. I'll be moving on to something else. – Jus12 Mar 26 '16 at 11:20
  • @Jus12: What did you move to now? Cloudfogger? I know it's not supported anymore, but I don't think it needs many major updates regarding security - I mean encfs is an pretty old algorithm and as far as it was already implemented correctly, no need to update it. Only feature wise it would be nice. – tim May 28 '16 at 16:06

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.