8

I am new to security and encryption. I want to store important information like passwords and pin codes so I don't forget them. So far I have been using LastPass but I would prefer a solution I control my self. From reading a lot on the net it seems to me that 7-zip with AES 256 encryption is the way to go.

But what about the temporary files while opening/editing the content?

The temporary files are being deleted (as far as I can see at least) but I guess deleted files can be recovered?

Here is the process I would use (suggestions fro improving it are most welcome!):

  1. create SECFILE.txt on desktop
  2. open, write, save/close
  3. right click SECFILE.txt, add to archive...
  4. type password, click Ok (SECFILE.7z is created same place, 7-Zip closes)
  5. shift-delete SECFILE.txt


  6. open SECFILE.7z, enter password

  7. hit F4 to open SECFILE.txt in Notepad, read, close or...
  8. edit (as you start typing a temp copy will be created)
  9. save/close Notepad
  10. back in 7-Zip hit Ok in pop-up to update archive

On Android (I want to be able to read my information on my smartphone too) the app ZArchiver works fine to open and read files.

My computer runs Windows 8.1 and the file system is encypted with BitLocker. My smartphone (currently a Samsung Galaxy S4) can also be encrypted and I password protect it with a pincode. But lets say somebody got access to my computer or smartphone. Would the temporary files be an issue?

TEMP files: Z-Zip (PC): C:\Documents and Settings\\Local Settings\Temp\7z#####.tmp ZArchiver (Android): /storage/emulated/0/Android/data/ru.zdevs.zarchiver/temp

  • 2
    What are you trying to protect your data from? – immibis Aug 24 '14 at 7:44
  • 1
    If you don't trust that machine then you must not open encrypted files there. – aggsol Jan 20 '15 at 14:28
  • 3
    For the usage you describe, "So far I have been using LastPass but I would prefer a solution I control my self", I would merely recommend using KeePass which is similar to LastPass but with local storage of the password database and a lot of nice security feature (like erasing the password from the memory after some time, etc.). – WhiteWinterWolf Jul 19 '15 at 14:23
  • @WhiteWinterWolf: you forgot to mention that KeePass is also open source. – Lie Ryan Sep 4 '15 at 14:14
1

Yes, the (unencrypted) contents of the temp file can be recovered after they are deleted (I don't think 7-Zip overwrites them before removing), so they can be a problem (assuming an attacker can the BitLocker disk, such as having administrative account privileges (not necessarily voluntarily given, it could be through a compromise) to your booted computer).

7-Zip is Open Source, though, and it should be simple to force it to overwrite temporary files before deletion.

  • 5
    Overwriting is only a secure option on magnetic disks. On solid-state disks, it is virtually certain that overwriting will not overwrite the data because of the drive's wear-leveling mechanism. – Mark Dec 17 '14 at 8:35
  • @Mark Good point. Although if the ssd controller was asked to discard those blocks, they won't be readable, either. Maybe a laboratory could. – Ángel Sep 30 '15 at 23:55
1

I am new to security and encryption. I want to store important information like passwords and pin codes so I don't forget them. So far I have been using LastPass but I would prefer a solution I control my self. From reading a lot on the net it seems to me that 7-zip with AES 256 encryption is the way to go.

I'll suggest something better:

  1. Keepass
  2. TrueCrypt 7.1a (It's still secure. But if you're paranoid, VeraCrypt or LUKS)
  3. A USB pendrive

For you smartphone:

  1. Keepass Android Offline
  2. EDS (Supports TrueCrypt, VeraCrypt, LUKS)

Plugin the USB drive and completely encrypt it with a secure passphrase.

Create a Keepass Database file inside the USB Drive (protecting it with a master password and a key file).

Store all your password in Keepass.

The encrypted USB is one layer of protection. The Keepass DB is the second layer. The key file acts like a 2FA layer. Store the key file in your computer and your phone in an obscure location.

On your smartphone:

Create a small encrypted container using EDS and copy your Keepass DB inside it. Copy the key file in to any obscure folder.

Usage:

  1. Mount the encrypted volume by giving the passphrase (TrueCrypt in Windows and EDS in Android).
  2. Open the Keepass DB by giving the master password and key-file.
-1

If I understood it well the end issue is to protect data from being recovered from deleted temp files. To address this problem use tools to shred the temp file and or folder instead of shift+delete.

Deleting a files is nothing more than unlinking the address of the file from filesystem. Unless the contents of the location are over-written it is possible to recover them.

Such shredding tools over write the memory location the temp files was held it, thus making it impossible to recover.

  • 1
    "Address", "memory location": you are using consistently wrong terminology when referring to the filesystem. – Deer Hunter May 20 '15 at 13:23
  • @DeerHunter what is the right terminology? – rkrara May 21 '15 at 5:15
  • @DeerHunter Can you clarify? – RoraΖ Aug 19 '15 at 11:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.