encrypt folder, recommendations?

[Mike S]

I am going to install a crypto wallet on my w7 ult, and want to encrypt
the folder it lives in. Are there any open source encryption packages
that will let me encrypt individual folders, or even individual files,
that anyone can recommend?

[masonc]

Post by Mike S
I am going to install a crypto wallet on my w7 ult, and want to encrypt
the folder it lives in. Are there any open source encryption packages
that will let me encrypt individual folders, or even individual files,
that anyone can recommend?

"Magic Folders"

[VanguardLH]

Post by Mike S
I am going to install a crypto wallet on my w7 ult, and want to encrypt
the folder it lives in. Are there any open source encryption packages
that will let me encrypt individual folders, or even individual files,
that anyone can recommend?

Windows 7 Ultimate
should have
EFS = Encrypted File System (requires using NTFS)

If you use EFS, make damn sure you setup a recovery agent. There is no
backdoor, so if you forget the password (your Windows login) then the
data is lost forever. Obviously you must have a non-blank Windows login
for EFS to have something with which to encrypt.

https://www.tomsguide.com/us/encrypt-files-windows,news-18314.html

I've lost data because of having to rescue or replace a failed HDD,
installed a fresh copy of Windows, but lost access to the EFS-encrypted
files on another HDD. The same login doesn't work. A secure hash is
saved in a protected section of the registry (cryptohive) and it is
unique to the instance of Windows under which it was created. That's
why you need to assign a recovery agent. I didn't so I lost the EFS
files.

I later moved to TrueCrypt. While it can be used for whole-disk
encryption (but only in BIOS/MBR setups, not with UEFI/GPT - although
the Veracrypt variant is supposed to support UEFI), I only use it to
create encrypted containers. What folder hierarchy you create in the TC
container is your choice, just like however you create folders and
subfolders in the regular file system. You use TC to mount the
container. You are prompted for the password. After mounting, access
no longer requires a password until the volume gets unmounted.

If you get TrueCrypt, do NOT get it from the old Sourceforge site. When
the authors abandoned the program (or were forced to leave after
deciding not to get forced into adding a backdoor by the US gov't), they
crippled TC so it was read-only. You could used the last version to
mount and read previously created TC containers but not created new
ones. The last full-featured version of Truecrypt was 7.1a. There are
newer variants of Truecrypt, like Veracrypt (also free). As I recall,
Bestcrypt Traveller (and only that edition) is also free.

Since you are creating an encrypted archive file using TC, it is
portable. Move it anywhere and use TrueCrypt there to mount and access
that encrypted container. You aren't stuck into a particular instance
of Windows which is what happens when using EFS.

[Stan Brown]

Post by VanguardLH
If you get TrueCrypt, do NOT get it from the old Sourceforge site. When
the authors abandoned the program (or were forced to leave after
deciding not to get forced into adding a backdoor by the US gov't), they
crippled TC so it was read-only. You could used the last version to
mount and read previously created TC containers but not created new
ones. The last full-featured version of Truecrypt was 7.1a. There are
newer variants of Truecrypt, like Veracrypt (also free).

I've been using VeraCrypt for several years, and I recommend it. It
can read and write TrueCrypt volumes, but it can't create TrueCrypt
volumes. I don't know the technical details of the differences
between a TrueCrypt volume and a VeraCrypt volume, but I imagine they
include a fix for the security hole that was found in TrueCrypt when
its code was audited.

Wikipedia seems to disagree with my memory about a security hole
being found in audit:
https://en.wikipedia.org/wiki/Truecrypt
Probably Wikipedia is right and I'm wrong. Maybe I have a distorted
memory of the anonymous TrueCrypt authors' claim that TrueCrypt
contained security problems.

Anyway, VeraCrypt works like TrueCrypt, and it's free.

[m***@nowhere.com]

Post by Stan Brown

Post by VanguardLH
If you get TrueCrypt, do NOT get it from the old Sourceforge site. When
the authors abandoned the program (or were forced to leave after
deciding not to get forced into adding a backdoor by the US gov't), they
crippled TC so it was read-only. You could used the last version to
mount and read previously created TC containers but not created new
ones. The last full-featured version of Truecrypt was 7.1a. There are
newer variants of Truecrypt, like Veracrypt (also free).

Edited Out

Post by Stan Brown
Wikipedia seems to disagree with my memory about a security hole
https://en.wikipedia.org/wiki/Truecrypt
Probably Wikipedia is right and I'm wrong. Maybe I have a distorted
memory of the anonymous TrueCrypt authors' claim that TrueCrypt
contained security problems.

The so called security hole found in TrueCrypt was of no consequence.
Read the report. The CIA, FBI, and local police have had to go to
court to open up someone's TrueCrypt disk. One time, an ex-husband
supplied the password to his ex-wife's encrypted drive. That's the
only way the feds broke it. TrueCrypt has not ever been hacked -
unless your password might be the name of the family pooch. Some
people are that stupid. Use a passphrase created with Diceware and you
won't have to worry about TC being hacked.

The real question oncemore is simply how important is your info, and
how many people would really give a dang about trying to get it?
That'll determine how absolutely sure you have to be about it being
safe. However, TC volumes are so easily created and backed up, it's a
no-brainer as far as I'm concerned, even for simple non-important
"secret info".

Just an opinion.

Post by Stan Brown
--
Stan Brown, Oak Road Systems, Tompkins County, New York, USA

[Mike S]

Post by m***@nowhere.com

Post by Stan Brown

Post by VanguardLH
If you get TrueCrypt, do NOT get it from the old Sourceforge site. When
the authors abandoned the program (or were forced to leave after
deciding not to get forced into adding a backdoor by the US gov't), they
crippled TC so it was read-only. You could used the last version to
mount and read previously created TC containers but not created new
ones. The last full-featured version of Truecrypt was 7.1a. There are
newer variants of Truecrypt, like Veracrypt (also free).

Edited Out

Post by Stan Brown
Wikipedia seems to disagree with my memory about a security hole
https://en.wikipedia.org/wiki/Truecrypt
Probably Wikipedia is right and I'm wrong. Maybe I have a distorted
memory of the anonymous TrueCrypt authors' claim that TrueCrypt
contained security problems.

The so called security hole found in TrueCrypt was of no consequence.
Read the report. The CIA, FBI, and local police have had to go to
court to open up someone's TrueCrypt disk. One time, an ex-husband
supplied the password to his ex-wife's encrypted drive. That's the
only way the feds broke it. TrueCrypt has not ever been hacked -
unless your password might be the name of the family pooch. Some
people are that stupid. Use a passphrase created with Diceware and you
won't have to worry about TC being hacked.
The real question oncemore is simply how important is your info, and
how many people would really give a dang about trying to get it?
That'll determine how absolutely sure you have to be about it being
safe. However, TC volumes are so easily created and backed up, it's a
no-brainer as far as I'm concerned, even for simple non-important
"secret info".
Just an opinion.

Post by Stan Brown
--
Stan Brown, Oak Road Systems, Tompkins County, New York, USA

Thanks to everyone who replied, I now have research to do on some really
good looking approaches.

[Zaidy036]

Post by Mike S
I am going to install a crypto wallet on my w7 ult, and want to encrypt
the folder it lives in. Are there any open source encryption packages
that will let me encrypt individual folders, or even individual files,
that anyone can recommend?

If you have an image program like Acronis then image the folder with a
password and then delete the original. Restore from image when you need it.

[m***@nowhere.com]

Post by Zaidy036

Post by Mike S
I am going to install a crypto wallet on my w7 ult, and want to encrypt
the folder it lives in. Are there any open source encryption packages
that will let me encrypt individual folders, or even individual files,
that anyone can recommend?

If you have an image program like Acronis then image the folder with a
password and then delete the original. Restore from image when you need it.
--
Zaidy036

I would never trust a program that has encryption simply as an add-on.
Acronis has had many problems in recent years. Many complaints in the
forums. That's why I still use a much older version. Just because an
outfit says their program contains encryption is no guarantee of how
well that encryption has been implemented. Simply using some AES,or
whatever encryption template code means little. Many so-called
encrypted proggies have been broken because of poor implementation.

In encryption, reputation - gained over a good deal of time, and
battles with hackers, private and government ones, are to me the sole
criterion by which an encryption program can be trusted.

However, how much security you really need is really dependant on the
importance of what info you are trying to protect. That's your call.

[J. P. Gilliver (John)]

Post by Zaidy036

Post by Mike S
I am going to install a crypto wallet on my w7 ult, and want to encrypt
the folder it lives in. Are there any open source encryption packages
that will let me encrypt individual folders, or even individual files,
that anyone can recommend?

If you have an image program like Acronis then image the folder with a
password and then delete the original. Restore from image when you need it.

(Regardless of whether you consider the encryption in Acronis or
whatever to be any good:) the "delete" in the above would be "delete
with extreme prejudice", i. e. use one of the many utilities that
overwrite. (With modern drives I don't think you'll need multiple
overwrites.) Plus what (ITIW) VanguardLH said about buffers, pagefiles,
etcetera.

[Stan Brown]

Post by J. P. Gilliver (John)
Plus what (ITIW) VanguardLH said about buffers, pagefiles,
etcetera.

I think Vanguard is right about that.

Here's my take. There is no such thing as absolute safety. Given
time, any encryption can be broken.

Even though pagefiles etc. are a potential security leak, they're a
lot less of one than just having the files sitting around unencrypted
and in regular Windows folders. It's like locking your car or your
house: it won't keep out a determined intruder, but it will slow them
down, and maybe even make them move on to an easier target.

The pagefile vulnerability can be avoided by installing extra RAM and
turning off virtual memory. If I'm not mistaken, shutting down the
computer clears RAM, if not instantly then in a few seconds.

I don't know what if anything can be done in general about buffers
created when files are open, but individual programs have some
mechanisms. Vim lets you designate where temp files should go. Excel
puts the working copy in the same folder as the original, so if the
original is in an encrypted volume the temp copy will be too. You can
always redirect %TEMP% to the encrypted volume if you really want to,
but there must be some programs that don't use %TEMP%.

[Paul]

Post by Stan Brown

Post by J. P. Gilliver (John)
Plus what (ITIW) VanguardLH said about buffers, pagefiles,
etcetera.

I think Vanguard is right about that.
Here's my take. There is no such thing as absolute safety. Given
time, any encryption can be broken.
Even though pagefiles etc. are a potential security leak, they're a
lot less of one than just having the files sitting around unencrypted
and in regular Windows folders. It's like locking your car or your
house: it won't keep out a determined intruder, but it will slow them
down, and maybe even make them move on to an easier target.
The pagefile vulnerability can be avoided by installing extra RAM and
turning off virtual memory. If I'm not mistaken, shutting down the
computer clears RAM, if not instantly then in a few seconds.
I don't know what if anything can be done in general about buffers
created when files are open, but individual programs have some
mechanisms. Vim lets you designate where temp files should go. Excel
puts the working copy in the same folder as the original, so if the
original is in an encrypted volume the temp copy will be too. You can
always redirect %TEMP% to the encrypted volume if you really want to,
but there must be some programs that don't use %TEMP%.

If you want to encrypt, you'd want to boot a LiveCD that uses
only RAM for buffering. When you shutdown afterwards, only the
encrypted output you copied to the Windows hard drive would remain,
and any temporary files would be lost when the RAM loses power.

For example, maybe I could use some tool that does AES128.
AES128 may be marginally more secure than AES256, so don't
judge a book by its cover. (I'm still trying to track down
why a 2^99 number is associated with AES256. And I'd seen
a claim somewhere, that AES256 might be easier to crack because
of whatever that number means.)

And Windows has EFS, Bitlocker with Elephant Diffuser (Win7)
and Bitlocker without Elephant Diffuser (Win10). As examples
of available in-system crypto.

*******

Here's an example of a jokey reference to cracking AES128 on a PDF.

https://security.stackexchange.com/questions/61346/how-long-would-it-take-to-bruteforce-an-aes-128-protected-pdf-knowing-the-key-is

Real tools seem to place an emphasis on poorly prepared passwords.

https://www.elcomsoft.com/apdfpr.html

The software doesn't use the password directly, and some processing
to generate a key is used.

https://crypto.stackexchange.com/questions/42538/is-password-based-aes-encryption-secure-at-all

*******

Your biggest exposure is probably storing your .TXT crib notes,
with all the steps you used to prepare the file. What slip of paper
did you write the password on again ? How many examples of "how I
think about passwords" did you leave around the house ? For example,
I like punctuation, even if sometimes I end up with a password
that's very hard to get right on the first entry.

And if you want to "collect entropy" on a computer, you have to
keep the interface active. As that's how some OSes collect their
"random events".

https://stackoverflow.com/questions/4955527/what-entropy-sources-are-available-on-windows

Paul

[Stan Brown]

Post by Paul
Your biggest exposure is probably storing your .TXT crib notes,
with all the steps you used to prepare the file. What slip of paper
did you write the password on again ? How many examples of "how I
think about passwords" did you leave around the house ?

Well, the end stage of that is writing the password on a sticky note
stuck to the monitor. :-)

But surely you use a password manager? Then all your passwords are
encrypted and you have to remember only one, to unlock the password
manager. Mine is a long phrase, so I can remember it easily but it's
hard to decode by brute force. And of course I have LOTS of backups
of the password file

[Mike S]

Post by Stan Brown

Post by Paul
Your biggest exposure is probably storing your .TXT crib notes,
with all the steps you used to prepare the file. What slip of paper
did you write the password on again ? How many examples of "how I
think about passwords" did you leave around the house ?

Well, the end stage of that is writing the password on a sticky note
stuck to the monitor. :-)
But surely you use a password manager? Then all your passwords are
encrypted and you have to remember only one, to unlock the password
manager. Mine is a long phrase, so I can remember it easily but it's
hard to decode by brute force. And of course I have LOTS of backups
of the password file

Thanks again for the replies and discussion, I settled on Veracrypt,
they have good documentation, it's easy to create an encrypted volume if
any size; and to mount, use, and un-mount it quickly. Discussion of the
pagefile issues was appreciated and noted.

[VanguardLH]

Post by Stan Brown

Post by J. P. Gilliver (John)
Plus what (ITIW) VanguardLH said about buffers, pagefiles,
etcetera.

I think Vanguard is right about that.
Here's my take. There is no such thing as absolute safety. Given
time, any encryption can be broken.
Even though pagefiles etc. are a potential security leak, they're a
lot less of one than just having the files sitting around unencrypted
and in regular Windows folders. It's like locking your car or your
house: it won't keep out a determined intruder, but it will slow them
down, and maybe even make them move on to an easier target.

Also, when editing the files, word processors often will save a
temporary backup. For example, when I use Word on a .doc file on my
desktop, I see the dimmed backup copies also on my desktop. Some will
put the temp file in the temp folder. That's a much bigger exposure
than pieces of the file sitting in the pagefile blocks that haven't yet
been reused or small pieces of the file in buffers in memory. After
opening a file, and to be sure no temp files got left behind or got
deleted but obviously their sectors could expose the contents until
reused, you could close the TC container and then wipe all free space on
the drive. The option to clear the paging file (not just deallocated
but written with zeros) on Windows shutdown and clearing out the old
system memory blocks still not reused which requires a power off is why
you seizure of computers must be quick, ensuring power cannot be lost,
and getting to the computers before the suspects can shutdown and power
off.

While you could create a RAM drive and designate it as the location for
the temp folder, that doesn't obviate programs that store temp files in
the same location as the file or in a location of their own choosing.
If the program uses the default temp folder but you've configured the
registry to point at a RAM drive then its contents are lost on a power
loss. If the program wrote the same path as the original file, the temp
file would be inside the TC container. Alas, some programs use the
Roaming, ProgramData, or other folders of the drive.

The files are secure inside the TC container. Whether they remain
secreted when opened and read from there can take a lot of work to keep
all those fragments hidden, encrypted, or inaccessible. For uber
paranoids, that's probably why they look at whole-disk encryption and
perform power cycling after touching highly-sensitive files, or they put
their computers into locked rooms. Thermal explosives would work, too,
by frying anything due to unauthorized access. Just hope you don't
retry that password too many times.

Post by Stan Brown
The pagefile vulnerability can be avoided by installing extra RAM and
turning off virtual memory.

The problem with that is some programs, even Windows, will demand paging
space at times. If the program coded to use the paging file gets a
status back that there is no available free space then the program will
misbehave, crash, or error exit. For example, many video games will
preload their textures into the pagefile to allow quick access despite
it is still retrieved from disk rather than memory. Loading all the
textures into memory instead of just those in the immediate level map
results in wasting a lot of system memory and severely ups the memory
requirement of the game.

[m***@nowhere.com]

Post by Mike S
I am going to install a crypto wallet on my w7 ult, and want to encrypt
the folder it lives in. Are there any open source encryption packages
that will let me encrypt individual folders, or even individual files,
that anyone can recommend?

My opinion is to use simple, safe and proven TrueCrypt to create an
encrypted volume which your machine treats as another drive. It
eliminates having to have untrusted and separate programs for files
and folder encryption. As far as I'm concerned, I trust none of the
newer encryption methods.

TC is proven. Period.

TC will NOT work with UEFI bios. I learned that the hard way by
blowing my Windows 7 Ultimate machine by trying it. Luckily I had
everything backed up with the Windows 7 backup utility plus a repair
disk. I regained everything through foresight.

Why didn't I use Redmond's BitLocker? You're kidding, right?

Everything I've read so far says VeraCrypt does not work with UEFI. I
could be wrong. But VeraCrypt is much too new to be trusted. It hasn't
been through the government wars yet, as has TC. I also read of multi
problems in the forums.

Go with a TC volume. Full disk encryption is much better, but it's a
pain in the butt to keep your drive backed up. That's for more
knowledgeable users.

Just my opinion after years of using TC on my older Windows machines.

[Stan Brown]

Post by m***@nowhere.com
My opinion is to use simple, safe and proven TrueCrypt

VeraCrypt, you mean.

https://en.wikipedia.org/wiki/Truecrypt

[m***@right.here.com]

Post by Stan Brown

Post by m***@nowhere.com
My opinion is to use simple, safe and proven TrueCrypt

VeraCrypt, you mean.

No, I didn't mean VeraCrypt. I meant what was posted - TrueCrypt.

VeraCrypt is unproven until Uncle Sam and lesser jurisdictions go
after it and fail, and then have to try to get it opened by court
order. That's the story of TrueCrypt. Until then, I trust TrueCrypt,
not VeraCrypt. My info, my choise.

[VanguardLH]

Post by m***@nowhere.com
TC will NOT work with UEFI bios. I learned that the hard way by
blowing my Windows 7 Ultimate machine by trying it. Luckily I had
everything backed up with the Windows 7 backup utility plus a repair
disk. I regained everything through foresight.

To be accurate, Truecrypt won't work when used for whole-disk encryption
on a UEFI computer. It still does work when creating .tc containers
holding the encrypted files.

Post by m***@nowhere.com
Why didn't I use Redmond's BitLocker? You're kidding, right?

Again, whole-disk encryption. The OP only wanted to protect the
contents of a folder, not the whole disk.

As I recall, the vulnerability in Bitlocker wasn't in the program but in
the TPM chip in the computer. So I did a search to check.

https://www.softcat.com/news/tpm-vulnerability-bitlocker-full-disk-encryption-impacted/
https://support.microsoft.com/en-us/help/4046783/bitlocker-mitigation-plan-for-vulnerability-in-tpm

Post by m***@nowhere.com
Everything I've read so far says VeraCrypt does not work with UEFI. I
could be wrong.

Yep, you're wrong. It's Truecrypt that won't work with UEFI but only if
you use TrueCrypt for whole-disk encryption.

Post by m***@nowhere.com
But VeraCrypt is much too new to be trusted.

It started with the TrueCrypt code (because it was open source). The
audits found some weaknesses or deficiencies. As I recall Veracrypt
only addressed some of them, like 6 out of 22. One was to support UEFI.

How long was it before TrueCrypt got any auditing? 11 years. How many
open source programs ever get audited? Being open source means they are
open to inspection but they rarely get inspected by an independent 3rd
party plus you have to assume the compiled executable used the open
source code that could be reviewed. Veracrypt got audited 3 years after
they adapted TC; see:

https://www.zdnet.com/article/veracrypt-audit-reveals-attacker-treasure-trove-of-critical-flaws/
"VeraCrypt 1.8 and its bootloaders contained a total of eight critical
vulnerabilities, three medium flaws and 15 additional bugs of low
importance."
"The majority of these problems have been fixed in VeraCrypt 1.19"
"The remaining problems present have all come from the days of
TrueCrypt, and fixing them at the moment could cause issues with
backward compatibility."

Unlike the TC authors who remained anonymous and were slow to make
changes and disappeared after the first audit and weren't around after
abandoning TC (and made it read-only) before the 2nd audit, Veracrypt is
a lot more responsive to fixing their product. IDRIX inherited the
problems found in TC.

Post by m***@nowhere.com
Go with a TC volume. Full disk encryption is much better, but it's a
pain in the butt to keep your drive backed up. That's for more
knowledgeable users.

Unless you are programming new software that needs to be protected, why
do you need whole-disk encryption for programs that aren't yours and
that anyone can get?

Post by m***@nowhere.com
Just my opinion after years of using TC on my older Windows machines.

The problem with TC, BestCrypt, VeraCrypt, and other tools creating
container files with encrypted data is that they possess static
protection. While the files are inside, they are very secure. When you
mount the container and open any files therein is when you lose security
due to buffers in memory, pagefile, and other artifacts in opening and
accessing the contents of files. In situ, the files are safe. In use,
they aren't so secure anymore. That's probably why some users go to
using whole-disk encryption; however, memory gets reallocated, pagefile
can be wiped on shutdown, and so on to placate the paranoids of which
most don't have anything they really need to secrete from a gov't but
perhaps from a business competitor.

[Stan Brown]

Thanks, Vanguard, for posting corrections to the F.U.D. from a
previous poster about VeraCrypt versus TrueCrypt.

[Stan Brown]

Post by Mike S
I am going to install a crypto wallet on my w7 ult, and want to encrypt
the folder it lives in. Are there any open source encryption packages
that will let me encrypt individual folders, or even individual files,
that anyone can recommend?

Isn't the "crypto wallet" already encrypted?

[Mike S]

Post by Stan Brown

Post by Mike S
I am going to install a crypto wallet on my w7 ult, and want to encrypt
the folder it lives in. Are there any open source encryption packages
that will let me encrypt individual folders, or even individual files,
that anyone can recommend?

Isn't the "crypto wallet" already encrypted?

I want another layer.