MX Linux Forum

I recently added a 2nd drive, formatted my 1st drive and planned on using it as a back up of sorts for pics, documents, etc.

Started transferring the files from the USB stick I currently use, clicked on the 1st folder, and INSTANTLY realized it needs to be password protected if I am going to leave it on a computer others can use.

I have been searching and playing around for the last hour or so and can't come up with an EASY to use program. Zulucrypt sucks. The only thing i could find that looks viable you have to add a ppa to download so that's out. 1 programs last update was debian 9, the other was 6 years ago. I don't want to use the command line.

Another user had a novel solution of adding another user, assigning ownership of the folder to that user, and using a different password. So far that seems the most viable alternative.

I looked at creating a small encrypted partition on the drive and storing the files there, but that seems like kind of a pain in the a**.

Anybody using anything with a simple, easy to use GUI that would just allow me to enter the password to get into that folder?

Thanks in advance.

If all you want to do is stop a bit of family espionage from 5 year olds, or errors, setting user permissions is fine. Otherwise, encrypted drive is the way.

After creating your partition using a tool such as GParted (let's say it's /dev/sdb1) use: sudo cryptsetup luksFormat /dev/sdb1
The program will prompt you for a password in the terminal.

I recall Thunar will ask for a password if it finds the drive is encrypted, but it's been a while since I moved to KDE Plasma.

Veracrypt .
_________________

.. Or .. (when p7zip-full is installed): Right-click on folder: "Archive" with .7z (click "advanced" => assign a password) ... then delete the original folder..

(Consequently, use the archive as an aes-256 encrypted folder)

I second the Huckleberry Finn answer.

I have some folders which I give an misleading name and then zip it with a password. Not military grade but sufficient for many things.

Just as a note: Say "those others" know a bit about these things and can scan your drive ..

Then the deleted original folder will be able to be rescued (say photorec, testdisk) ..

So (in serious cases) it needs to be overwritten with zeros or random (and that's also simple with dd etc..)

(Same for aescrypt users for files)

So it looks like the answer to my question is a resounding "NO!!" LOL.

Veracrypt I will have to study and play with some more. All it did was create a file I can't open. the .7z archive route was cumbersome, but accomplished what I need.

I haven't added a user yet, but it seems that is still going to be the simplest after it gets set up. Just enter the pw and go.

Thanks all.

In fact, aescrypt may be what you need, but that's for files. So, you need to select all files within folder each time, or again first compress the folder to make it a single file (no pw. and any format, zip etc..)

Veracrypt is really so handy (and so strong) once you get used to (or understand how it works).

Shortly, you can create "containers" first (a virtual drive as if formatted to say ext4 etc.), then you can rename, delete, send, copy, move, change pw. / key files .. Add new files or take some out (like a directory or archive) ...

All you need to do is first create a container once, then the rest is fun. (It can be very small or big.. say 30 MB will do the job) ..

Meanwhile I, too do the "misleading name" trick :) I especially give names that sounds like system-related files: systemd , sysvinit, even system32.dll

Meanwhile, since they're "so called" drives, you just "mount" them with Veracrypt, then unmount again within Veracrypt and close (but not using the file manager etc..)

Ccrypt will recursively encrypt folder contents.

I have been using VeraCrypt for years and it has performed flawlessly. It is a solid encryption program that has been independently audited. I can't emphasize that enough.

It can encrypt a partition (e.g. an entire USB Flash Drive) or make a container (file) on a partition. The encrypted container (file) has a minimum size depending on the file type (FAT is 292 KB, exFAT is 424 KB, NTFS is 3792 KB, etc.). The encrypted file can be treated like any other file - it can be deleted, moved, copied, re-named, etc. To open (or decrypt) the partition or file, just open VeraCrypt, enter the password, and mount it.

Once the VeraCrypt partition or file is decrypted, it will appear as a "disk" that you can store files and folders in just like any disk or directory.

GlockdocVegas wrote: Sat May 22, 2021 10:57 am Veracrypt I will have to study and play with some more. All it did was create a file I can't open.

I think a VeraCrypt tutorial from a YouTube video would show why the "All it did was create a file I can't open." problem occured.

While there are many good VeraCrypt YouTube tutorials, I recommend this https://youtu.be/cFipj_GOWjU?t=166 because he shows how to use it in Linux, although using it in Windows will be essentially the same. The above link will open at the 2:46 time mark because that is where he opens VeraCrypt (the part prior is him downloading it - we have it in the Stable repository in MXPI). The video has an English closed caption in case you need a clear interpretation.

Meanwhile, this guy wrote almost what I was thinking to write, it may be useful for everyone who reads these later or searches about Veracrypt:

The below are quoted from the comment of youtube member "Perhaps" (on the same link above) :


" Regarding keyfiles:

Although you can use VeraCrypt to create keyfiles, you also have the option to use any file on your computer as a keyfile, too.

Although having a complicated keyfile (the type that VeraCrypt would create) is theoretically better, the goal of using a keyfile is that if an attacker does not know that you are using a keyfile, then he cannot brute force his way in to your encrypted volume. In other words, you can use a keyfile with only the letter "x" in it. But if no one knows that you used that file for your volume, then they will never be able to break in to your encrypted volume.

Also, although you can use any file as a keyfile, do not use any files that comes with Windows, or any file that comes with an installed program. This is because if an update changes or deletes the file, then you are screwed. Only use a file that you know will never change.

You can use multiple files.

VeraCrypt has a limit on how much of a file it will use towards unlocking your encrypted volume (I think it is the first 1024 bytes). So if you use, for example, a .mp4 video as a keyfile (and you can -- it will work), only the first 1024 (or something like that) characters will be used by VeraCrypt. This is fine. But just do not think that a huge keyfile will make a huge difference. "

__________________________________________

Huck: ... Therefore, when using media files you can rename but just don't make any changes in exif / metadata (artist, album, comment etc.), they won't be recognized as the keyfile ..

I can also give Vera Crypt a big thumbs up. I used its predecessor, True Crypt, for years and it always delivered the goods.

I don't think it's in the repo yet but you can get it here - https://veracrypt.fr/en/Downloads.html

You'll probably want the gui version.

This tutorial works on MX - https://www.linuxandubuntu.com/home/enc ... -truecrypt

It's the best option whether you want to just encrypt a folder or an entire partition imo. Just keep in mind the encrypted volume will need to be a bit larger than the folder you need to encrypt, i.e. if the folder size is 20mb then create a volume no smaller than 25 or 26mb.

LU344928 wrote: Sun May 23, 2021 12:19 pm I don't think it's in the repo yet but you can get it here - https://veracrypt.fr/en/Downloads.html

VeraCrypt is available in the Stable Repository. Here is an image of it in the MX-19.4 MXPI. Note that it is at its current version 1.24 (as of this posting).

What is your use-case. In other words, from what are you protecting these files? The use-case should drive the type of protection you use. The greater the protection needed. How much data needs to be protected (how many files and how many GB)?

Stuart_M wrote: Sun May 23, 2021 4:12 pm

LU344928 wrote: Sun May 23, 2021 12:19 pm I don't think it's in the repo yet but you can get it here - https://veracrypt.fr/en/Downloads.html

VeraCrypt is available in the Stable Repository. Here is an image of it in the MX-19.4 MXPI. Note that it is at its current version 1.24 (as of this posting).
VeraCrypt_MXPI.png

Good to hear. I did see it in the request thread but that was some time ago. Thanks for that.

Be sure to back up your data prior to encrypting the folder just in case something goes wrong.

Then the backup would need to be offsite or on cloud storage. No point in encrypting a folder if you have an unencrypted backup on the same computer.

I guess that goes without saying but this could be overlooked by newbies to encryption.

You can always securely delete the backup when you're through. The package secure-delete's in the stable repo. It's just that I think Veracrypt will create a new encrypted volume which could destroy your existing data in the process. Anyway, it's better to be prepared than to accidentally lose your data.

JayM wrote: Mon May 24, 2021 4:04 am It's just that I think Veracrypt will create a new encrypted volume which could destroy your existing data in the process.

That would only happen if you're encrypting an existing partition, not a good approach anyway. If you're just working with folders then the original folder remains unaltered. It's just a simple copy/paste to the encrypted container/volume which appears as another drive in the file manager.

If what you want is to click on a folder (well, device/partition at top left of Thunar) and have a password dialogue pop up, then a LUKS encrypted partition will do that. You don't need to set up LUKS opening during boot. The drive encrypted partition should appear in Thunar, you click on it and a password prompt will pop up, then the system will automount the unlocked partition. You can create a LUKS encrypted partition in gui disk tools in MX.

A Veracrypt container is pretty close to this use scenario but does involve a couple more simple steps in the gui to open the container. Really, just selecting the container before mounting. The Veracrypt approach is simpler overall if you ask me and you can backup or move your container to anywhere you like.

I use both approaches for different things.

I used to use Veracrypt to encrypt my external backup drive and as you say it's pretty simple to decrypt and mount it using the GUI, but now I just use LUKS as I can do the same in Thunar without having to use an additional app.

If the OP decides to use Veracrypt, one tip: at some point when you decrypt the volume it will ask for either your password or root's: enter your own password. Then after the volume's mounted you'll have full read-write-execute permissions on the files already.

JayM wrote: Mon May 24, 2021 4:42 am If the OP decides to use Veracrypt, one tip: at some point when you decrypt the volume it will ask for either your password or root's: enter your own password.

Yes. To further clarify, for each session two passwords must be entered. The first is the one used when creating the container then the second is the user/sudo password, not root's. That's assuming the process is started from the gui.

I did consider Veracrypt, for reasons of privacy really, but was put off by the issue of hidden volumes, and the dangers outlined in the following article. Bear in mind we may live presently in semi-democracies but will that last? I wouldn't bet on it.

https://proprivacy.com/privacy-service/ ... en-volumes
"A VeraCrypt hidden volume makes it impossible to know (and therefore prove) that hidden data exists, which is what lies at the heart of the concept of ‘plausible deniability’. The problem comes when you are dealing with an adversary who doesn’t care about proving the data exists, and will imprison or torture you simply on the grounds of suspicion.

In such a situation, using VeraCrypt to protect your files may be especially dangerous, since if no hidden volume actually exists then you can neither prove this to be the case, nor surrender the non-existent keys. If your adversary chooses not believe you, then you have nowhere to go…"

They do suggest that, If we are sure only one hidden volume Can exist in each instance, then always create that volume so you can submit the key to prove it.

The solution I chose was a 3rd. party app Cryptomator which is very easy to use and one can create numerous vaults locally or on external usb etc. A good long passphrase for each vault secures. You then only need to open the vault(s) which has your current work. It can hold files and folders. I think it needs Systemd, which I use anyway.
It is primarily designed for Dropbox-like use, where both parties know the passphrase, but I've had no problem using it locally.

Stuart_M wrote: Sun May 23, 2021 8:58 am I have been using VeraCrypt for years and it has performed flawlessly. It is a solid encryption program that has been independently audited. I can't emphasize that enough.

great choice !

Re: veracrypt and plausible deniability. Interesting issue. If charged with the task of proving that you are not hiding anything on a computer (upon pain of death or torture), I'd have thought that whether or not you have a veracrypt container or not is just the tip of the iceberg.

How do you go about 'proof of non-concealment'? Seems like an almost impossible task. It's kind of the opposite of plausible deniability. 'You can't prove I'm hiding something' vs 'I can prove I'm not hiding something'.

"They do suggest that, If we are sure only one hidden volume Can exist in each instance, then always create that volume so you can submit the key to prove it." - this does seem to solve the issue for Veracrypt though. But what about all those other places on your computer / phone / cloud etc...?

LinnitXa wrote: Mon May 24, 2021 8:44 am I did consider Veracrypt, for reasons of privacy really, but was put off by the issue of hidden volumes, and the dangers outlined in the following article. Bear in mind we may live presently in semi-democracies but will that last? I wouldn't bet on it.

https://proprivacy.com/privacy-service/ ... en-volumes

If society is forced into the dystopian picture that article paints then it won't matter which encryption software you use - you'll be deemed guilty just by having such software installed. Although I seem to recall Veracrypt under Windows offered a portable mode where you could install it onto a usb stick thereby leaving no trace on your system but that doesn't seem to be available on Linux.

That said, Veracrypt offers another level of plausible deniability you may have overlooked and that is to encrypt an entire drive:

'A possible plausible explanation for the existence of a partition/device containing solely random data is that you have wiped (securely erased) the content of the partition/device using one of the tools that erase data by overwriting it with random data (in fact, VeraCrypt can be used to securely erase a partition/device too, by creating an empty encrypted partition/device-hosted volume within it).'

With this approach there'd be no issue with hidden volumes as you wouldn't be working with containers. So to anyone but yourself it is simply a drive that has been securely erased. Then there's the added advantage of storing this external drive in a different location.

But then if your computer is targeted for forensic examination then presumably they''ll also have a search warrant and such a search would probably discover this drive. In which case you'd need a normal container or two somewhere on your system to justify the presence of Veracrypt as you'd likely be accused of encrypting the drive, that is assuming there's no way to hide the fact Veracrypt is installed, which I don't think there is on Linux. Then it'd be advisable to have a dedicated data erase program like Dban so you can say you used that to do the secure erase. I'd say their forensic capabilities would have to pretty good to determine which was actually used. That is assuming the data erase program wrote random data like Veracrypt does, as opposed to all zeros for example.

Then again if things get that bad then just having data erase software would probably be almost as incriminating as having encryption software. It could be a real can of worms.

All this depends on what your threat model is, who you're trying to protect your data from, doesn't it? Do you merely want to keep personal data safe from possible identity thieves or blackmailers? Are you worried (for good cause) about the Secret Police knocking your door down at 3AM to take you away? Those are roughly the two extremes. Of course the OP could be just experimenting with encryption to learn about it, and not even have a potential security threat.

JayM wrote: Wed May 26, 2021 5:12 am All this depends on what your threat model is, who you're trying to protect your data from, doesn't it?

Yes that's a valid point. But I was actually addressing LinnitXa's post and in the scenario presented there (if that ever comes about) it seems to me one would be better off with Veracrypt, as long as it was used with drives and not containers.

Have a nice pinoy day.