search

HACKERALERT / Picocrypt

A very small, very simple, yet very secure encryption tool.
GNU General Public License v3.0
2.44k stars 147 forks source link

If I drag and Drop a folder with name, make the encrypt file have the same name #124

Closed OGWarrior closed 2 years ago

OGWarrior commented 2 years ago

I think would be awesome if I drag and drop a folder to encrypt, the encrypt file keeps the same name as folder instead of "encrypt".zip.pcv. I also noticed you cannot copy and paste text when changing the name of the encrypt folder when encrypting.

MacOs - Monterey

HACKERALERT commented 2 years ago

That is possible, but a potential issue is if you encrypt the folder, decrypt the volume, and decompress, you could accidentally overwrite files in the folder you just encrypted. Since Picocrypt makes sure to be as footgun-free as possible, I think having Encrypted.zip.pcv is good enough. There aren't as many edge cases when a fixed name is used. You can always just change the output name and path before hitting Encrypt or rename it after encrypting, right? Also, I don't really want to change the code much now as it's already very stable and I'm trying not to fix anything that isn't broken. Thanks for the suggestion, though :)

Also, do you mind letting me know your system specs? So do you have a Mac Mini or a MacBook, is it Intel or M1/M2, etc.? Apple is a very closed ecosystem so I rarely get the chance to ask these questions.

OGWarrior commented 2 years ago

Make sense. Intel Macbook

I have another idea that maybe you can consider, but maybe can be..."extreme". If the encrypted file have a keyfile and I do not place a keyfile (ex: because I forgot), shows a message that says: "make sure your password is right / include keyfile" or similar message. The idea is to not let know, if I'm not the one who is decrypting, that there is a keyfile. It's better if the person thinks the password is incorrect.

HACKERALERT commented 2 years ago

Yes, that's also been requested before.

When using keyfiles, a flag is set within the volume. So even if Picocrypt doesn't explicity show that keyfiles are being used, one can just read the flag from inside the volume to see if keyfiles are being used or not. So you can look at this as a design "limitation", although I would consider it more of a feature since Picocrypt is generally targeted to the general public as opposed to power users. For the average user, it makes more sense to tell them if their password is correct and if their keyfiles are correct separately so as to not confuse them. So yeah, I know some tools can do this, but just keep in mind that "security through obscurity" isn't the best form of security. You can run, but you can't hide :)

If you choose a good password, your volume is secure regardless of how the keyfiles are configured. If one of your keyfiles is securely stored, your volume is secure regardless of your password or other keyfiles.

HACKERALERT commented 2 years ago

I'll close this for now. Feel free to reopen if needed!