Discussion on:

Review: Sophos Free Encryption

Do you encrypt sensitive files on a regular basis - what tools do you use for this?

I'm currently using Truecrypt for this purpose at home. Free and works on Windows, OS X and Linux which is nice because I use all three OSes (although whole disk encryption doesn't seem to work on OS X). For sensitive data I have encrypted volumes on my primary online storage that are left unmounted until needed, and do likewise with sensitive data stored on the cloud. My on- and off-site backups are on USB drives encrypted with full disk encryption.

I've been quite happy with Truecrypt, but Sophos looks interesting so I may have to check it out. Thanks for the article, first I've heard of it.

I use Truecrypt daily. I keep all my work docs in a large encrypted container. At home I use fully encrypted TC disks to store private stuff like taxes, my will, and other sensitive stuff. TC is also open source, so you can get the source and compile it yourself if you're really paranoid and want to check for backdoors. As frylock mentioned, there are versions for the major OSs, so I can access my stuff from my Windows game machine or my Linux server. What's not to like?

I'm glad to see other players enter this category though. Stir the pot and all that. Get some new ideas going hopefully. TC hasn't been updated in quite a while. That's not necessarily a bad thing because it is very stable, but users might feel it is abandonware after a while. It's not, but I know one of the things I look at when I'm evaluating OSS is the frequency and recency of updates. Come to think of it, I haven't checked the TC site in a while. Maybe there is an update.

Sophos Free Encryption does appear to offer good features for a 'free' product, with a trusted security company as the developer.

However:

* you need to register with Sophos to obtain it
* it's Windows-only
* expect the source code to be proprietary / closed, with all that entails on the encryption/security of the product
* availability of the program could be dropped by Sophos at any time.

7-Zip has the important advantages of being cross-platform between Windows and Linux (most desktop distros, as p7zip), is available from several sources, has useful file support, and is open source to review security effectiveness.

Another cross-platform alternative is zip files encrypted with GNUPG, although GNUPG is quite a heavyweight app on Windows compared to 7-Zip. (Don't use standard zip encryption (PKZip) though - that's really weak).

Encrypting only on a file by file basis or only part of the disk is vulnerable to data leaking to swap, temp files, or other unencrypted areas. When encrypting a disk, encrypt the entire thing.

When sending files to other people, I use GPG and asymmetric cryptography. It simplifies the exchange of keys to a one time affair. Also simplifies sending files to multiple people.

I have some folders with large amounts of files that are too many to drag and drop. Can I drag and drop the folders?

Thanx
z