Keyfile.bcx to box.com is unencrypted?

jn1167

I want to know if this is right.

Keyfile.bcx is sent to box.com unencrypted? How safe does that make my files? Is this the only way that we can use Boxcryptor with Box.com on windows?

Also, is this a box.com problem or is this something you have to do for the cloud services like dropbox, skydrive and gdrive?

Thanks..

David R.

Hey!

If you open your keyfile with an text editor, you'll see that the sensitive information is encrypted. We generate a key from your password (via the pbkdf2 function) and this key encrypts the key used for encrypting the files.

Best regards,
David

jn1167

David,

Thanks for the super fast reply.

Also, is this a box.com problem or is this something you have to do for the cloud services like dropbox, skydrive and gdrive?

Thanks :)

Robert

Every BoxCryptor Folder contains a configuration/key file. By default this is named ".encfs6.xml" but as Box Sync does not like files beginning with a dot very much, the name of this file is "Keyfile.bcx" when the BoxCryptor Folder is located within the Box Folder. So yes, also when using other services such a file (with a different name) exists and is sent to the cloud.

But as David pointed out, the important parts of this file are encrypted with your password - so anybody with physical access to this file still needs to know your password.

We also have some information in our Knowledge Base:
https://boxcryptor.desk.com/customer/portal/articles/565947

Best,
Robert

jn1167

If thats the problem why dont you guys fix that in the software so that boxcryptot creates the keyfile instead of us having to go in and change it ourselves?

Anyway, thanks for the info. You've both been very helpful.

abc200

Apologies for reviving an old post, but which sections of the file are encrypted? I am seeing the unencrypted Keyfile.bcx file in my Google Drive using Boxcryptor classic. When I open it, I simply see an XML file. Is there a way to verify that I'm not providing an unencrypted key file to my Google Drive?

Robert

Hi,

The encrypted section is "encodedKeyData". This is the actual encryption key encrypted itself with a key derived from your password and then encoded with Base64 (so that the result is plain text). Everything else is (as you see) plain text.

Best regards,
Robert

abc200

Thanks for the quick reply, Robert!