Excel file becomes unencrypted

dmartin

I can reproduce this every time .... have an Excel file in Dropbox (encrypted by Boxcyrptor). Open the file with Excel and save it. The file is now UNENCRYPTED. Not good security!

Other encrypted files in the directory are ok.

A second Excel file behaves exactly the same (wrong) way.

Any ideas?

Robert

Hi,

This is how Excel (and Boxcryptor) works. If you modify a file in Excel and save it, Excel is not overwriting the existing file. Instead, Excel is creating a completely new file and deleting the old one.

If a file is created in a plaintext folder, it is not encrypted by Boxcryptor. Only new files in an encrypted folder are also encrypted automatically. So I assume that the encrypted Excel file is located in a plaintext folder.

The solution is pretty simple: Move the Excel file to an encrypted folder.

Best regards,
Robert

dmartin

OK. Well, I find different results to what you say. And if this is the way Boxcryptor works, it needs to be improved, before users start to sue because their files become unencrypted (unprotected) without them realising.

What I find is:

Boxcryptor documentation does not clearly say that folders need to be encrypted.
Users are going to be very surprised to find that data files saved with the same name can become unencrypted.
When using encrypted files in a non-encrypted folder, some programs seem to behave well and their files DO remain encrypted after use. I have a TXT file editor which preserves the encryption, and Lotus 123 also preserves encryption of a spreadsheet. Those are just 2 examples.
Excel (2007) does NOT behave well [as you have described] and encryption is not preserved. I also find that MS Word and Lotus Wordpro also do NOT preserve the encryption on any file which they open.

The fact that different programs can behave differently like that is a fact that should be explained clearly in Boxcryptor documentation. In fact I am not even convinced that 'explaining' is enough, because the behaviour is SO UNEXPECTED. You might need to take action to ensure the folder is made encrypted whenever any file in the folder is made encrypted. It seems to me that this may be the only way to plug this hole.

So ... I then tried to do as you suggested and to encrypt the folder. The folder contaned about 10 files, some encrypted, some not encrypted. I right clicked on the folder name and selected 'encrypt'. This does not work ... various error messages and eventually hangs. I have to press 'cancel' and a few minutes later it ends.

So I guessed that Boxcryptor cannot handle folder files which are already encrypted, so I decrypted all the files, and then I encrypted the folder. Success.

That is a major bug.

I tested the files in the encrypted folder and there are no longer any decryption problems with Excel, Word, etc.

Please note that my attempt to encrypt the folder when it contained a mix of files (encrypted and unencrypted) damaged some of those files. Fortunately my files were only copies for testing.

Looks like some major work required.