Security bug? Move .bc file around and....

amreina

...it opens with no password!
Have set up all as indicated (MacOS). *.bc file is in one folder. If double-click, then prompt to enter password )as expected) to access drive and my encrypted files.
BUT if move *.bc files to desktop and then back again, then can simply open *.bc file without prompt and password. How can that be?
The *.bc file should be possible to be opened only with the secure password, no matter how often and where I move it around, right? Otherwise what is the purpose of the whole thing?
Please confirm.
Regards

Robert

Hello,

This is how Boxcryptor works and not a bug. The .bc "file" is actually a bundle - a folder which appears as a file in Finder. After you entered the password, this the .bc folder is mounted to the virtual Boxcryptor Volume (/Volumes/Boxcryptor) and the path stored in Boxcryptor. When the .bc folder is mounted, no password is required to access the files until you exit Boxcryptor.

If Boxcryptor is running, the virtual Boxcryptor Volume stays mounted even if you move the underlying .bc folder - but you will receive errors when trying to access the Boxcryptor Volume because the underlying folder does not exist anymore on the stored path. As soon as you move the .bc folder back to its original location, you can access the Boxcryptor Volume again (because it's still mounted).

If you want to have to enter the password again, you have to either unmount the Boxcryptor Volume or exit Boxcryptor.

Best regards,
Robert

amreina

Hi Robert,
Thanks for the reply.
I have "unmounted" the volume by "ejecting" it (so it does not appear anymore in "Devices"). And still, I simply double-click on the .bc file and it "remounts" again with no password required.
That should not happen, or?
Cheers
Andreas

amreina

Hi Robert,
"Quitting Boxcryptor" does not change anything: Moving the "dismounted" .bc file across locations and the back to where it was allows to open it (= "mounting the device") with no password required. Doing that btw restarts automatically Boxcryptor too.
Am I missing something fundamental?
Was assuming that if you dismount/eject the encrypted volume, then all is safe...
Regards
Andreas

amreina

Hello,

To summarize:

(A) in iOS if you "unmount" the volume by "ejecting" it (so it does not appear anymore in "Devices") and then simply double-click on the .bc file, it "remounts" again with NO password required. That should not happen, as "when yu unmount it should be password-protected"

(B) if after "unmounting" (see (A)) you quit Boxcryptor, then nothing changes: Moving the "dismounted" .bc file across locations and the back to where it was allows to open it (= "mounting the device") with no password required. Doing that btw restarts automatically Boxcryptor too.

Bottom line, the password-security can easily be circumvented and the encryption is of no use.

Ragards

Robert

Hello amreina,

I assume the checkbox "Remember password" was enabled when you entered the password the first time. Of course, then no password is required when you re-mount the drive.

To clear an already remembered password, open the Boxcryptor Preferences (right-click on the Boxcryptor icon in the menu when it is running) and click the "Clear" button in the toolbar.

Best regards,
Robert