Serious Boxcryptor design issue / bug when Hibernating

GeorgeDorgan

Thanks for your great tool with reasonable pricing. I quickly registered and upgraded my plan.

However, I have a quite serious issue with Boxcryptor on my laptop.
On purpose I disabled the "Remember Password" functionality. My windows password is far easier to hack than the (20characters computer-generated) Boxcryptor pw; my sensitive data are stored via Boxcryptor (and sugar sync).
I typically do not shut down the notebook but I use hibernate. But after the hibernate, Windows correctly asks the password again, but Boxcryptor DOES NOT. This despite I disabled the "remember password" in Boxcryptor.

This means that in case of theft, my sensitive data are only secured with the Windows password and windows functionality. And my private data is there decrypted.

Robert

Hello George,

This is not a bug, but how Boxcryptor works. Boxcryptor only asks for the password when you start Boxcryptor. When your computer goes to hibernate (and resume), Boxcryptor is still running and thus you are not asked for a password.

I have noted your feature request and we might add an optional automatic logout when the computer is going to hibernate. Until then, you can exit Boxcryptor before going into hibernate (either manually or even automatically using taskkill and a small batch script).

Best regards,
Robert

GeorgeDorgan

Thanks, for a programmer it is always easy to say "it is not a bug but a feature".
But software is made for users not for programmers. For security reasons Boxcryptor MUST shut down when the computer goes into hibernate.

Anyway, thanks for considering this as a feature request.

Plerry

> For security reasons Boxcryptor MUST shut down when the computer goes into hibernate.

That fully depends on what you use BoxCryptor for.
If you use BoxCrytor for encrypting/decrypting data stored "in the Cloud", the present behaviour is perfectly OK.

If you (also) want to use BoxCrytor as a local disk encryption tool, it becomes another story. Then you should _not_ let BoxCryptor store its password, _not_ automatically remount any encrypted drives at startup, _dismount_ any encrypted drives when going into hybernation, and _even_ dismount when going into screensaver mode ...

But as, like I suppose many with me, I use BoxCryptor for en/decrypting data in the Cloud, I would deeply hate to need to enter my BoxCryptor password following every (re)start, screen-saver activation and hibernation.
In fact, it would be ground for me to stop using BoxCryptor ...

Robert

Hi George,

Boxcryptor has been built and optimized to secure your data in the cloud - not locally on your device. There exist other solution which serve the purpose of securing your data locally way better then Boxcryptor ever could (e.g. full disk encryption, features built-in the operating system, etc.).

Of course, it does not mean that we may not add features for additional local security (e.g. an option to change when the Boxcryptor drive gets unmounted) in the future - but the default will always stay as it is now.

Best regards,
Robert

james1601

I have to say I agree with George on this, I appreciate your argument Robert (and accept that you can't deliver everything all at once) but I think that Boxcryptor should be looking to firm up its security for locally stored files, after all most 'cloud' users sync their files locally and on laptop the 'off line' access need is obvious.

We use Boxcryptor for our small business and therefore have the advantage of the business features such as policy enforcement. This 'feature' of not requiring re-login on resume is the one element I am not happy with - the effectiveness and reliability of the rest of the service is such that we are running with this 'known risk' and we're small enough that training our staff to exit Boxcryptor manually is not an issue but I would love this feature to be present in the next major upgrade. Add my vote to the feature request.....

James.

snaphat

Boxcryptor is .net code so this should be fairly easy to implement by hooking the PowerModeChanged system event.

gje

Hi, i'm new to boxcryptor since a couple of days and exactly that automatic log off issue is the only missing option in my view, too.
I definitly want to combine the function on an secure drive which is synchronized with other devices via dropbox. One device i.e. will be the PC in the office and the second one the private windows 8.1 tablet. Especially the tablet should switch boxcryptor off in hibernate mode to be more secure!
Please, if possible, provide an option in the configuration settings and everyone can decide by himself between the more secure or more comfortable setup!
Thanks,
Gerd

minhestrone

It's imperative that Boxcryptor have this auto-logoff functionality.

OP wasn't arguing that it should be the default function, but just that there ought to be an option. Some of us don't have strong OS/drive protection. (My SSD read/write on my laptop takes a huge hit with Bitlocker activated.) For myself, if my local encryption were strong, I would have just had Boxcryptor remember my password and never have to type it in.

Please, keep the default setup but give us the option to automatically log off on hibernate/sleep.

pjmair

Yes I concur - it would be hugely beneficial to have an auto-logoff function. The local encryption is one of the key value propositions of BoxCryptor. I had a laptop stolen from my office that was powered on and left in my docking station... I would have slept better knowing that the local cloud copies of my sensitive files were encrypted and required password to access.

Provide an option such as:

Never auto-lock, auto-lock after x minutes, auto-lock when windows locks, etc.

hotzedejong

Please provide an auto logoff option for Boxcryptor. I do not start it automatically, only when needed. But I tend to forget to logoff, cause most services have an auto logoff option.

Richard Hess

Hi everyone,

this feature is on our road map.
Unfortunately I can neither name an exact date on this nor any further information about our developers priorities.

Thanks for your patience.

Kind regards,
Richard

snaphat

Having been part of this thread, I find it rather disingenuous and disappointing to hear you guys tell users this is on the roadmap after over a year. If it is on the roadmap, then implement it in a timely manner. It's not even programmatically difficult. If it's not on the roadmap then please don't tell us it is.

Robert

Hello snaphat,

As Richard said, this feature is on our roadmap but it is not scheduled for immediate implementation. Our roadmap includes all things we plan to implement at some time in the future - depending on available resources and priorities.

Best regards,
Robert

Power_User

Hi Robert/Richard,

Attn: Developers / Auto Sign Out

As soon as Auto Sign out triggers;

Step 1:
User is warned that, within 10 minutes boxcyptor will be signed out.
either user will Extend the session or save his/her files
Same behavior like Windows Auto update

Step 2:
Any open file MUST be saved by Boxcryptor
On Next Sign in, Boxcryptor MUST present both files
"Original file saved by user" & "File Recovered by Boxcryptor on forced sign out"
Same behavior as applied by Microsoft Excel etc.,

Thanks every one in team boxcryptor.
you are doing a marvelous job
Very warn wishes & good luck!!!

/Muhammad

hojo

Please provide an auto logoff function.
I use Boxcryptor via iCloud as a shared drive. Perfect, all my data at iCloud is encrypted!
I have a password on my Mac so no one can access without password.
But the shared drive is always mapped and available. I try to shutdown Boxcryptor when I leave my Mac, but most of the time I forget.... That's why there are auto logoff functions.
I fear ransomware. If I get an infection all my encrypted files at iCloud will be encrypted once more. And iCloud does not provide the possibility to revert to the previous version of a file.

I really don't understand why a (very good!) product like Boxcryptor does not provide an auto logoff function.

devarni

Auto logoff should be implemented shortly. It's not a big thing to add a timer callback function and add some options to a tab so the user can select some values (Never, 30min, 1h, custom values).
People using often this day's mobile devices like laptops. If a laptop is stolen you have a problem if Boxcryptor already "opened the doors" to the encrypted data. But also for desktop pcs in public locations or the office this can be a problem.

The hibernate stuff is IMO important too. If the device woke up, Boxcryptor should ask again for the password (of course, this could be an additional option in the settings "close BC on hibernate/sleeping") but this should be enabled by default (because it's the most secure option).

shsh

7 years after the feature has entered the roadmap, it is yet to be implemented... :-(