Does "Boxcryptor out of business scenario" apply to BoxCryptor sale to Dropbox?

kwab50

Hello,

I'm a little unclear about Boxcryptor's abilities to work offline without access to BoxCryptor servers.

Long before Boxcryptor was sold to DropBox, the BoxCryptor FAQ had a scenario asking what would happen if BoxCryptor went out of business. The answer explained how we could continue to use the service as long as our keys were on our devices, even if we weren't using a local account. It was documented that even without local accounts, all devices already have a copy of the keys.

FAQ explaining BoxCryptor "Out of Business" scenario
https://support.boxcryptor.com/en/help/faq-and-troubleshooting/portable/#what-if-boxcryptor-goes-out-of-business

It seems to me that the sale of BoxCryptor to DropBox and termination of Boxcryptor accounts at the end of the contractual period is the equivalent of the "Boxcryptor servers not being available" scenario presented in the FAQ above. If so, shouldnt we be able to continue to encrypt/decrypt our files to our cloud provider using the BoxCryptor application even if our accounts have been terminated, expecially since BoxCryptor was designed to keep working even if servers were unavailable?

However, at this FAQ link below, under the section "What Happens When the Cancellation Period Is Over?", it is implied that when the cancellation period is over, all devices will be disconnected and we will no longer be able to access our data or use the service. As a result, we're urged to decrypt our data before the termination date.

FAQ explaining what happens at end of cancellation period
https://www.boxcryptor.com/en/blog/post/boxcryptor-and-dropbox-user-info/

Essentially, my question is: Shouldn't BoxCryptor continue to work on our existing devices at the end of the cancellation period even after our accounts have been deleted?

Mattis

kwab50 Hey! Boxcryptor should continue to work after the account termination, when you meet the requirement to export your keys first. However, I would not recommend to go forward with Boxcryptor after the service became terminated, because it's unlikely that you get any updates for new operating systems. The lack of updates for future operating systems is likely to cause problems with compatiblity. Did you already take a look at Cryptomator? 😀

kwab50

Do I need to explicitly export the keys and reconfigure BoxCryptor app for local mode to keep it running? I thought the keys were already on my device, even when not in local mode.

Mattis

kwab50 Yes, you have to reconfigure the Boxcryptor client for local mode. You’re right, that your keys are already on your device, but these keys will be wiped, when your account becomes terminated. It’s absolutely necessary to export your key from Boxcryptor.com.

The reason for this behavior is the function to disconnect devices through your account panel. Just imagine you lost your phone and something is able to get in. When you had Boxcryptor installed on that phone, a bad guy might be able to view or access your files in the cloud, because you’re signed into Boxcryptor. To prevent the bad guy from accessing your data, you can remotely disconnect your phone from your Boxcryptor account. In this case, the phone will wipe your Boxcryptor keys when your phone gets an internet connection. The same thing will happen, when you or Boxcryptor deletes your account. The app will recognize the termination of your Boxcryptor account as a command, that you want to disconnect all your devices, which will cause the deletion of your keys.

Happy to help! 😃

Personally I would no longer stick with Boxcryptor and migrate to another solution.

kwab50

Thank you so much for the clear explanation. I will work on migrating off BoxCryptor.

Mattis

kwab50 You’re very welcome. 😃