Sending REALLY sensitive information

[ionux]

Obligatory: http://xkcd.com/538/

[1715415448]

1715415448

[1715415448]

1715415448

[SgtSpike]

Reviving this thread...

I got to thinking about it more, and most of these solutions rely on the machine in question being online at some point in time.

Bitmessage requires a connection to send out (Unless there is a way to create a transaction on an offline computer, then transfer the tx to an online computer to be broadcast? That would be awesome!)

GPG mail seems to require an online connection as well (connect to your email host).  I wish there was an easy method to use someone's PGP key and encrypt a message offline, but the only solution I can find for that is via command line.  It's an option, I suppose, but I don't like it much.

OTR IM Chat/Tor Chat - obviously requires the machine to be online.

readthenburn - again, obviously requires the machine to be online.

.RAR - seems like it would work offline?  I took a look at some .rar password crackers, and even a 10-char address said it would take "too long" to crack.  Would it be reasonable to expect the .rar encryption to hold with a sufficient length password (say, 20 chars?), at least until quantum computing becomes a thing?  As long as the .rar and password were sent through different channels (email + bitmessage, for instance), it seems as though it'd be very difficult to crack.

Let's leave the MITM argument alone for the time being.

EDIT:  Just found a plethora of GUIs for GPG though - nice!  http://www.gnupg.org/related_software/frontends.en.html

[kokjo]

.RAR - seems like it would work offline?  I took a look at some .rar password crackers, and even a 10-char address said it would take "too long" to crack.  Would it be reasonable to expect the .rar encryption to hold with a sufficient length password (say, 20 chars?), at least until quantum computing becomes a thing?  As long as the .rar and password were sent through different channels (email + bitmessage, for instance), it seems as though it'd be very difficult to crack.

you do not want to to use a closed format for encryption.

gpg can be used to encrypt files too.

[SgtSpike]

.RAR - seems like it would work offline?  I took a look at some .rar password crackers, and even a 10-char address said it would take "too long" to crack.  Would it be reasonable to expect the .rar encryption to hold with a sufficient length password (say, 20 chars?), at least until quantum computing becomes a thing?  As long as the .rar and password were sent through different channels (email + bitmessage, for instance), it seems as though it'd be very difficult to crack.

you do not want to to use a closed format for encryption.

gpg can be used to encrypt files too.

Thanks, and good point.

I suppose the big difference I see between the two is that GPG requires a public key to encrypt with, whereas a .rar can be encrypted with anything of my choosing, provided I give the password to the party through an alternate channel.  Is there something .rar style that uses an open format?

[MysteryMiner]

Is there something .rar style that uses an open format?

7-zip can do that. 10-char password is not enough. I will go with 20+ random password.

Almost everything requires for computer to be online. Being online is all what the internet is all about. Next time search for possible ways to encrypt and send information when computer is both offline and turned off

[SgtSpike]

Is there something .rar style that uses an open format?

7-zip can do that. 10-char password is not enough. I will go with 20+ random password.

Almost everything requires for computer to be online. Being online is all what the internet is all about. Next time search for possible ways to encrypt and send information when computer is both offline and turned off

Thanks, I'll check out 7-zip.  And yes, I was thinking 20-char.  Maybe 25 or 30 char would be even safer, but that might be overkill.

I understand that almost everything requires for the computer to be online.  But I'd like multiple methods that do not involve putting the private information on a computer that could potentially be compromised unless that information is otherwise secured (i.e. encrypted).  It seems the only real way to do this is to encrypt the information on the offline machine prior to bring it to the online machine.  Or, potentially, physical delivery (via postal service).  I guess that gives me 3 options.  I am satisfied with these results then.  Thanks to all who have participated in this thread!

[kokjo]

.RAR - seems like it would work offline?  I took a look at some .rar password crackers, and even a 10-char address said it would take "too long" to crack.  Would it be reasonable to expect the .rar encryption to hold with a sufficient length password (say, 20 chars?), at least until quantum computing becomes a thing?  As long as the .rar and password were sent through different channels (email + bitmessage, for instance), it seems as though it'd be very difficult to crack.

you do not want to to use a closed format for encryption.

gpg can be used to encrypt files too.

Thanks, and good point.

I suppose the big difference I see between the two is that GPG requires a public key to encrypt with, whereas a .rar can be encrypted with anything of my choosing, provided I give the password to the party through an alternate channel.  Is there something .rar style that uses an open format?

gpg can do symmetric encryption only, if you ask it to.
see the "-c" switch in man gpg

[SgtSpike]

.RAR - seems like it would work offline?  I took a look at some .rar password crackers, and even a 10-char address said it would take "too long" to crack.  Would it be reasonable to expect the .rar encryption to hold with a sufficient length password (say, 20 chars?), at least until quantum computing becomes a thing?  As long as the .rar and password were sent through different channels (email + bitmessage, for instance), it seems as though it'd be very difficult to crack.

you do not want to to use a closed format for encryption.

gpg can be used to encrypt files too.

Thanks, and good point.

I suppose the big difference I see between the two is that GPG requires a public key to encrypt with, whereas a .rar can be encrypted with anything of my choosing, provided I give the password to the party through an alternate channel.  Is there something .rar style that uses an open format?

gpg can do symmetric encryption only, if you ask it to.
see the "-c" switch in man gpg

Oh, that's good to know!  I am looking for GUI options, but perhaps one of the GUI's available for general GPG encryption would also support symmetric encryption.  Thanks!