Public-Key Cryptography, created in the 1970s, is a matched-pair encryption/decryption standard. Using this method, the sender and recipient share public encryption keys, thereby establishing a relationship of trust. After that occurs, files can be encrypted by one and decrypted by the other without using passwords. While Public-Key Cryptography can use a variety of levels of security, DropKey uses the 256-bit method, a well-established industry standard.
I talked to DropKey’s CEO Ian Schray, and what impresses me about the app is that it only takes one extra click to encrypt a file and send it in an email, than it does if you didn’t encrypt the file. I’ve tried file encryption software in the past and it was a real pain, but this looks really good.
Update: 5/8/2015 **This product is no longer available.**
256 bits is extremely small for a public key, most likely what he means is that they encrypt a symmetrical key of 256 bits with the public key and then encrypt the file with that. If the software does in fact use a 256 bit public key then don’t expect the data to remain secret.
With public key or asymmetrical encryption the sender and receiver don’t share keys either, that’s why it’s asymmetrical. They each have a key that is the mirror of the other and that’s why one can be made public.
Presumably the engineer’s didn’t have time to proof read the PR.
The question is (and their website doesn’t address this) is how are the recipients going to be able to decrypt? Do they have to have DropKey too? Is it PGP/GPG?
The site’s video demo addresses this.
I don’t think it is a PR issue, just tested it and this is not a secure product.
Thanks for the comment, Michael. Yes, the 256-bit comment refers to the symmetric key used in encrypting files with DropKey. In fact, a new symmetric key is generated with each file encryption action.
To be clear, we’re not using a 256-bit public key. DropKey uses a 2048-bit public key.
Also, you’re correct about key sharing. Only public keys are shared between users. The private keys are never to be shared.
Ian SchrayWellRedApps
Ronaldo, we’d be more than happy to look into and address your concerns. Can you email us at support [at] wellredapps.com ?
Ian Schray
WellRedApps
Ronaldo, we’d be more than happy to look into and address your concerns. Can you email us at support [at] wellredapps.com ?
Ian Schray
WellRedApps
For a security company they have made some pretty amateur mistakes. They are using the Sparkle framework which grabs the app feed over a non-SSL connection:
http://www.wellredapps.com/sparkle/dropkey.xml
It is not verifying the authenticity of the updated files, the fact this app runs with root access, this should scare the crap out anyone serious about security. Pair that with running on a crappy shared web host like 1&1, just seems pretty sloppy for a security product.
Hello Mac Static. Thank you for voicing your concerns, it’s feedback like this that helps us make a better app.
I would like to address a couple of your concerns here. While we are currently not using SSL for our Sparkle update feed, all updates contain a cryptographic signature so that DropKey can verify that the update came from us.
We use provided APIs that are all sandbox compliant. In order to maintain that sandbox compliance, DropKey does not run as root.
You are correct that shared hosting can sometimes be a concern. However, all of the DropKey executable files are hosted elsewhere (on Amazon’s S3) which is considered safe. If you are worried about the authenticity of the DropKey app download, here are the MD5 and SHA1 checksums:
MD5: e42993c5725baa4d9bf0e543d1b8fc0b
SHA1: 3a100b522e1785c01c8b9f8d7723ac8c08d5070b
I hope this has helped alleviate some of your concerns, but if you have any further questions feel free to contact us at support[at]wellredapps.com
Logan Holmes
Developer at WellRedApps
(Sorry for the delay in addressing this. Our original response was lost in the ether…)
Hello Mac Static. Thank you for voicing your concerns. It is feedback like yours that helps make DropKey a better product. I would like address some of these concerns here.While we are not using SSL on our Sparkle update feed, every update contains a cryptographic signature so that DropKey can verify that the update came from us. If any update comes through that does not have a valid signature DropKey will not use that update. This method of updates is one of the suggested (and generally accepted) ways to perform updates from the Sparkle manual, and does not require an SSL connection.Dropkey uses provided APIs all deemed safe by sandboxing standards. As part of being sandbox compliant DropKey does not in fact run as root.However, you are right about shared hosting sometimes being a concern. To address this, all DropKey downloadable executables are hosted separately (on Amazon’s S3) which is typically considered safe. If you are concerned about the authenticity of DropKey’s download file, here are the MD5 and SHA1 checksums for it:MD5: e42993c5725baa4d9bf0e543d1b8fc0bSHA1: 3a100b522e1785c01c8b9f8d7723ac8c08d5070bI hope this has helped alleviate some of your concerns. If you have any further questions feel free to contact us at support [at] wellredapps.com
Ian Schray
WellRedApps