The Dropbox TrueCrypt Paranoia Corollary

Well, it's a week now since I started using TrueCrypt to encrypt all of my files on Dropbox, as detailed in my last post. And, I'm sad to say, after one week I'm ready to drop the encryption and go back to using Dropbox, um... unprotected. I've got a few reasons why:

TrueCrypt adds extra steps. I'm annoyingly fragile when it comes to getting into a writing frame of mind. Most anything can distract me at a critical juncture, be it a Corgi jumping in my lap for attention or that pile of laundry I forgot to pull out of the washing machine three hours ago. So having to find and mount a TrueCrypt volume before I can find and open the Word document I want to work on can actually stop me from opening that Word document. And I can't have that, now can I?

TrueCrypt nerfs Dropbox's versioning system. An obvious point I think I mentioned before, but as long as my files are in a TrueCrypt volume, Dropbox can't version them individually. For the most part, I haven't had to take advantage of this feature. Still, I've done enough development work with Subversion to know I damn well want it.

TrueCrypt slows down my syncing. I noticed this right from the get-go: with TrueCrypt, it takes Dropbox about a minute to two minutes to sync any update I make to the files in it. It's not enough to be unusable, but it's just enough to get annoying after awhile, especially if I just want to turn my computer off and go to bed after a save.

TrueCrypt actually makes me more paranoid. This is the biggie. I don't keep anything on Dropbox I would mind people looking at. Mostly it's backup copies of eBooks, evidence of CISSP CPEs I've earned, and my manuscripts. Now, it's conceivable that Dropbox is going to steal all of my shit and do nefarious things with it, but I can't imagine what. The same goes for any random hacker who breaks into my account. At worst, I'd expect to get hit with some jerk deleting everything in my Dropbox, which is why I keep offline backups.

Now, with TrueCrypt, I get the added fear that my encrypted volume might get corrupted, either from bouncing it between operating systems or by forgetting to sync updates to the volume in the correct order and having Dropbox introduce a mess of file errors. I've made that kind of screw-up before, and I don't want to do it again and have it blow away all of my files.

So, no more TrueCrypt, at least not with Dropbox. I may go back to using it to encrypt some things down the line - an In-Case-Of-Emergency file, for example - but right now it's worth more to me to have an easy time using Dropbox.

I'd go into the annoying filename quirks I ran into when I copied everything out of my TrueCrypt0 volume, but the Corg0i just jum1ped int0o my lap and star1ted1 licking my keyboard. Stop that Lina!

The Dropbox TrueCrypt Paranoia Conundrum

I've been using Dropbox for months now to back up my important files to the Mystical Cloud that drifts through the Internet. Aside from one minor wrinkle of a file conflict (which I easily resolved), it's done sterling service. My files are backed up across multiple computers and their associated backup hard drives, not to mention the Dropbox servers themselves. Losing my work in a catastrophic incident should, theoretically, be impossible.*

But over the last couple of weeks Dropbox has gotten some bad press. Aside from the security breach (see "bad"), none of this is really a surprise; if you put your data on somebody else's computer, they are going to have to protect themselves legally in some fashion. And because copyright law is a hydra with infinite heads and a bad attitude, even an innocent company is going to look bad trying to comply with it.

That said...

The security breach did bother the heck out of me. I don't know of anyone who'd want to look at my files with malice in their heart, but I also didn't know anyone who'd want to run up a $300 bill on my Amazon account. Shit happens. And while all of my files are perfectly innocent**, I still feel less than clean knowing that someone could be looking at them right now with their filthy eyes...

Enter TrueCrypt. My files are now wrapped in one big, ambiguous blob of encrypted data, one that no one is liable to crack open in the next decade without the correct password. So I am, relatively speaking, secure.

But can I still be productive?

TrueCrypt bundles your data into what is effectively an encrypted hard drive. With the right password, you can mount it and edit everything on it just like any other filesystem. So what's in my Dropbox account now is one big file that is 1.99GB in size. There are some issues with this:

Syncing. The initial upload of this file took a good three hours. Fortunately Dropbox does bitwise syncing, so it only needs to resync the bits of the file that change during an edit. I opened up a Word document and added some text, and Dropbox updated it in about a minute.

Syncing again. The encryption works fine if I only edit the file on one computer at a time. Since that's what I do anyway, this is no big deal. But if I forget and let my systems get out of sync, I'm going to wind up with a 4GB conflict that could potentially corrupt my data. So be careful with those edits, m'kay?

Nerfed features. Dropbox allows you to access your files from the web, but not if they're in one big encrypted blob. Ditto for sharing files with other people, or versioning them. Happily I'm not using these features anyway and don't plan to start.

So this isn't a perfect solution. Still, I think it's a happy balance between ease-of-use and security, which is all I can ask for.

And if it turns out to be more annoying than I bargained for, I'll store my files in my data dog instead.

*This is tempting fate. I'm certain some alien intelligence with a global-scale EMP generator is reading this and giggling.

**Pay no mind to that donkey in the corner.