in reply to Adding a password to Zip compression ?

Hi b10m,

This has "recently" been discussed in Password Protected Zip files and Archive::ZIP. Unfortunately, you have to rely on some system call.

Okay, thanks, I've had a look at that, and can see how to do it. But now after checking out the "man" for using the "zip" utility here , I'm starting to have second throughts about sending the (sensitive) information via email, even though the file would be password protected. The "man" doc suggested that the encryption used in ZIP is "weak".

Maybe a better way of doing this, is to give the user a login (Apache/.htacess,etc) to a path, where he could view the information. Or use PGP to encrypt the file before emailing it ?

There is also a HTTPS connection available, if I combined that with the (.htacess) login, would that be a better alternative ?

Peter

  • Comment on Re: Adding a password to Zip compression ?

Replies are listed 'Best First'.
Re: Re: Adding a password to Zip compression ?
by exussum0 (Vicar) on Jan 04, 2004 at 05:17 UTC
    Do NOT rely on the zip format for encryption purposes. More proof from the writers of gzip and also in the great crypto book, "Applied Cryptography", it is easy to crack. You are right to use PGP or a proven cryptography package like openssl with a good cryptographic algorithm, like DES3.

    Play that funky music white boy..
[reply]
Re: Adding a password to Zip compression ?
by b10m (Vicar) on Jan 04, 2004 at 08:50 UTC

    Ah, sensitive data. Nope, as sporty said, don't use the zip password thingy!

    You entered a realm of hassle now :) Sending out an e-mail with user/pass combo for a .htaccess protected site doesn't do much good either. The mail can be sniffed on it's way to the user, or the user's mailbox can be read by others (how many people do "lock" their screens when AFK?). The same argument is of course valid with the SSL connection. How does the user get his/her username/password? If you have the option of handing it over in person, go for that, otherwise: good luck :)

    I would opt for GPG/PGP encryption (although I dislike the idea of sending files over SMTP, but that's just my personal believe). A lot of Windows users seem to see PGP/GPG as a burden though, but I even convinced my mom to use it, so I bet everyone can be convinced after some (long) discussions :)

    --
    b10m
[reply]
      Hi,

      What are my alternatives to use email/PGP ?

      The user needs to see this (sensitive) information, and already has an user/pass for .htaccess paths. I _think_ using .htaccess login though, even though the password is encrypted at 'root' level, sends the username/pwd across the internet as plain text, just like FTP. :(

      I guess I could setup another path/directory, and the user _has_ to use the SSL connection, plus a .htaccess login. Would that make the viewing of the information 'secure' ?

      Sorry this is a bit OT for Perl now, but considering what people have stated, using a zip password is not secure, using PGP/email may be difficult as I haven't used it before, and this user is not very computer literate at all.

      Peter

[reply]
        I guess I could setup another path/directory, and the user _has_ to use the SSL connection, plus a .htaccess login. Would that make the viewing of the information 'secure' ?

        I always understood that all SSL connections are encrypted including the sending/receiving of logins and passwords. It will be as secure as SSL.

        CountZero

        "If you have four groups working on a compiler, you'll get a 4-pass compiler." - Conway's Law

[reply]
        check this Invisible Proxy. Sourceforge also has some encrypted IMs projects.
[reply]
        Just as an aside... If you *did* use pgp, and just not send the mail, you could simply have an open web server (no ssl/.htascess required), allow people to download the file, and since it's protected using pgp, it would be 'hard' to see the file contents...


        ----
        Zak
[reply]
      Excuse me for butting in here, I've been out of the loop for a while on PGP. Didn't the U. professor sell PGP to someone (Netscape I think?) and there was a lot of concern about PGP being patented and no longer being secure anymore? The news broke out right about when my life took a turn for the worse and I didn't have the time then to track the PGP news.

      When you refer to GPG, I guess you're meaning the project at gnupg.com? I would guess so since a search turns up the gnupg.com site at the top, but they don't seem to refer to themselves as GPG.

      ----
      Thanks for your patience.
      Prove your knowledge @ HLPD

[reply]

        AFAIK, the PGP(.com) program is indeed commercial and they have patented their "IDEA". I also heard that the FBI (or whatever three-letter US department) tried to persuade the company to build in a backdoor, which PGP claims not to have done.

        With GPG I indeed mean GnuPG, the Open Source variant of PGP (and based on OpenPGP). And their website is (how original) http://www.gnupg.org/. On that site, they say:

        GnuPG is a complete and free replacement for PGP. Because it does not use the patented IDEA algorithm, it can be used without any restrictions. GnuPG is a RFC2440 (OpenPGP) compliant application.
        --
        b10m
[reply]

In Section Seekers of Perl Wisdom