Protecting Your Privacy on Linux

Some times you need to protect your documents containing sensitive information from prying eyes. Simply enforcing access-control on a document (e.g. "chmod 600 foobar") is not enough in such cases as it can still be read by those with super-user access or with physical access to your storage media (e.g. when your laptop gets stolen or you misplace your backup media). It is also ineffective when you use on-line back-up solutions like SkyDrive, Google Docs or Dropbox. Fortunately Linux provides several tools to help you here depending on your needs.

(DISCLAIMER: I am not a cryptographer. Consult one if you need to be sure of the security of these methods.)

If you use the text-editor Vim, you can encrypt your files by invoking Vim with the "-x" command-line option (e.g. "vim -x diary.txt"). You can alternatively encrypt a file while editing it by typing ":X" in command-mode. Vim will ask you (twice) to enter a password that will be used to encrypt the file. When you open such an encrypted file for editing, Vim will prompt you to enter a password to unlock it. You can find more details about this feature here.

Note that the default encryption-method used by Vim is not very secure and can be broken by a determined person. With Vim 7.3, you have the option of choosing a stronger method based on the Blowfish cipher using ":set cryptmethod=1" in command-mode (or by setting it in your ".vimrc" file).

If you use OpenOffice.org, securing your document is as simple as choosing the "Save with password" option in the save dialogue-box. More details of the method used by OpenOffice.org to encrypt the document can be found here.

If you prefer a stronger method or if your documents have been created by an application that doesn't natively support encryption, you can use the "openssl" command-line tool. For example, to encrypt a file named "foo" using AES-256 and store the result in a file named "foo.enc", you can use:

  openssl enc -aes-256-cbc -e -salt -in foo -out foo.enc

To decrypt the encrypted file and store the result in a file named "bar", you can use:

  openssl enc -aes-256-cbc -d -in foo.enc -out bar

(Quick Tips: Compress your files before encrypting them; never omit a salt; do not use ECB. See also: "Everything You Need To Know About Cryptography in One Hour".)

You can alternatively use GNU Privacy Guard and mcrypt, but they are not significantly better than "openssl" for this purpose, except perhaps in usability. bcrypt and scrypt are stronger file-encryption tools, though the latter is relatively new and has not been vetted thoroughly by experts yet.

If you are paranoid, you can hide your sensitive information among innocuous data in such a way that a malicious person would not even know of its existence. This is known as steganography. For example, this image of The Milkmaid:

"The Milkmaid" by Johannes Vermeer

looks visually-indistinguishable from this image:

The Same Painting, Now With a Message

and yet the latter contains the complete (compressed and encrypted) text of the Declaration of the Rights of Man and of the Citizen. It was created using steghide like this:

  steghide embed -z 9 -e twofish cbc -ef rights.txt \
    -cf verm_mm.jpg -sf mmenc.jpg

The password is "leroiestmort" should you wish to extract the document like this:

  steghide extract -sf mmenc.jpg

"steghide" is a tool that works very well for its intended purpose. Other such tools include OutGuess and JPHIDE, though they require modifications to libjpeg unlike "steghide". Unfortunately "steghide" has not been under active development for over five years now and the other tools don't fare any better in this regard either. (Note that if you do intend to compile "steghide" yourself on a modern Linux system, you would need to apply a patch like this for the 0.5.1 release to be able to compile it.)

If you are even more paranoid, you can use TrueCrypt for encrypting a partition on a disc or for creating an encrypted virtual disc within a file. Alternatively you can use dm-crypt with LUKS on a modern Linux system to encrypt a partition on a disc. Markus Gattol has published "Full-disk Encryption" as a guide to implementing this option. You can use FreeOTFE to access such disc-partitions from Windows. Note that even with full-disc encryption, you still have to use the other tools when storing sensitive data on on-line backup sites or on unsupported off-line backup media.

Finally, after all is said and done, don't forget xkcd-538. ;-)

Update (2010-09-10): Pointed to dm-crypt/LUKS based on feedback from the corresponding reddit post.

Tweet