Need to send large files over the Internet in a secure manner? If so, you’re best advised to use a file sharing service that supports end-to-end encryption. FileSender offers this form of security, assuring nobody but your intended recipient gets to see them. After all, you’re not just trying to keep your files out of the hands of outright evildoers; even an accidental slipup that lands your files in the hands of the competition or (in the case of sensitive files) the press can be a hair-raising incident.
On the Internet there are many services, lots of them free-to-use, that facilitate the exchange of files, large and small. The basic principle of these services is the same everywhere: the user uploads the files to a server and the recipient again downloads these files from the same server. Many of these platforms aim for the simplest, glitziest service delivery, and in doing so often forego a security mindset. In many cases, it suffices to know the download URL; anybody who’s gained hold of that can download the files. In those, less common cases, where a password can be set to thwart the previous scenario, those passwords are typically stored on the service’s server, bluntly as that.
Sending passwords securely
Sending files in a secure manner is essential, and shortcuts won’t do. Rest assured, Filesender has you covered. FileSender was built with a security mindset from the get-go. It offers full end-to-end encryption when sending files. Encryption of the data takes place entirely inside the browser of the person who wants to send the files; the server sees neither the password used nor the plaintext as it is turned into encrypted format. Filesender was always able to encrypt large files, but as of the latest version of FileSender we can even claim to let users to encrypt files of essentially unlimited size. The maximum file size of the file to be encrypted is ultimately determined only by the user’s device: browser, disk, operating system. Once the file is encrypted locally, the encrypted data is sent to FileSender’s server. If a recipient turns up, the server will let them download the encrypted data, and it is again inside the recipient’s browser that decryption happens – provided, of course, they have the required password.
Of course, sender and recipient need to agree on a password; and it is vitally important to exchange this password in a secure manner. By way of example, it’s not a great idea to send the password via plain email; that’s just a little too easy to intercept for properly sensitive data purposes. A better idea is to exchange passwords via WhatsApp, Signal or Telegram, or any other instant messaging app that itself offers end-to-end encryption. That way, you’re very reasonably assured no unauthorized people will get their hands on the password.
Why, you might ask, do we insist on encrypting in the browser – don’t we trust our own filesender? The reason is by avoiding the need for the FileSender server itself to store passwords, an attack on the server is rendered pointless. Even if such an attack might succeed, a hacker will then gain access to nothing but encrypted files, which are unusable without the correct password.
What is a good password?
It’s true for all encryption and for FileSender just as well; the security of end-to-end encryption stands or falls with the strength of the password used. If, say, you were to use the recipients’ name as a password, no technical encryption magic is going to save you. To this end, FileSender contains a feature that will autogenerate strong passwords for you. If you decide not to use these, there’s still a simple rule of thumb on password strength:
- There’s no substitute for length – better to add many new characters than to try and use fewer but unusual ones (!$#*! doesn’t add much in terms of randomness)
- Compensate for the unavoidable weakness of human-generated passwords by using a new one for each batch of properly sensitive files you send. That at least prevents multiple batches from being read if a single password is revealed.
- In general, the following applies to passwords: the longer, the better. It is better to think of a (long) sentence that you can use as a password, which is easy to remember as well. When entering this sentence, you obviously leave out the spaces.
Want to know more about the possibilities of FileSender? Read all about FileSender on https://filesender.org/software/ and download the software for free.
