“passworded folders” app for mac os x - snakeoil


April 13th, 2008

The only reason I’m writing about this comes from the fact that the application caught my eye in the RSS stream from Apple’s downloads site. Just a friendly warning about the ’security’ of the application.

The application description goes to saying that it:

Allows you to create secure passworded folders with the greatest of ease. Make users and hide that game from your sister or brother, or if the computer is public, keep your files away from other users of that computer.

Secure? No. Passworded? Not really. Away from other users? Kind of.

The way it works, the application pops up a menu for you to create a user or to let you login as one. If you do login, it will pop-up a Finder window with the secret folder so that you can work with things inside of it, after which you simply close the Finder window and you are done.

Given user, the folder will be in /Users/<logged in user>/Desktop/.user/ Which means you can easily browse there without the need of an application, either through the Finder > Go to Folder menu or through the Terminal. That is, without being asked for a password or facing any kind of security barriers whatsoever.

So security is a serious misnomer here, hence my appreciation of the application being snakeoil. Sure, it’s free, so there isn’t much harm done, but the lack of transparency is really bad and misleading.

If you want security, make sparse, encrypted and passworded disk images (via Disk Utility or FreeDMG) or go heavy and grab TrueCrypt.

  • TwitThis
  • del.icio.us
  • StumbleUpon
  • Google
  • Technorati
  • YahooMyWeb
  • Live
  • Slashdot
  • Digg
  • Reddit
  • Facebook
  • Mixx

6 Comments

  • Have you see this encryption widget?

    http://murphymac.com/great-stuff/

    There’s a link to a post on command-line encryption there too.

  • Haven’t seen it so far, looks pretty cool.

    As far as CLI tools go, I’m more partial to pgp or gpg if I send stuff to others. Rarely, were I to require batch encryption, would I script something else, depending on what phase the moon is in.

    I like TrueCrypt’s on-the-fly encryption for my own secret projects, though I’m understanding PGP disk does something similar — though, again, TrueCrypt is free and cross-platform and open source.

  • I gotta try TrueCrypt! I’ve heard so many good things about it, some from your other posts :)

  • I haven’t tried TrueCrypt either, but I’m interested. I wish I had more friends capable of dealing with encrypted files. Unfortunately any extra steps are too much for the average user.

  • @Murphy Mac

    If you need to share files with friends securely, even back and forth, a sparse (growing) passworded DMG could do the trick. It saves having to teach them anything they don’t know already and as far as I know the compression/encryption is quite good.

    Of course, there may be problems with passworded/compressed DMGs on Windows and/or Linux.

  • [...] must be the longest title I have ever written. It also pretty much sums up the affair. Passworded Folders is now listed as Secret Folders on the Samuco website and goes for $7.50 per license. The only [...]


Post a Comment

Anything goes, as long as it is in English (proper, if possible). Try to keep the conversation civil, in the interest of Ideas.


«the way it is | home | twurling script for quicksilver»