The print-to-PDF feature in OS X is convenient for quickly preserving a document's layout in the PDF format, so it can be viewed on most computers and tablets. If you would like to send someone a formatted document that contains sensitive information, you may want to add the step of protecting it with a password.
To do this, you can use a container format such as a ZIP file or an encrypted disk image (using the Disk Utility program in OS X); however, these may be a bit cumbersome to manage, both for the sender and recipient.
An alternative is to send the PDF as an encrypted PDF file with a password that must be entered by the recipient before the PDF can be read.
There isn't a specific option to print a document to an encrypted PDF format in OS X, but the procedure is simple enough:
Use the PDF menu in the print dialog box and choose "Open PDF in Preview."
Press Command-S to save the PDF.
In the save dialog box, click the "Encrypt" check box and provide a password for the PDF, and then save it to your desktop (or similar location).
Now click the Sharing toolbar button in preview and choose the Email option.
This action will create the encrypted PDF and offers a relatively easy way to attach it to a new e-mail message. However, if you use this feature regularly then you may want a slightly more streamlined approach.
Luckily, OS X supports an option for custom print plug-in workflows that you can use to encrypt a PDF directly from the PDF menu in the print dialog window. To do this, open the Automator program (in the Applications folder) and follow these steps:
When creating the workflow, for the encryption action be sure to check the option to show the action's input when the workflow runs (click for larger view).
Create a new workflow.
Select "Print Plugin" as the type of workflow to create.
Locate the "Encrypt PDF Documents" action and drag it to the workflow area.
Click the Options button for this action and check the option to "Show this action when the workflow runs."
Locate the "New Mail Message" action and drag it to the workflow, below the encryption action (you can optionally use the "Add Attachments to Front Message" action, or have this in a separate workflow altogether).
Save the workflow with a name like "Mail Encrypted PDF" and you should be good to go. Now whenever you print a document you can choose this workflow from the PDF menu and after you supply the password to use, the system will generate the secured PDF document in a new e-mail message.
I’m smart, right? I’m technology-savvy. Hell, you might even call me an expert on some of this crap. But none of those descriptors seemed to matter when I dipped my toes into the murky pool of encryption
– the one and only technology that promises to keep out the NSA – or at least slow it down – besides, apparently, typewriters.
While many of you may claim to have nothing to hide, I actually did – well, I thought I did anyway. I am currently working on a story that involves passing along some potentially sensitive information with some pathologically privacy-minded individuals. Through the course of my reporting, one of my contacts requested that we communicate via encrypted email, using an encryption standard known as PGP, or Pretty Good Privacy. Great, I said. Let me just figure that out real quick and I’ll get right back to you.
Cryptography is necessarily complex – if it weren’t, it wouldn’t be secure.
The original PGP encryption software is now owned by Symantec, which has the audacity to charge money for its product. Lucky for me, a number of open-source options are available. Do a few Google searches, and you’ll find yourself at the home of Gnu Privacy Guard (GPG), which has released versions of OpenPGP software for both Microsoft Windows and Apple OS X machines.
As a Mac user, I opted for GPGTools. The download is straightforward. The creators were even kind enough to provide a handy tutorial for how to get started – one of the few PGP tutorials not written exclusively for computer geniuses with Asperger’s.
PGP basically works like this: A piece of software (in my case, GPGTools) generates two PGP encryption keys. One of these keys you keep private. The other, your “public key,” you share with whomever you want to send secret messages.
This sharing of keys is where things start to get overly complicated. Most people who use PGP upload their public key to a key exchange, which makes your key searchable (as long as the person doing the searching knows what you’ve named yourself on the the key exchange). Or you can share you public key some other secure way – snail mail, maybe? Carrier pigeon? Long-range ballistic missile? Maybe you could just meet up in the basement of some parking garage, Deep-Throat style. The possibilities here are virtually endless – and they all kind of suck.
To send your friend an encrypted email, you use his public key to encrypt the message. He then decrypts the message with his private key. For him to send you an encrypted message, he uses your public key to encrypt, and you decrypt with your private key. Are you still with me?
Or you can share you public key some other secure way – snail mail, maybe? Carrier pigeon? Long-range ballistic missile?
Well, it doesn’t matter because that’s about as far as I got. GPGTools seems to act as a kind of plugin for Apple’s Mail app. Which, from what I could decipher, enables a couple of buttons in Mail to now do, um, something that they didn’t before. But I still have yet to figure out how to successfully encrypt or decrypt an email using the software.
Now, there are some more user-friendly options out there. The Mailvelope plugin, for example, is actually a bit easier to use than GPGTools, but still comes with all the other complications inherent with PGP. Another option, SecureGmail, is a simple-as-pie browser plugin for Chrome or iOS. But it uses something called symmetric encryption (as opposed to PGP, which is a form of asymmetric encryption), and relies on you to come up with a quality password to protect your emails – something we all know ain’t gonna cut it – and then to share that password with your contacts in a way that makes the whole exercise futile.
None of my bickering is meant to dog on the clearly brilliant minds working to build these encryption tools. Cryptography is necessarily complex – if it weren’t, it wouldn’t be secure. But using it needn’t give you an aneurism. Fortunately for the rest of us, there are people currently working very hard to solve the usability problem, including the teams behind the plugins listed above, The Pirate Bay guys behind the new Heml.is app, and many others.
Until these developers get it right, most people just won’t go through the trouble of figuring this stuff out – especially since encrypting your communications can reportedly make you more of a target for the NSA. That’s not to say doing so is an impossible riddle or not worth the effort – strong encryption really is the best option we have. But the barrier to entry here is some “Game of Thrones”-level nonsense.
At the end of the day, my contact and I just decided to talk on the phone – what he had to tell me was far less sensitive than he first made it out to be. So, theoretically, anyone could have listened. I can only hope that I have this PGP thing figured out by the time I actually have something to hide.
Encrypt text documents before you upload them to Google Drive via Fogpad, or encrypt and transfer all your Google Drive files to the Tresorit cloud-storage service.
(Credit: Google)
This month marks the sixth anniversary of my Google Drive account. I've been aware since the beginning that the thousands of files I have uploaded to the service are stored unencrypted on Google's servers.
That hasn't prevented me from uploading plenty of sensitive information to Google Drive, including dozens of invoices that list my address and the amount of money I was billing for, although the invoices do not include any bank-account or Social Security numbers.
I could have easily encrypted the files using any number of free services. In last May's "Free services make Gmail, Google Drive, and Google search more private," I described the BoxCryptor program that adds an encrypted folder to Google Drive.
I recently discovered two free services that take different approaches to online encryption. With Fogpad, you create and edit text files via a basic online word processor. The files are encrypted on the client PC before being uploaded automatically to your Google Drive account.
By contrast, the Tresorit cloud-storage service lets you download some or all of your Google Drive files, then encrypt them in the Windows-based Tresorit program as they are uploaded to your Tresorit account in the cloud. Tresorit offers 5GB of free online storage, and the company plans to release versions of the program for Macs and iOS devices.
Fogpad is the simpler of the two methods, but it encrypts text files only and requires that you create the file on the Fogpad.net site. Tresorit lets you transmit an encrypted version of the files stored in a folder on your Windows PC to the company's servers.
Both services encrypt the files on the client side, so the companies themselves are unable to decrypt the files you store on their servers. That doesn't guarantee the security of the data, however.
Last week, CNET's Declan McCullagh explained revelations by the Foreign Intelligence Surveillance Court in proceedings relating to requests by Microsoft and Google to disclose details about their interactions with government agencies.
It would appear that if data exists anywhere on the Internet, the U.S. government may request access to it, although major Internet service providers insist they do not honor every data request a government agency makes. The rule remains: If it's really sensitive, it doesn't belong anywhere online.
Password-protect the text files you store on Google Drive When you click the big, red "Create a secure document" button on the main Fogpad page, you're prompted to sign into your Google account. The first time you do so, you're asked to grant the service access to your account.
The first time you create an encrypted Google Drive text file via Fogpad, you're prompted to grant the service access permission.
(Credit: Screenshot by Dennis O'Reilly/CNET)
You're then prompted to enter and confirm a password for the document.
Before you create an encrypted text file in Fogpad, you enter and confirm the file's password.
The text-editing options include the standard cut, copy, paste, find, replace, and format text. You can insert images, tables, lines, and special characters. Apply one of 15 formatting styles and 10 paragraph formats, including six levels of headings.
The Fogpad text-editing window provides basic formatting and content-creation options.
When you press the Back button you return to the main Google Drive window. The file name appears in the list, and the file type is labeled "undefined." No preview of the file appears when you select it.
Click Open > Fogpad and enter the file's password to open it in the Fogpad editor. In my testing, encrypted files wouldn't download, and when I shared a link to an encrypted file, the recipient was unable to open the file.
The Fogpad site's About page describes its 256-bit AES encryption as "military-grade cryptography" but offers no other details about the service's encryption methodology.
Transfer encrypted versions of your Google Drive files to another service Where Fogpad encrypts Google Drive files one at a time, the Tresorit service goes the one-fell-swoop route: all the files in the folder you select are encrypted as you sync them with Tresorit's servers, and you control the encryption key, rather than Tresorit or anyone else, according to the company. The Tresorit site's security page provides details on the service's client-side encryption technique.
As I noted above, the Tresorit client is currently available only for Windows, but the company plans to release versions for the Mac and iOS devices. Also, Tresorit doesn't encrypt the files on the PC's hard drive; it encrypts the files only as they are transmitted to the company's servers and gives users control of the encryption key.
To download all your Google Drive files to a single zipped folder, check the box in the top-left corner of the list and select More > Download. Alternatively, check only the files you want to encrypt and transfer to Tresorit, and then choose More > Download.
A window shows the progress of the file zipping and download. You can have Google send you an e-mail when the download is complete.
Download some or all of your Google Drive files to a single folder on your PC that you can encrypt and transfer to Tresorit's cloud storage service.
After you download and install the Tresorit program, open the app and choose New Tresor in the bottom-left corner of the window. Click Browse and navigate to the folder containing the files you just downloaded from Google Drive. Click the Select Folder button, change the name of the Tresor (if you wish), and click Next.
You can share the Tresor with someone else, but that person has to download and install the program on their Windows PC. You're prompted to enter the recipient's e-mail address and to send them an invitation. Click Finish to create the Tresor and encrypt the files as they sync with the Tresorit cloud servers.
Subsequent syncs are performed automatically, or you can click the Sync Now button. You can also choose the option to disconnect from the computer.
The main Tresorit window lists your encrypted folders and lets you open the folder in Windows Explorer, among other options.
The only settings available in the program let you sign out, uncheck the option to start Tresorit with Windows, and hide notifications (they're shown by default).
It took less than 30 minutes to download a 200MB Google Drive archive and upload it to a free Tresorit account. The files included Word documents, Excel spreadsheets, PowerPoint presentations, native Google files, text files, PDFs, and various image files.
When I tested Tresorit by sharing and synching folders between two PCs, some syncs took several minutes to complete while others were done in just a few seconds.
The files can be accessed only via the Tresorit program rather than through a browser. This restricts your ability to share files because the recipients have to download and install the Tresorit client. At least this limitation may prevent oversharing.
The page suggests you contact Tresorit for more information, but the only e-mail address I could find on the English-language version of the site was on the Careers page and was addressed to the HR department. A request for information placed on the company's support forum went unanswered. The lack of contact information is troubling, to say the least.Tresorit offers 5GB of free storage. The company's support page indicates more storage and features are available for monthly fees, but it doesn't describe the features or state what the rates are.
Apart from the inability to contact the company, Tresorit ran without a hitch when I tested the program on a Windows 7 PC and a Windows 8 laptop. I felt confident enough in the encrypted Google Drive archive on Tresorit to delete the sensitive files I had stored in Google Drive.
There isn't a specific option to print a document to an encrypted PDF format in OS X, but the procedure is simple enough:
