We tend to judge tech companies by how well they encrypt and handle our data,
and as well we should. But what about YOU? How well do you protect your own
data? Today I want to bring you through four levels of personal data encryption
that begins with steps that all of us should be taking but then ends with
some extreme but possibly useful forms of encryption you probably don’t know about.
Let’s start with the basics. Before you consider encrypting files in
the cloud or files that you send to other people, step one is to simply
protect the data you keep your physical devices, known as full disk encryption.
That way, if your laptop or phone gets stolen and somebody tries to direct access your hard drive,
they won’t be able to read any of the files without having your password to decrypt the data.
You may have already set this up without realizing it, but it’s worth checking again to be sure.
On a Mac computer, that means turning on FileVault,
which can be found in your system settings, Privacy and Security,
and then scroll down until you find FileVault. If you’re turning it on for the first time,
keep in mind that it might take a while to encrypt an entire hard drive.
On a Windows computer, open your settings, choose privacy & security
and then find Device encryption. And as with most anything Microsoft-related,
it’s entirely possible that your device or version of Windows doesn’t support device encryption,
so don’t complain to me in the comments if you can’t find this.
Thankfully, mobile devices nowadays encrypt your local data with your
PIN or biometrics, so my only advice here is to make sure that the code you
set on your iPhone or Android is at least 6 digits if not longer.
The next level of personal data encryption means protecting the stuff that you upload to the cloud.
Most people don’t realize that services like Google Drive and Dropbox aren’t end-to-end
encrypted. They’re encrypted, but they’re not end-to-end encrypted,
which means that, for instance, Google’s privacy policy states
that it can and does scan the data you upload for malware or illegal content.
For a personal account, Dropbox secures your data but keeps a key so that
they have emergency access if needed. End-to-end encryption means that you,
and only you, have access to the data you store elsewhere.
This is like renting a bank security safe where only you have the key and even though
the safe is located within the bank, the bank employees can’t open the safe if they
wanted to. You might have also heard of this referred to as zero-knowledge encryption.
Services like Proton Drive, NordLocker and Sync.com offer this kind of data encryption
and while this may not be as convenient as using Google or Apple cloud services,
it does offer stronger overall protection.
What I do, for example, is keep all of my tax documents and previous tax
returns safely stored in one of these standalone,
end-to-end encrypted cloud services. It isn’t stored on my laptop or in Google Drive,
and I never send these files via email. I only share access to the folder securely with my CPA.
My goal here is twofold. First, I think it’s valuable to keep a backup of important data
off of my laptop so that in the unfortunate event that I lose or break that device, I’m not screwed.
But second, I want to maintain the privacy of that data, even from the
company that is storing it. The only way to do that is via end-to-end encryption.
Now I hear what some of you may be saying - standalone services like Proton Drive are
great and all, but I’m too entrenched with Google Drive or iCloud to move.
I get that, so this third level of personal data protection is
going to focus on encryption solutions that integrate with what you’re already using.
One easy example of this is Apple’s Advanced Data Protection. If you’re an iCloud user,
I recommend you turn on Advanced Data Protection, which ensures that almost
all of the data you upload to Apple’s iCloud servers is fully encrypted. I’ve
done an entire video explainer on how to do this here that you can watch next.
But for most people I talk to, Google Drive and Dropbox are the places where you store
the majority of your digital life. Say what you will about their privacy practices, but it’s
hard to deny that they build great products that are super-easy to use.
There are numerous solutions here, but I’m going to focus on two of them here. The first is the
equivalent to storing a safe within a safe. So, for example, if you think of Google Drive
as a data safe where Google shares a key with you, double encryption means only uploading
encrypted files to that safe. So you’re taking a locked safe and storing it inside of a safe,
does that make sense? That way, even if somebody did break into Google servers or
a rouge employee accessed the folder, all they’ll find is useless encrypted data.
This is what Boxcryptor used to do before it was acquired by Dropbox,
and it’s what Cryptomator still does. The upside here is that Cryptomator is mostly
free and open source, with years of public use to prove its effectiveness. The only catch is
that if you want to upload data from your mobile device, you’ll have to pay for that.
The second solution here is a more granular control of Google Drive
via a service like OrangeDox. I’ve been playing around with this newer
service and the benefit here is the deeper level of control that I have
with sharing documents and keeping an audit train of who has opened what.
I feel like this is meant more for professionals or businesses
who are stuck working with Google Workspaces but absolutely need a
good way to sync and share documents across teams and client securely.
OrangeDox syncs directly with my Google Drive account and makes it
easy to simply click to create what they call a “data room”,
offering you more control over who can access the files in that room,
whether or not they can download or forward the files, and it keeps an audit log of their access.
That same control is ported over to Gmail,
where file attachments are given the same level of encryption and sharing protections.
The downsides here is that OrangeDox only works with Google Drive, not Dropbox,
and it’s not priced with the average consumer in mind. It’s definitely meant
for businesses and professionals, but if that’s you, it’s worth checking out.
More encryption? How is that even possible, you might be asking? Well
the final level of data encryption boils down to one thing: control.
What if I wanted to send you an example contract but encrypt the signature page?
What if I wanted to redact the information in a document before
sending it or hide a portion of an image before sharing it with somebody publicly?
This feels like government-level technology and there are a lot of technical enterprise
solutions available, but I’ve been testing it out using a service called Confidencial.io.
With Confidencial, it is possible to selectively choose which parts
of a file are encrypted, including entire pages of a document, one particular section
or even a specific word or phrase throughout the document.
So instead of going into Photoshop and trying to redact something, I now have the ability
to not only hide this information, but to also control who can then unlock the ability to see it.
Essentially, a solution like this is a best of all the previous levels combined. You’re getting
end-to-end encryption, the ability to store the files anywhere you want with confidence, and the
ability to control not just who can see the file, but also which parts of the file can be seen.
Nobody sponsored this video, but I have links to all of the services
mentioned in the description below in case you’re curious.
Quick bonus! Did you know that you can also encrypt that external hard drive or
thumb drive that you keep sitting around? Whether you keep these laying around the
house or especially if you travel with them, it’s definitely worth encrypting the data so
that nobody has the ability to just swipe the drive and copy what you have on there.
Many of these come with proprietary software out of the box that allows you to encrypt the drive,
but it’s also just as easy to encrypt it from your computer,
at least on a Mac. Find the drive in your Finder window, right click on the drive and
click “Encrypt”. You’ll be prompted to create a password and a password hint, and that’s it.
For those who use professional editions of Microsoft Windows, you can do the same
thing with the native Bitlocker tool, but if you’re a home user you’ll have
to try a 3rd party app like Veracrypt or whatever software came with your drive.
Thanks for spending some time with me today! If you’ve watched this video all the way through
and you’re not already subscribed, you really need to do that. And then watch this video
next where I walk through how to turn on the one security setting every Apple user needs to fix.