Ask HN: Tool to share/exchange personal and confidential files | Hacker News Reader

Ask HN: Tool to share/exchange personal and confidential files

4 pointsakashcoach9 comments

What tool do you use to share/exchange personal and confidential files with outside organizations ? Size of the files can be large in many GBs. Security is the main concern. Tool should be web based.

View on HN

> Size of the files can be large in many GBs.

> Security is the main concern.

> Tool should be web based.

From your question it kinda sounds you actually have 3 main concerns, not just security. I can't give you any suggestions for web based tools but I can suggest:

1. Obtain a public SSH key out-of-band with the party that needs the large file and give them access to an SFTP share with that key.

2. Upload the file to a private S3 bucket and send them a signed link[1]

[1] https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareO...

Thanks for your suggestion. Unfortunately the users of the system are not too technical so some of these steps might be too much for them. Is there a user friendly tool in this space of secure file exchange?

Based on your non-technical users, you may want something with a Dropbox-like UI that can be self-hosted, like PsiTransfer https://github.com/psi-4ward/psitransfer .

If you're hosting in the cloud, you can improve the security posture using confidential computing like AWS Nitro Enclaves. Contact me at bobbie.chen@anjuna.io if you'd like more info on getting started with that.

SFTP.

For non-technical partners, we have a simple instructional document on how to download and use Filezilla[1] to connect. We haven't had many challenges.

1. https://filezilla-project.org/

External orgs sysadmin does not allow filezila installation. That is why we are looking for a web based solution that they can access via the browser.

Another problem I've run into more than once is that many orgs don't allow ssh out through the firewall. One project I worked on recently the client had to send and receive data via his home computer after work and transport it to/from his work computer on a USB drive. Apparently that was fine.

That would be a strict no-no for us considering the sensitivity of data.

Oh I am definitely not recommending this. It's just a warning of how people will work around any security protocols you put in place if they make it too cumbersome to actually get their job done. And in this case it was their secret data, not ours, so we didn't argue too much.

If those were the requirements, I'd pay for Dropbox and use their web sharing platform.

It's probably the least janky solution I've come across in a land of janky and insecure.

Reply on news.ycombinator.com