Forum Replies Created
-
AuthorPosts
-
Hi Frank,
Here’s the thing – you downloaded “AxCrypt standalone” – the install-free version. Now, if it could do everything an installed version can, why do we need it?
Well, that’s just what the installed version does – it adds two major things to the standalone version:
1) Double-click to open encrypted files
2) Right-click in Windows Explorer to access AxCrypt.
That’s essentially what the installation procedure does – set a number of Windows Registry settings so those functions work.
The standalone version is, well, standalone. That’s why you have to work from the “Recent Files” view with that version.
If you’d like to get back the “double-click to to open support”, do get the installer and install it.
—
What’s to keep someone from opening AxCrypt and viewing the file? Your password. AxCrypt is engineered around the fact that nothing needs to be secret except that password. Not the encrypted file contents, not the software, not the algorithms, not even the source code. Just the password.
AxCrypt does stay “signed in” for convenience while you are signed in to Windows. For more information about that, please read http://www.axcrypt.net/blog/leaving-computer-axcrypt/ .
Hello Amine,
From what we can tell, you’re successfully signing in to your AxCrypt ID account.
Of course we don’t stop letting you in if a trial period expires.
The thing is also – you never have had a trial period.
So, since everything seems to be ok from here, and we can’t really match your description of events with your account status, I’d like you to send a screen shot of where you are stuck.
PS – The behavior you describe that once signed in you do not need to re-enter the password is by design. That’s how it’s supposed to work.
Hello Patrick,
We’re in the final phases of development for mobile apps right now, they are in internal beta.
Then we’re aiming for a Mac OS X version during Q1 2017.
Hi Robin,
No, the “communication email” is the same as the AxCrypt ID. It’s that email that we verify to be correct by sending a verification code to as well.
Our point of view is that an email is simply not a secret (every spammer on the planet knows it), nor should it be a secret that a given person (like myself) is using AxCrypt.
The source code, the algorithms, even the encrypted files – nothing of this should need be kept secret.
The *only* thing that should and must be kept secret is the password.
Hello Tas,
This is most probably because you have attempted to associate the AxCrypt file extension (.axx) with a Adobe Acrobat PDF viewer.
When you install AxCrypt, the .axx file extension is associated with AxCrypt, so when you double-click such a file, AxCrypt is started (which may in turn start another application such as a PDF viewer after decryption).
If you associate .axx directly with something else than AxCrypt, it will not work.
If this does not explain it, please add a screen shot of the situation. You might also want to google “windows file association extension” or something similar.
Hello Robin!
It appears that you deleted your existing account, and then created an entirely new one. What you probably intended to do was to *change* your email. You can do that from account.axcrypt.net when signed in.
But, axantum.com is soon to be entirely separated from AxCrypt, and unless you had passwords stored in your old account, there’s no real harm done – except of course that we no longer see that you’re a long-time user!
If this is a problem, we can recreate your old account from the backups, but to be honest – it’s work and if it’s not important to you… But if really want, we can.
Hello Francois,
Can you please explain in more detail what you are trying to do, and include a screen shot? It would also be helpful to know what version of AxCrypt you are using. Finally, you’re mostly on your own when you do custom installs, but we’ll try to help if we can.
AxCrypt typically works fine on a multi-user Windows PC, as far as we know.
Hello Adewale,
This is a first. Can you please send a complete error report according to the description here: http://www.axcrypt.net/blog/send-complete-error-report/ .
Hello Mike,
Have you installed anything else since then? Although you don’t quote the exact same message, you might want to check the following: http://www.axcrypt.net/support/faq/#lavasoft-crash .
If this does not ring any bells, and you cannot find any Lavasoft software, please send a complete error report as described here: http://www.axcrypt.net/blog/send-complete-error-report/ .
Hello,
Please send a screen shot of the situation so we learn a little bit more about the version of AxCrypt etc. Generally speaking, this means that the file is damaged. It is very, very unusual.
Also, please explain a little more about the history, i.e. what type of file is it, have you updated it frequently, when did you last successfully open it, what type of medium is it stored on etc.
Hello Xavier,
You’re right – it’s a bit confusing, and doesn’t feel that welcome. It’s because there are various ways to sign up, you presumably did so via the webb. When you sign up via the AxCrypt App, it’s a little more clear. And that’s also where you start your trial period. We’ll improve that, thanks for pointing it out to us!
Anyway, I’ve extended your Premium to include the Trial month as well.
Hello,
We need more information about this.
Please start by performing steps 1. and 2. from http://www.axcrypt.net/blog/send-complete-error-report/ and sending them to support@axcrypt.net .
Hello John,
This is by design, so you don’t have to enter the password all the time. As soon as your screen saver goes active, you sign out of Windows, or your computer goes to sleep or is turned off AxCrypt will also sign out, and then require the password when you get back.
See http://www.axcrypt.net/blog/leaving-computer-axcrypt/ for more about this, and some common questions.
Hello again, this is in reply to your earlier entry.
Many questions, but I’ll try to keep it short:
“The first time you start AxCrypt a real email address is required. Click help for more information” – If you’re off line when starting the first time, the only requirement is an email address that looks real, i.e. has the correct form. There’s no requirement to be online at any time to use AxCrypt.
“Verify that the download is undamaged and authentic by checking the digital signature” – No, we don’t need to publish any hashes, or verify the fingerprint of the certificate. That’s not relevant for Authenticode signatures, which use the PKI builtin your PC. That’s the way these certificates and signatures work. These are not PGP signatures with a weak “web of trust”. We’ve paid real money for the certificate authority to comply with manufacturer guidelines, and to verify that we are who we say we are and that your system has a trusted root certificate so you can trust ours.
“AxCrypt don’t have an SSL certificate on the main website” – You’re right for just the reasons you specify, and we will fix that. It’s on our to-do list, almost but not quite at the top!
Hello,
Yes, the initial situation during the time frame between an ‘invite’ and ‘sign up’ for Bob allows for the scenario you describe.
However, I believe the outcome (apart from the fact that Mallory actually gets to open the file) is that Bob will call Alice and ask what’s going on? Bob can’t sign in to the account – and the end result is that Bob will become aware that his email is compromised.
If the attack is initiated *after* Bob has actually signed up for AxCrypt, there is no vulnerability to this attack at all.
The private key is initially stored on our server when an invite happens, encrypted with our key. As soon as Bob (or Mallory for that matter) sets a password, the private key is re-encrypted with that password.
This is the ‘convenience’ track. Should Alice *really* want to be assured that this does not happen, she should contact Bob and ask him to sign up before the file key is shared.
It’s a situation where we feel that practicality is so great in *not* requiring Alice to contact and wait for Bob to set everything up is worth the attack window.
What’s stopping an attacker from changing the key on our servers, is our servers of course. Except for the ‘invite’ window scenario, an intruder with access to the server can’t access or decrypt any private keys just as little as we can ourselves.
The private keys are also synchronized to your local device, and can even be generated there if you are running offline when you register. And, yes, you can export the key pair (both private and public as one file). It’s under the following menu:
File | Key Management | Export AxCrypt ID Secret and Sharing Key Pair
-
AuthorPosts
