Encrypt Your Tax Docs BEFORE You Send Them

It’s that time. We all are doing our taxes online now. Some of us need some help and that usually ends up with digitally sending tax documents.

Do not ever, under any circumstance, email a document that has your SSN, home address, phone number, bank information, etc. unencrypted. That is a good way to lose all of your money and even your identity.

For encryption, I recommend starting with the 30-day free trial of AES Crypt. After the trial, continued desktop use requires a paid perpetual license. You can share the encrypted file through Dropbox, Google Drive, OneDrive, or another file-sharing service.

Step 1: Install AESCrypt

Download the AES Crypt desktop free trial for your operating system and install it. The trial lasts 30 days, so you can test the process before deciding whether to purchase a license.

Step 2: Zip up all of those files

You want to send one encrypted blob of data. Put all of your files into a single folder and zip that up. On the Mac, select the file and go to File >> Compress “Sensitive Docs”.

Step 3: Encrypt

Follow the directions for your platform to encrypt your zip file. On the Mac, drag the file onto the dock icon and enter a strong password when prompted.

I suggest using a secure password generator like the one over at GRC.com. You can also use Lastpass or whatever you use (even the commandline) to manage your passwords. Make a note of that password though. You can keep a copy of the password in TextEdit or NVAlt – the documents are already on your computer.

Steve Gibson recommended, on the Security Now Podcast, to use a long string of numbers that can easily be read over the phone such as, “32 67 89 14 75 12 99”, etc.

You can send them the file directly through the Dropbox website or get the link and send it separately.

Step 5: Send the Password via a Separate Method

If you send an email with a link to your encrypted document, it doesn’t make sense to put the password into that email. Additionally, you might not want to send the password from your account to that same account. Try to send the password over iMessage, Signal, or another instant messenger, or to a secondary email address the person has.

This would be a good time to send them the decryption instructions if they need some help.

Step 6: The Takedown

Once the recipient has confirmed that they have the documents and have decrypted them on their own machine you will remove the encrypted documents from Dropbox. Sure they are safe, but there is no reason to keep that online.

Sable

You can use any temporary online storage solution you have access to in order to send the file, but sending via email attachment will ensure that your encrypted file is available permanently for offline attacks

*Use openssl from the cli: openssl rand -base64 12