Espionage keeps your data safe from spying eyes

Mac OS X’s FileVault feature, which encrypts your entire user folder, is great for security. But because it stores your entire user folder as an encrypted disk image, it adversely affects performance, makes backups difficult, and—worst of all—can render all your data inaccessible if something bad ever happens to the monolithic encrypted disk image hosting your account.

As I explained when I reviewed Knox, an alternative is to use smaller encrypted disk images for particular types of data; for example, one for all your financial data, one for your work documents, and so on. You can create these disk images using OS X’s Disk Utility, but Knox makes the creation process easier, gives you a systemwide menu for convenient access to those images, and provides an automatic backup system that keeps older versions of each image in case one is ever damaged.

Knox remains one of my favorite Gems, but I’ve been testing another disk-image utility, Espionage, that’s got some compelling features of its own.

Like Knox, Espionage uses encrypted disk images to store sensitive data. However, Espionage performs a bit of Finder trickery to give you the illusion that you’re interacting directly with a protected folder, instead of a disk image—the program does all the disk-image work for you, behind the scenes.

To protect a folder, you drag it into the Espionage window, choose your encryption settings (AES-128 or AES-256 and the type of disk image), and then provide a password. (Espionage can also password-protect a folder without encrypting it, but this is much less secure.) Once protected, you can continue to work with the folder just as you did before…once you’ve unlocked it, of course.

To unlock a folder, you just double-click it; you’re prompted for the folder’s password. A few seconds after entering the correct password, the folder’s contents appear. To lock the folder again, you just right-click on the folder and choose Lock Folder from the resulting contextual menu. You can also unlock and lock a folder using the systemwide Espionage menu or the Espionage application itself.

But Espionage’s most compelling feature may be that it can automatically encrypt application-specific support data, wherever that data resides; for example, Mail e-mail messages and Safari bookmarks and history. From within Espionage, choose File -> Application Templates and then choose one of the preconfigured application templates—26 are provided, including Address Book, Mail, and Safari. Espionage displays a list of associated data folders and then asks for a password for those folders. Whenever you use the program, you’ll be prompted to provide the password to access the program’s data.

You can encrypt data from programs not listed here, but you’ll need to set up such encryption manually by dragging the application’s data folder into Espionage and then, in the setup window, dragging the application into the Application Associations field.

You can also whitelist particular applications—for example, backup software—so they have access to your protected folders, and blacklist applications you want to be automatically denied. If you choose to store in a Mac OS X keychain the passwords for your protected folders, you can opt to use your standard login keychain or to create a new one, with a separate password, just for Espionage passwords.

Espionage displays onscreen notifications—its own or using Growl—whenever a folder is locked or unlocked, or any time someone attempts to open a locked folder with the wrong password. Like Knox, Espionage provides the option to automatically back up your encrypted data.

I did come across one surprising security caveat: When you first protect a folder using Espionage, the folder’s contents are copied to a new, encrypted disk image, and then the original folder is moved to the Trash. Which means that if you want to be sure that the original data is not accessible or recoverable, when emptying the Trash to delete those contents, you must use the Finder’s Secure Empty Trash command instead of the standard Empty Trash command.

In addition to that caveat, because of the way the program works, you can’t move or rename a protected folder as you normally would. (More accurately, you can, but doing so will cause problems.) You must first disable protection of the folder within Espionage, then move or rename the folder, then re-protect the folder. Also, because of the way Espionage interacts with the Finder, Time Machine backups of an encrypted folder will differ dramatically depending on whether the folder was locked or unlocked at the time of the backup; be sure to read Espionage’s documentation for the details. Those Help documents also detail a number of other minor issues that stem from the way Espionage must interact with the Finder to perform its magic.

Want to stay up to date with the latest Gems? Sign up for the Mac Gems newsletter for a weekly e-mail summary of Gems reviews sent directly to your Inbox.