Live data from Hacker News

PeaZip: Open-source file compression and encryption software

peazip.github.io

21–30 of 95 posts

Re: PeaZip: Open-source file compression and encryption software

#22
post #18

Programs like 7-zip and PeaZip both have an unusual feature: Ability to explore NT paths that Windows Explorer will refuse to load. You can go to a path like "\\?\Harddisk0Partition2\" in 7-zip file manager or PeaZip. On my PC, that happens to be the EFI partition. (Need to run as Admin before it lets you access the EFI partition) Sysinternals WinObj will let you see all the paths in the NT Object Namespace. To conve…

TIL, thanks!

To add to this list of unusual features, 7-zip can also parse many self-extracting PE executables and display the executable sections of ELFs and PEs. I'm not sure if this has been documented anywhere, though.

Re: PeaZip: Open-source file compression and encryption software

#23
post #18

Programs like 7-zip and PeaZip both have an unusual feature: Ability to explore NT paths that Windows Explorer will refuse to load. You can go to a path like "\\?\Harddisk0Partition2\" in 7-zip file manager or PeaZip. On my PC, that happens to be the EFI partition. (Need to run as Admin before it lets you access the EFI partition) Sysinternals WinObj will let you see all the paths in the NT Object Namespace. To conve…

Reminds me of when I used WinZip to copy files from a shared directory that had non-ASCII (non latin even!) characters in the file names over 20 years ago. Windows Explorer refused to do it. Can't remember the error message, WinZip did the job.

Re: PeaZip: Open-source file compression and encryption software

#24
post #18

Programs like 7-zip and PeaZip both have an unusual feature: Ability to explore NT paths that Windows Explorer will refuse to load. You can go to a path like "\\?\Harddisk0Partition2\" in 7-zip file manager or PeaZip. On my PC, that happens to be the EFI partition. (Need to run as Admin before it lets you access the EFI partition) Sysinternals WinObj will let you see all the paths in the NT Object Namespace. To conve…

Not so much "refuse", but lacking code to go down those paths. ReactOS includes built-in shell extensions to browse native NT device paths and the registry right in Explorer. Its same shell extensions can even be installed on Windows to achieve the same thing in Microsoft's Windows Explorer :)

Re: PeaZip: Open-source file compression and encryption software

#26
post #15

PeaZip is great software, and doubly so because it is written using Lazarus and compiled with Free Pascal. I highly recommend giving it a try, if only to experience that high quality software can be built using tools that lead you somewhat off the beaten path. Unfortunately, its lead developer has recently posted[0] that he has to undergo what seems to be complicated, major eye surgery, and that he will probably be u…

Seems like he's doing OK, thank goodness! https://old.reddit.com/r/PeaZip/comments/1cpdvum/peazip_980_...

Re: PeaZip: Open-source file compression and encryption software

#27
Currently using it under Linux because it's able to extract the malformed large zip files generated by onedrive, that give a corrupted file error when you try to open them using the native file extractor. See https://www.bitsgalore.org/2020/03/11/does-microsoft-onedriv...

Re: PeaZip: Open-source file compression and encryption software

#28

Can anyone explain why this is better than 7zip?

I hate that PeaZip does not support passwords with a quotation mark (") in the UI. I haven't reviewed the code, but I am assuming that they are neither passing the password via a variable (linked library) nor via an execve call (less secure), but via some sub-shell which is a common attack vector and bad security practice. But as I said, I haven't reviewed the code.

Re: PeaZip: Open-source file compression and encryption software

#30
post #5

> Offer two factor authentication (password + keyfile) for all formats supporting encryption, to increase security against guessing and dictionary based attacks on weak passwords. uhhh, that’s not how symmetric encryption works. We have salted password-based (PB) KDFs for exactly this purpose. Encryption probably doesn’t belong in the compression container format.

The quote is correct. It does not say they're not using a KDF or salting, which you seem to read into it? The keyfile is the "something you have" and the password "something you know", so two-factor checks out, even if it's not a time-based token that people expect nowadays (though TOTP is essentially the same but on another device, extracting time-based short codes from the long key to make it convenient to type over). No matter how good your KDF, a weak or reused password can still be crackable, so a key file can make sense even if you use a salted KDF
Post reply on HN