Huacal

Security

Security and privacy

What Huacal does with your files, how it protects your passwords, and how you can check that the installer is the original.

In short

  • It never connects to the internet. No telemetry, no account, no ads.
  • Passwords use AES-256 in zip and 7z, and Huacal does not store them.
  • It never writes outside the folder you choose, even when an archive is built to try.
  • Every installer has a published SHA-256 checksum, so you can check it is the original.

Privacy Passwords and encryption Opening other people’s archives Your files The installer Your PC Reporting a problem

Privacy: your files never leave your PC

  • Huacal contains no component for connecting to the internet, and its window is configured so it cannot load anything that does not come from the program itself.
  • No telemetry: it does not count how often you use it, what you compress or what your files are called.
  • No account and no email address, and it works the same offline.
  • It only opens your browser when you click a link, such as the one to this site.
  • All it stores are your preferences (format, level, language and similar options), on your PC. It never stores passwords.

Since it never connects, Huacal also cannot tell you on its own when a new release is out. That is what the releases page is for.

Passwords and encryption

When you put a password on an archive, Huacal uses AES-256, the same encryption 7-Zip and WinRAR use. It never uses the old zip encryption (ZipCrypto), which can be broken quickly today.

  • zip: AES-256 in the standard WinZip format that 7-Zip and WinRAR understand. It protects the contents of each file, but the file names are visible without the password.
  • 7z: AES-256 with the key derived from your password using SHA-256, as the format specifies. With “Hide the file names too”, not even the list is visible without the password.
  • It compresses first and encrypts second. The other way round nothing would compress, because encrypted data looks random. Huacal has an automated test that watches exactly that.

If you forget the password, there is no way to recover the contents. Huacal neither stores it nor sends it anywhere, and there is no master key. That is precisely the protection.

The tar, gz, xz and bz2 formats have no password option. If you need one, use zip or 7z (see which format to use).

Opening other people’s archives

An archive can be built with bad intent: with files named, for example, ..\..\Windows\something.dll, so that extracting them writes outside the folder you picked. The attack is known as zip slip.

Huacal checks every file name before extracting it, in all four kinds it opens (zip, 7z, tar and rar). If one points outside the destination folder or is an absolute path, it stops with an error and does not write that file.

To open rar files it uses the official UnRAR library, published by the author of WinRAR.

Your files

  • If a file cannot be read while compressing (for example, because another program has it open), Huacal skips it and tells you when it finishes. It never leaves a file out without telling you.
  • If you cancel or something fails, it deletes the half-made archive instead of leaving you an incomplete one that looks fine.
  • When adding files to or removing them from a zip, it works on a copy and only replaces the original at the end. If something goes wrong halfway, your zip stays as it was.
  • “Check the archive when finished” opens it again in full to confirm it has no errors. If that fails, you see an error, never a success.

The installer

The installer does not have a digital signature yet, so Windows warns you when you open it (“Windows protected your PC”). Click More info → Run anyway. Signing it is paperwork that will happen when the project justifies it.

Meanwhile, every installer has its SHA-256 checksum published on the releases page. Think of it as a fingerprint: change a single byte and the checksum changes. To check it, open PowerShell in your downloads folder and type:

Get-FileHash .\Huacal-setup-x64.exe -Algorithm SHA256

The result must be identical to the published one. After every release, an outside server downloads the installers the way anyone would and checks that their checksums match the ones on this site.

Self-extracting files (.exe) you create with Huacal are not signed either, and Windows will warn whoever opens them too.

What changes on your PC

  • It installs in Program Files, for every account on the PC.
  • It adds its options to the File Explorer right-click menu and shows up under “Open with”. You can remove the menu from Settings with “Remove from Explorer”.
  • It never makes itself the default program. On Windows that is your decision, in Settings. Huacal only takes you to that screen if you ask it to.
  • Uninstalling removes the menu and the “Open with” entries.

The third-party components Huacal uses, with their licenses, are listed in TERCEROS.txt, next to Huacal.exe.

Reporting a security problem

If you find a security flaw, write to [email protected] with the steps to reproduce it, before publishing it anywhere else. That leaves time to ship a release that fixes it.