4 ms·

> A system that was secure in 2005 doesnt necessarily have to be secure in 2015. Can you clarify what you mean by this? What sort of vulnerability could magic

> A system that was secure in 2005 doesnt necessarily have to be secure in 2015. Can you clarify what you mean by this? What sort of vulnerability could magically appear in Truecrypt to make it less secure now than a decade ago?

dogma1138 11y ago
Time, it's less about new vulnerabilities being introduced and more being discovered, some issues for example like identifying some statistical bias within say the software PNRG that could potentially be used to regenerate encryption key enmass more economically also only increase with time. That said considering the circumstances in which the "developer" of this software disappeared, how it was presented and the fact that it is not maintained anymore should make people think twice about using it.
ChrisLomont 11y ago
The second paragraph of the article lists multiple new vulnerabilities found in Truecrypt just recently, some of which make the overall encryption weaker, others which allow attacking a mounted drive. An attacker knowing these flaws now has a smaller attack surface than a decade ago, since he now knows some weaknesses. There's the magic.
liw 11y ago
I don't use TrueCrypt myself, and haven't followed what's happening with it in any detail, but I'll comment on the general question here: why do you need to keep up to date with vulnerabilities in order to keep secure. First, nothing is ever totally secure. If a system gets audited today, the best the auditors can say is that to the best of their knowledge, the system has either no flaws, or list the vulnerabilities they know about. There might be vulnerabilities they missed. Some of the unknown ones might be blatant (say, a backdoor), or very subtle. When the unknown ones are found later on, and become public, the only way to not be vulnerable to those is to update. Second, a system may become vulnerable later by the environment around it changing. This might be, for example, a change in the compiler (you rebuild for a new platform, and the kernel introduces a vulnerability), or in the language interpreter, or some library that the software uses, or the operating system kernel, or something else. It might be that you upgrade the CPU and the hardware random number generater on the new CPU is worse than in the old CPU. It might be that you move your system from physical hardware you control to a virtual machine you rent, thereby violating security assumptions made by the software. A system, or software, that is never updated stays still, and never gets better, while potential attackers learn more tricks and more ways to attack. Sooner or later they'll find a way to attack any stale systems. And that is why updating is important for security.
furyferret 11y ago
Vulnerabilities don't "magically appear". They're there from the beginning and the goal of the game is to find them and fix them before the bad guys find them and exploit them. If you use a software which isn't maintained, it's insecure not because of its vulnerabilities, but because of its environment, which is ready to attack the vulnerabilities. From a general point of view, it's not risky to use a software from 2005. It's just risky to use it in 2015. Try installing a Flash version from 2005 and open a web browser with it in 2015. That's basically killing your computer, and yet we were all using this Flash version in 2005 without a problem (or almost).

dogma1138 11y ago

Time, it's less about new vulnerabilities being introduced and more being discovered, some issues for example like identifying some statistical bias within say the software PNRG that could potentially be used to regenerate encryption key enmass more economically also only increase with time. That said considering the circumstances in which the "developer" of this software disappeared, how it was presented and the fact that it is not maintained anymore should make people think twice about using it.

ChrisLomont 11y ago

The second paragraph of the article lists multiple new vulnerabilities found in Truecrypt just recently, some of which make the overall encryption weaker, others which allow attacking a mounted drive. An attacker knowing these flaws now has a smaller attack surface than a decade ago, since he now knows some weaknesses. There's the magic.

liw 11y ago

I don't use TrueCrypt myself, and haven't followed what's happening with it in any detail, but I'll comment on the general question here: why do you need to keep up to date with vulnerabilities in order to keep secure. First, nothing is ever totally secure. If a system gets audited today, the best the auditors can say is that to the best of their knowledge, the system has either no flaws, or list the vulnerabilities they know about. There might be vulnerabilities they missed. Some of the unknown ones might be blatant (say, a backdoor), or very subtle. When the unknown ones are found later on, and become public, the only way to not be vulnerable to those is to update. Second, a system may become vulnerable later by the environment around it changing. This might be, for example, a change in the compiler (you rebuild for a new platform, and the kernel introduces a vulnerability), or in the language interpreter, or some library that the software uses, or the operating system kernel, or something else. It might be that you upgrade the CPU and the hardware random number generater on the new CPU is worse than in the old CPU. It might be that you move your system from physical hardware you control to a virtual machine you rent, thereby violating security assumptions made by the software. A system, or software, that is never updated stays still, and never gets better, while potential attackers learn more tricks and more ways to attack. Sooner or later they'll find a way to attack any stale systems. And that is why updating is important for security.

furyferret 11y ago

Vulnerabilities don't "magically appear". They're there from the beginning and the goal of the game is to find them and fix them before the bad guys find them and exploit them. If you use a software which isn't maintained, it's insecure not because of its vulnerabilities, but because of its environment, which is ready to attack the vulnerabilities. From a general point of view, it's not risky to use a software from 2005. It's just risky to use it in 2015. Try installing a Flash version from 2005 and open a web browser with it in 2015. That's basically killing your computer, and yet we were all using this Flash version in 2005 without a problem (or almost).