3 ms·

The audit confirms my suspicions that VeraCrypt is relatively unsafe. I would also suggest to take into account the fact that, albeit being open source, it is

The audit confirms my suspicions that VeraCrypt is relatively unsafe. I would also suggest to take into account the fact that, albeit being open source, it is primarily developed by a French security company whose web pages https://www.idrix.fr/Root/ https://www.idrix.fr/Root/ do not inspire confidence in combination with France's history of dealing with encryption. A conflict of interest can easily arise in such companies between the companies or authorities that pay them and the interests of the general public. "You'll find below a partial list of those who gave us their full trust, as some of our customers prefer to remain discrete about our collaboration."

Kadin 10y ago
I don't think that's a particularly fair reading of the audit. First, they had the audit done at all, which is something a very short list of software products can even claim. E.g., and I am not casting aspersions on the project, I don't think `dm-crypt` has done a formal 3rd-party audit to date, and it's probably the next-best alternative to VeraCrypt, not counting the last version of TrueCrypt itself. About the only really unfortunate thing that I saw in the audit was the addition of the old Soviet 64b block cipher that they need to remove. They shouldn't have added that, noble though the goal of adding non-Western-derived algos might have been. But the remainder of the issues noted in the audit are likely there from TrueCrypt, and as the VC team fixes them, it will mean that VeraCrypt is definitively better than TrueCrypt. That's a good piece of information to know, as I suspect there are lots of people around still using TrueCrypt because nobody has really produced anything better yet.
laurent123456 10y ago
> do not inspire confidence in combination with France's history of dealing with encryption So which country would inspire confidence then? Reading the news these days it seems most developed countries are equally guilty of mass surveillance and trying to meddle with encryption technologies. The only way to really be sure is to have independent audits like they just did, and the VeraCrypt developers are apparently keen to keep making these audits happen.
- JohnStrange 10y ago
  First of all, mass surveillance has nothing to do with this topic. Second, trying to meddle with encryption technologies is not the same as state regulation of encryption and prohibiting encryption, which is what France's lawmakers did in the past and tried to re-institute recently. I'm not the kind of guy who compiles the source code himself and vets it against the audited code (who is, frankly speaking?), so I only run encryption software that has been developed by individuals and non-profit groups of individuals that do not run a private security company and that I consider trustworthy based on personal criteria. In cryptography, private companies have proved again and again that they cannot be trusted. They invariably mess it up due to incompetence or meddling with the government (see e.g. Crypto AG as a typical example). Open source is good, of course, but it is only a necessary, not a sufficient step. Security audits will not help you at all if you download binaries from untrusted sources. It's fine if you trust Idrix, but it's also fine and fully rational if I don't, based on what I know about France's intelligence apparatus and how they operate. Yes, I do consider it possible with a low but significant enough subjective probability that Idrix is a government setup.

Kadin 10y ago

I don't think that's a particularly fair reading of the audit. First, they had the audit done at all, which is something a very short list of software products can even claim. E.g., and I am not casting aspersions on the project, I don't think `dm-crypt` has done a formal 3rd-party audit to date, and it's probably the next-best alternative to VeraCrypt, not counting the last version of TrueCrypt itself. About the only really unfortunate thing that I saw in the audit was the addition of the old Soviet 64b block cipher that they need to remove. They shouldn't have added that, noble though the goal of adding non-Western-derived algos might have been. But the remainder of the issues noted in the audit are likely there from TrueCrypt, and as the VC team fixes them, it will mean that VeraCrypt is definitively better than TrueCrypt. That's a good piece of information to know, as I suspect there are lots of people around still using TrueCrypt because nobody has really produced anything better yet.

laurent123456 10y ago

> do not inspire confidence in combination with France's history of dealing with encryption So which country would inspire confidence then? Reading the news these days it seems most developed countries are equally guilty of mass surveillance and trying to meddle with encryption technologies. The only way to really be sure is to have independent audits like they just did, and the VeraCrypt developers are apparently keen to keep making these audits happen.

JohnStrange 10y ago
First of all, mass surveillance has nothing to do with this topic. Second, trying to meddle with encryption technologies is not the same as state regulation of encryption and prohibiting encryption, which is what France's lawmakers did in the past and tried to re-institute recently. I'm not the kind of guy who compiles the source code himself and vets it against the audited code (who is, frankly speaking?), so I only run encryption software that has been developed by individuals and non-profit groups of individuals that do not run a private security company and that I consider trustworthy based on personal criteria. In cryptography, private companies have proved again and again that they cannot be trusted. They invariably mess it up due to incompetence or meddling with the government (see e.g. Crypto AG as a typical example). Open source is good, of course, but it is only a necessary, not a sufficient step. Security audits will not help you at all if you download binaries from untrusted sources. It's fine if you trust Idrix, but it's also fine and fully rational if I don't, based on what I know about France's intelligence apparatus and how they operate. Yes, I do consider it possible with a low but significant enough subjective probability that Idrix is a government setup.