4 ms·
Really secure software isn't easy to write. But we're not holding the VeraCrypt developers to a higher bar than the one they've set for themselves. For disk en
by JoachimSchipper 10y ago
Really secure software isn't easy to write. But we're not holding the VeraCrypt developers to a higher bar than the one they've set for themselves.
For disk encryption, use whatever comes with your system. If you have no preference, Microsoft's BitLocker is excellent - it can incorporate hardware security features such as a TPM, self-encrypting (OPAL) SSD, it's somewhat easy to administer, etc.
- pjc50 10y agoBitlocker is excellent in a commercial environment, but the question some people are concerned about is how it might handle state-level threats. Although I suspect after Windows 10 techies would find that consideration moot, there are quite a lot of human rights people still using it for the usual reasons.
- JoachimSchipper 10y agoIf BitLocker seems riskier to you than VeraCrypt, might I suggest you recalibrate your threat model? See e.g. https://news.ycombinator.com/item?id=8193364 https://news.ycombinator.com/item?id=8193364.
- hannob 10y agoIf your threat model is that you assume your OS vendor is part of the attack then you can't use a proprietary OS. There's probably no free OS either that can give you the confidence level you'd want, because you probably would want to have reproducible builds, a trustworthy update process (preferably with some kind of transparency log), a wide array of exploit mitigations (aslr/pie/pic, grsec kernel, maybe CFI). There's currently no free OS offering all of those.
- keithpeter 10y agoJust out of interest: is there any OS that offers all of those? Libre/Open Source/Free or proprietary (latter with source access I assume)?
- GordonS 10y agoIf you are on Windows 10, the Home edition doesn't come with BitLocker - so your choice is to upgrade to Pro or use something else, such as VeraCrypt. I think it's probable that both can be broken/bypassed by state actors - I'd be happy to use either as a defence against everyone else though.
- krylon 10y ago> For disk encryption, use whatever comes with your system. I acknowledge this is likely a super-niche problem, but if you want to use an encrypted thumb drive (or external HDD/SDD) to access data from Windows, Mac and Linux machines, there is almost no alternative. Is there any realistic alternative? And BitLocker, even if you are on Windows is not completely trouble-free - on Windows 7, e.g. to my knowledge only the Ultimate/Enterprise editions support it. Windows 7 Pro does not.
- acqq 10y agoRegarding BitLocker, even on Windows 10 Pro, you can't encrypt the virtual disk and put it on the DVD or BlyRay and later read from there directly (why? because MSFT). That means it's not suitable at all for longer-term archiving.