4 ms·

> do not inspire confidence in combination with France's history of dealing with encryption So which country would inspire confidence then? Reading the news th

> do not inspire confidence in combination with France's history of dealing with encryption So which country would inspire confidence then? Reading the news these days it seems most developed countries are equally guilty of mass surveillance and trying to meddle with encryption technologies. The only way to really be sure is to have independent audits like they just did, and the VeraCrypt developers are apparently keen to keep making these audits happen.

JohnStrange 10y ago
First of all, mass surveillance has nothing to do with this topic. Second, trying to meddle with encryption technologies is not the same as state regulation of encryption and prohibiting encryption, which is what France's lawmakers did in the past and tried to re-institute recently. I'm not the kind of guy who compiles the source code himself and vets it against the audited code (who is, frankly speaking?), so I only run encryption software that has been developed by individuals and non-profit groups of individuals that do not run a private security company and that I consider trustworthy based on personal criteria. In cryptography, private companies have proved again and again that they cannot be trusted. They invariably mess it up due to incompetence or meddling with the government (see e.g. Crypto AG as a typical example). Open source is good, of course, but it is only a necessary, not a sufficient step. Security audits will not help you at all if you download binaries from untrusted sources. It's fine if you trust Idrix, but it's also fine and fully rational if I don't, based on what I know about France's intelligence apparatus and how they operate. Yes, I do consider it possible with a low but significant enough subjective probability that Idrix is a government setup.

4 ms·

> do not inspire confidence in combination with France's history of dealing with encryption So which country would inspire confidence then? Reading the news th

by laurent123456 10y ago

JohnStrange 10y ago
First of all, mass surveillance has nothing to do with this topic. Second, trying to meddle with encryption technologies is not the same as state regulation of encryption and prohibiting encryption, which is what France's lawmakers did in the past and tried to re-institute recently. I'm not the kind of guy who compiles the source code himself and vets it against the audited code (who is, frankly speaking?), so I only run encryption software that has been developed by individuals and non-profit groups of individuals that do not run a private security company and that I consider trustworthy based on personal criteria. In cryptography, private companies have proved again and again that they cannot be trusted. They invariably mess it up due to incompetence or meddling with the government (see e.g. Crypto AG as a typical example). Open source is good, of course, but it is only a necessary, not a sufficient step. Security audits will not help you at all if you download binaries from untrusted sources. It's fine if you trust Idrix, but it's also fine and fully rational if I don't, based on what I know about France's intelligence apparatus and how they operate. Yes, I do consider it possible with a low but significant enough subjective probability that Idrix is a government setup.