7 ms·

Does anyone here feel more confident about a security software when it has a team page with real humans behind it? That was one of the things that always made m

Does anyone here feel more confident about a security software when it has a team page with real humans behind it? That was one of the things that always made me uncomfortable about TrueCrypt for example. Sure there is code. But I can't go through the code..

gen3 6y ago
I’ve been fine with KeePassXC, mainly because the file format is just AES encrypted xml. Sure, they could have still done something nonstandard and potentially dangerous, but with all the other clients people make I would expect that to get exposed reasonably quick.
- arsome 6y ago
  "Just AES encrypted" is a pretty limited way of looking at things. AES offers plenty of ways to screw things up, off the top of my head with my limited cryptographic knowledge: how do you do random number generation? How do you deal with password-based key derivation? Is it resistant to GPU bruteforcing? Did you pick a good mode of operation for the use case and are you properly managing IVs? Do you authenticate encrypted data? As far as I'm aware the newest KeePass format seems to do these things well (they switched from a custom AES-based KDF to using Argon2 recently), but I'm not sure if KeePass XC does the same and I'm certainly not qualified to review these things perfectly myself.
  - zaarn 6y ago
    KeepassXC has availability of Argon2id and Argon2. It's very decent software IMO that improves over standard Keepass.
Phenix88be 6y ago
There is real humans behind every software, I don't understand the logic here.
- NullPrefix 6y ago
  >Original release of TrueCrypt was made by anonymous developers called "the TrueCrypt Team".
- bitxbitxbitcoin 6y ago
  Replace "humans" with "human reputations."
t0astbread 6y ago
I don't agree with you but the developers disclose their real names in the about dialog in KeePassXC.
bitxbitxbitcoin 6y ago
I do understand the sentiment but I can imagine that depending on who the real humans behind TrueCrypt were, their presence on a team page could have just as easily decreased confidence.
brnt 6y ago
Actually, I do, with any software. I'm aware you may as well use it to fool me with some stock profiles, but seeing the humans behind the code increases my comfort of using it. You wouldn't show your face if you're 'selling' me crap, would you?
- t0astbread 6y ago
  There are a lot of people who show you their face (or a face) to gain trust and sell you crap. Inversely, there's also a lot of people producing really good software who wouldn't wanna show you their face. Also, I'm not accusing you of anything but I have the feeling real name/face/whatever policies are one of those things that disproportionately affect minorities (people who are subject to harassment online or otherwise uncomfortable sharing their identity) while doing almost nothing to ensure trustworthiness.
avhon1 6y ago
I'm not sure this is a good signal for trustworthiness. For example, how do you know the humans are real? In this new age of deepfakes, it's easier than ever to generate profiles of non-existent people.
nyolfen 6y ago
irl identities are attack surfaces

gen3 6y ago

I’ve been fine with KeePassXC, mainly because the file format is just AES encrypted xml. Sure, they could have still done something nonstandard and potentially dangerous, but with all the other clients people make I would expect that to get exposed reasonably quick.

arsome 6y ago
"Just AES encrypted" is a pretty limited way of looking at things. AES offers plenty of ways to screw things up, off the top of my head with my limited cryptographic knowledge: how do you do random number generation? How do you deal with password-based key derivation? Is it resistant to GPU bruteforcing? Did you pick a good mode of operation for the use case and are you properly managing IVs? Do you authenticate encrypted data? As far as I'm aware the newest KeePass format seems to do these things well (they switched from a custom AES-based KDF to using Argon2 recently), but I'm not sure if KeePass XC does the same and I'm certainly not qualified to review these things perfectly myself.
- zaarn 6y ago
  KeepassXC has availability of Argon2id and Argon2. It's very decent software IMO that improves over standard Keepass.

Phenix88be 6y ago

There is real humans behind every software, I don't understand the logic here.

NullPrefix 6y ago
>Original release of TrueCrypt was made by anonymous developers called "the TrueCrypt Team".
bitxbitxbitcoin 6y ago
Replace "humans" with "human reputations."

t0astbread 6y ago

I don't agree with you but the developers disclose their real names in the about dialog in KeePassXC.

bitxbitxbitcoin 6y ago

I do understand the sentiment but I can imagine that depending on who the real humans behind TrueCrypt were, their presence on a team page could have just as easily decreased confidence.

brnt 6y ago

Actually, I do, with any software. I'm aware you may as well use it to fool me with some stock profiles, but seeing the humans behind the code increases my comfort of using it. You wouldn't show your face if you're 'selling' me crap, would you?

t0astbread 6y ago
There are a lot of people who show you their face (or a face) to gain trust and sell you crap. Inversely, there's also a lot of people producing really good software who wouldn't wanna show you their face. Also, I'm not accusing you of anything but I have the feeling real name/face/whatever policies are one of those things that disproportionately affect minorities (people who are subject to harassment online or otherwise uncomfortable sharing their identity) while doing almost nothing to ensure trustworthiness.

avhon1 6y ago

I'm not sure this is a good signal for trustworthiness. For example, how do you know the humans are real? In this new age of deepfakes, it's easier than ever to generate profiles of non-existent people.

nyolfen 6y ago

irl identities are attack surfaces