47 ms·

To be fair, I trust TrueCrypt because it's "libre" and "open", but I've never looked at the source code myself. I trust that other people more knowledgable tha

by jazzyb 15y ago

To be fair, I trust TrueCrypt because it's "libre" and "open", but I've never looked at the source code myself. I trust that other people more knowledgable than me have taken a look at it, but if there is indeed a backdoor in it, then it will look on the surface like the most innocuous bug in the world. Don't get me wrong: I understand and appreciate your point, but I honestly don't know how most of us using TrueCrypt (e.g. me) are any better off than those who use a proprietary solution. The only difference I can see is any backdoors in TrueCrypt or PGP must be better hidden.

slowpoke 15y ago
While you are basically correct, the mere ability to check the source yourself and possibly be able to find (or even fix) said bugs-which-could-or-could-not-be-cleverly-hidden-backdoors puts it leagues ahead of any proprietary solution, where there is never any way to be sure there isn't just something like a void force_decrypt(string company_master_password)[1] in there. And to be perfectly honest, I'd rather trust the FLOSS crowd who checked TrueCrypt and other more or less popular encryption tools probably hundreds, if not thousands of times than trust the development team of a company refusing to release the source of their software. [1] Yes, I am kidding, but I hope you catch my drift.
- Create 15y ago
  be reassured, that "nobody" actually checks thoroughly in practice, so don't rely on it. http://www.h-online.com/newsticker/news/item/Debian-package-of-OpenSSL-generates-weak-keys-735183.html http://www.h-online.com/newsticker/news/item/Debian-package-...
  - 3pt14159 15y ago
    Doesn't that prove that people do check it? Isn't the point of open source that you can have problems for a time, but eventually you'll be ok? Certainly better than you could write yourself or trust in a closed source system.
    - Create 15y ago
      Yes, it is certainly easier to audit than binaries, but one of the main axioms in cryptography is, that it should ensure security for the timeframe until the information protected is still valuable (one can assume, that eventually all crypto is cracked -- the question is when, and how to delay this to ensure functionality). This bug was injected for two years: the damage has been done, with literally over a million of weak keys that pollute the internet. That said, I acknowledge, that the ssl system has (perhaps even more) serious weaknesses beyond the keys themselves. It should have been caught days after commit, and never should have made it into debian stable (and debian has a very slow, thorough release cycle). But telnetd comes to mind, etc. Perhaps only OpenBSD shows consistent true efforts in open source auditing.

by jazzyb 15y ago

slowpoke 15y ago

While you are basically correct, the mere ability to check the source yourself and possibly be able to find (or even fix) said bugs-which-could-or-could-not-be-cleverly-hidden-backdoors puts it leagues ahead of any proprietary solution, where there is never any way to be sure there isn't just something like a void force_decrypt(string company_master_password)[1] in there. And to be perfectly honest, I'd rather trust the FLOSS crowd who checked TrueCrypt and other more or less popular encryption tools probably hundreds, if not thousands of times than trust the development team of a company refusing to release the source of their software. [1] Yes, I am kidding, but I hope you catch my drift.

Create 15y ago
be reassured, that "nobody" actually checks thoroughly in practice, so don't rely on it. http://www.h-online.com/newsticker/news/item/Debian-package-of-OpenSSL-generates-weak-keys-735183.html http://www.h-online.com/newsticker/news/item/Debian-package-...
- 3pt14159 15y ago
  Doesn't that prove that people do check it? Isn't the point of open source that you can have problems for a time, but eventually you'll be ok? Certainly better than you could write yourself or trust in a closed source system.
  - Create 15y ago
    Yes, it is certainly easier to audit than binaries, but one of the main axioms in cryptography is, that it should ensure security for the timeframe until the information protected is still valuable (one can assume, that eventually all crypto is cracked -- the question is when, and how to delay this to ensure functionality). This bug was injected for two years: the damage has been done, with literally over a million of weak keys that pollute the internet. That said, I acknowledge, that the ssl system has (perhaps even more) serious weaknesses beyond the keys themselves. It should have been caught days after commit, and never should have made it into debian stable (and debian has a very slow, thorough release cycle). But telnetd comes to mind, etc. Perhaps only OpenBSD shows consistent true efforts in open source auditing.