4 ms·

Is it better? Even truecrypt's developers (which this is based on) recommend moving to bit locker now, https://truecrypt.sourceforge.net https://truecrypt.sourc

Is it better? Even truecrypt's developers (which this is based on) recommend moving to bit locker now, https://truecrypt.sourceforge.net https://truecrypt.sourceforge.net

kijin 3y ago
That was 9 years ago, not "now". BitLocker was the only alternative that they could recommend back then. It's possible that whatever vulnerability the TrueCrypt developers were alluding to still lurks in the VeraCrypt codebase, but the chances seem pretty low. VeraCrypt uses much stronger encryption methods, it has addressed all the issues raised in the original TrueCrypt audit as well as a separate audit of its own code, and the latest version isn't even backward-compatible with TrueCrypt volumes.
- rkagerer 3y ago
  the latest version isn't even backward-compatible with TrueCrypt volumes Are you sure? I thought it could open them in read-only mode. Here's a 2023 post suggesting it's supposed to still be able to open TC 6.0+ files, though the user in question is having trouble: https://sourceforge.net/p/veracrypt/discussion/technical/thread/9f62c2e593/ https://sourceforge.net/p/veracrypt/discussion/technical/thr...
- cypress66 3y ago
  No, recommending bitlocker back then was basically a joke to anyone at that time, an obvious way of telling you something wrong. The obvious recommendation back then was LUKS. And even if there were no alternatives they're not going to recommend you a proprietary solution with a high chance of being backdoored. They'll just say to use "other software".
  - kijin 3y ago
    The majority of TrueCrypt users were on Windows and needed a GUI. Backdoors or not, BitLocker was the only comparable alternative. Recommending BitLocker might have been a signal to hackers in the aftermath of the Snowden revelations, but IIRC the announcement also included a detailed tutorial for setting up BitLocker that was actually quite helpful to anyone whose threat model mostly concrerned thieves, corporate spies, and non-Five Eyes intelligence agencies.
- 13415 3y ago
  This probably has nothing to do with vulnerabilities in the source code, it has to do with the observations that Mounir Idrassi took over truecrypt very fast when it was shut down, yet was not known in cryptography circles prior to this at all, and his company idrix.fr looks a lot like a typical DGSE shell company. It is unclear what kind of contracts it had (if any) before it dedicated seemingly most of its time to Veracrypt. Of course, it would be the binaries that are problem, if there is one. If you vet the source code and compile it yourself, there shouldn't be any issue. Note that the French government has long history of being anti-cryptography for end-consumers. I personally wouldn't even touch Veracrypt with a long pole. But that's just my personal opinion.
  - paulryanrogers 3y ago
    Do you believe the audit was compromised as well? https://ostif.org/the-veracrypt-audit-results/ https://ostif.org/the-veracrypt-audit-results/
    - 13415 3y ago
      They audited the source code. I was talking about the executables on their website. Intelligence agencies tend to substitute binaries with compromised executables when they are downloaded by specific targets. We know that's what the NSA was routinely doing (among other things like hardware interception) from the Snowden revelations. There is no reason to believe DGSE works differently. Of course, it is also possible to provide compromised source code to specific targets if necessary.
      - Ms-J 3y ago
        Replacing binaries for specific targets certainly happens more than one would like. This has even happened specifically with TC and VC files in the past. A mitigating circumstance though with Veracrypt is that the binaries also have detached GPG signatures that one can check against IDRIX's public key to verify that it is in fact what Idrassi has released on the website. It's still possible for actors to tamper with the binaries in other ways even if signed, so it's best to pull from source and periodically check the diffs.
two_in_one 3y ago
LOL, that was when they _removed_ all encryption in their last, final update. That was part of the deal probably, but they made it so obvious that nobody took it seriously. Everybody got the message: something is going wrong. Since then truecrypt was carefully reviewed, some bugs were found, but no backdoors. It was forked and veracrypt is one of those forks. It has enhanced security which makes it annoying to use. For example to disconnect the drive one needs to enter admin's password. That's done because veracrypt doesn't store it. On one hand it makes it more secure, on the other entering passwords many times in public makes it less.
- LoganDark 3y ago
  > For example to disconnect the drive one needs to enter admin's password. That's done because veracrypt doesn't store it. What? For me, VeraCrypt can mount and unmount volumes (on Windows 11) without ever prompting for UAC. It could also do the same on my other, Windows 10 PC.
  - two_in_one 3y ago
    On Ubuntu it requires admin pas on every action. Like mount/unmount. On truecrypt it's on click. Sadly they are not compatible. Not sure, did veracrypt pass external audit like truecrypt?
    - LoganDark 3y ago
      > Not sure, did veracrypt pass external audit like truecrypt? I believe they incorporated the recommendations from TrueCrypt's own audit, and then went through an additional external audit that came up clean.
- sangnoir 3y ago
  > LOL, that was when they _removed_ all encryption in their last, final update That's was the time the other Truecrypt contributors learned that Paul le Roux was in federal custody[1]. Most likely they nukes encryption & gave dire warnings as a scorched earth play to avoid the possibility of an FBI-authored binary release of TrueCrypt, since Paul controlled the website and the infrastructure, IIRC. 1. Warning: linked story is a 3-part longform story that can cause 30-60m to vanish from your day. https://magazine.atavist.com/he-always-had-a-dark-side/ https://magazine.atavist.com/he-always-had-a-dark-side/

Is it better? Even truecrypt's developers (which this is based on) recommend moving to bit locker now, https://truecrypt.sourceforge.net https://truecrypt.sourceforge.net

kijin 3y ago

That was 9 years ago, not "now". BitLocker was the only alternative that they could recommend back then. It's possible that whatever vulnerability the TrueCrypt developers were alluding to still lurks in the VeraCrypt codebase, but the chances seem pretty low. VeraCrypt uses much stronger encryption methods, it has addressed all the issues raised in the original TrueCrypt audit as well as a separate audit of its own code, and the latest version isn't even backward-compatible with TrueCrypt volumes.

rkagerer 3y ago
the latest version isn't even backward-compatible with TrueCrypt volumes Are you sure? I thought it could open them in read-only mode. Here's a 2023 post suggesting it's supposed to still be able to open TC 6.0+ files, though the user in question is having trouble: https://sourceforge.net/p/veracrypt/discussion/technical/thread/9f62c2e593/ https://sourceforge.net/p/veracrypt/discussion/technical/thr...
cypress66 3y ago
No, recommending bitlocker back then was basically a joke to anyone at that time, an obvious way of telling you something wrong. The obvious recommendation back then was LUKS. And even if there were no alternatives they're not going to recommend you a proprietary solution with a high chance of being backdoored. They'll just say to use "other software".
- kijin 3y ago
  The majority of TrueCrypt users were on Windows and needed a GUI. Backdoors or not, BitLocker was the only comparable alternative. Recommending BitLocker might have been a signal to hackers in the aftermath of the Snowden revelations, but IIRC the announcement also included a detailed tutorial for setting up BitLocker that was actually quite helpful to anyone whose threat model mostly concrerned thieves, corporate spies, and non-Five Eyes intelligence agencies.
13415 3y ago
This probably has nothing to do with vulnerabilities in the source code, it has to do with the observations that Mounir Idrassi took over truecrypt very fast when it was shut down, yet was not known in cryptography circles prior to this at all, and his company idrix.fr looks a lot like a typical DGSE shell company. It is unclear what kind of contracts it had (if any) before it dedicated seemingly most of its time to Veracrypt. Of course, it would be the binaries that are problem, if there is one. If you vet the source code and compile it yourself, there shouldn't be any issue. Note that the French government has long history of being anti-cryptography for end-consumers. I personally wouldn't even touch Veracrypt with a long pole. But that's just my personal opinion.
- paulryanrogers 3y ago
  Do you believe the audit was compromised as well? https://ostif.org/the-veracrypt-audit-results/ https://ostif.org/the-veracrypt-audit-results/
  - 13415 3y ago
    They audited the source code. I was talking about the executables on their website. Intelligence agencies tend to substitute binaries with compromised executables when they are downloaded by specific targets. We know that's what the NSA was routinely doing (among other things like hardware interception) from the Snowden revelations. There is no reason to believe DGSE works differently. Of course, it is also possible to provide compromised source code to specific targets if necessary.
    - Ms-J 3y ago
      Replacing binaries for specific targets certainly happens more than one would like. This has even happened specifically with TC and VC files in the past. A mitigating circumstance though with Veracrypt is that the binaries also have detached GPG signatures that one can check against IDRIX's public key to verify that it is in fact what Idrassi has released on the website. It's still possible for actors to tamper with the binaries in other ways even if signed, so it's best to pull from source and periodically check the diffs.

two_in_one 3y ago

LOL, that was when they _removed_ all encryption in their last, final update. That was part of the deal probably, but they made it so obvious that nobody took it seriously. Everybody got the message: something is going wrong. Since then truecrypt was carefully reviewed, some bugs were found, but no backdoors. It was forked and veracrypt is one of those forks. It has enhanced security which makes it annoying to use. For example to disconnect the drive one needs to enter admin's password. That's done because veracrypt doesn't store it. On one hand it makes it more secure, on the other entering passwords many times in public makes it less.

LoganDark 3y ago
> For example to disconnect the drive one needs to enter admin's password. That's done because veracrypt doesn't store it. What? For me, VeraCrypt can mount and unmount volumes (on Windows 11) without ever prompting for UAC. It could also do the same on my other, Windows 10 PC.
- two_in_one 3y ago
  On Ubuntu it requires admin pas on every action. Like mount/unmount. On truecrypt it's on click. Sadly they are not compatible. Not sure, did veracrypt pass external audit like truecrypt?
  - LoganDark 3y ago
    > Not sure, did veracrypt pass external audit like truecrypt? I believe they incorporated the recommendations from TrueCrypt's own audit, and then went through an additional external audit that came up clean.
sangnoir 3y ago
> LOL, that was when they _removed_ all encryption in their last, final update That's was the time the other Truecrypt contributors learned that Paul le Roux was in federal custody[1]. Most likely they nukes encryption & gave dire warnings as a scorched earth play to avoid the possibility of an FBI-authored binary release of TrueCrypt, since Paul controlled the website and the infrastructure, IIRC. 1. Warning: linked story is a 3-part longform story that can cause 30-60m to vanish from your day. https://magazine.atavist.com/he-always-had-a-dark-side/ https://magazine.atavist.com/he-always-had-a-dark-side/