4 ms·

Same was true of Truecrypt. After the core team disbanded there was a full security audit which uncovered some very minor issues. People never really trusted

• hypeatei 2y ago
  > People never really trusted Veracrypt though Can you expand on this? It was my understanding that Veracrypt is the new de-facto standard.
  • dijit 2y ago
    Bitlocker, LUKS and FileVault are the new standard(s). Veracrypt is a curiousity, not beloved the way truecrypt was. I’d love to see hard numbers for this, just my outside impression. In fact, when trying to find old forums that I was part of during that era, I failed; and found only this: https://discuss.privacyguides.net/t/why-people-still-believe-truecrypt-is-much-better-than-veracrypt/18295 https://discuss.privacyguides.net/t/why-people-still-believe...
    • UberFly 2y ago
      This is complete conjecture. Like Truecrypt, Veracrypt is open source, has been audited and has been actively maintained. Could it use another audit? Sure but so could Bitlocker but that isn't happening for even the first time any time soon.
      • dijit 2y ago
        I read this as intended to be some kind of rebuttal but… Where did I say it wasn't conjecture? I was stating facts about the ecosystem. People didn't trust it at the time. I never said there was a definite reason for that distrust.
        • trompetenaccoun 2y ago
          Never heard of any credible reasons to distrust Veracrypt. Don't know who these "people" are either, none of the comments named anything more concrete than what sounds like online rumors.
• fencepost 2y ago
  IIRC there were a lot more options by the time of the Truecrypt-Veracrypt shift. Truecrypt was around when drive encryption was otherwise an expensive enterprise software thing, but I think Bitlocker was included with Pro versions of Windows by the time of Veracrypt so that probably became the easiest free option - and probably with better compatibility as well.
  • no-dr-onboard 2y ago
    this presumes that anyone would trust bitlocker. https://pulsesecurity.co.nz/articles/TPM-sniffing https://pulsesecurity.co.nz/articles/TPM-sniffing
    • bri3d 2y ago
      Being able to sniff a key as it transits a local bus is a very different kind of compromise of "trust" than believing that something is preemptively backdoored by a threat actor. It is deeply mysterious that Microsoft don't simply use TPM encrypted sessions to prevent this, though.
      • dylan604 2y ago
        Isn't this yet another example of if they have your physical machine, it's already game over?
        • bri3d 2y ago
          No? Any modern disk encryption system with a strong passphrase (basically, anything but default-BitLocker) is very effective against "they have your physical machine and it's off" for any known, current adversary. And, the basic cryptography in use is common, robust, and proven enough that this is probably true even if your tinfoil hat is balled quite tightly. Where modern research effort goes is into protecting against "they HAD your physical machine and they gave it back to you" or "they got your machine while it was on/running" - these are much more difficult problems to solve, and are where TEE, TPM, Secure Boot, memory encryption, DMA hardening, etc. come into play.