3 ms·

How long till we hear a similar story about TrueCrypt. Except no one even knows who is behind TrueCrypt. I hope there was some audited fork or another software

How long till we hear a similar story about TrueCrypt. Except no one even knows who is behind TrueCrypt. I hope there was some audited fork or another software with similar features(esp. hidden volumes) from a reputable company I could use.

mariusmg 13y ago
Why is so important to "know" who is behind TrueCrypt ? They publish the code and you can inspect it and build it yourself if you don't trust the provided binaries.
- nivla 13y ago
  The issue is that the source code is too complex to audit personally. Having no real identity behind it also removes the risk of finger pointing if a backdoor were to be discovered. "There has been no known comprehensive review of the source code by a qualified cryptographer.[46][44] Thorough security code review and testing is hard, tedious, and painstaking work, and very few people have the skills to do it. There was, however, a functional evaluation of the deniability of hidden volumes in an earlier version of TrueCrypt by Schneier et al. that found security leaks." [1] [1]https://en.wikipedia.org/wiki/Truecrypt#Reasonable_paranoia https://en.wikipedia.org/wiki/Truecrypt#Reasonable_paranoia
  - mariusmg 13y ago
    If you go down this line of thinking, you can only trust the code you wrote yourself. Having a couple of dudes publicly recognizing that they wrote TrueCrypt doesn't actually solves anything.
  - miopa 13y ago
    It's about time then that few qualified cryptographers make an audit. Kickstarter project maybe.
miopa 13y ago
I'll be the devil's advocate. Insightful encryption app developer would hide his identity in order not to be bullied into putting backdoors.
cdh 13y ago
PGP? It does whole disk encryption, but I don't think it does hidden volumes. (I could be wrong.) I'm not sure if you consider it reputable or not, but the source has been available, at least for recent versions. I'm not sure about the current version. http://www.symantec.com/connect/downloads/symantec-pgp-desktop-source-code http://www.symantec.com/connect/downloads/symantec-pgp-deskt...

mariusmg 13y ago

Why is so important to "know" who is behind TrueCrypt ? They publish the code and you can inspect it and build it yourself if you don't trust the provided binaries.

nivla 13y ago
The issue is that the source code is too complex to audit personally. Having no real identity behind it also removes the risk of finger pointing if a backdoor were to be discovered. "There has been no known comprehensive review of the source code by a qualified cryptographer.[46][44] Thorough security code review and testing is hard, tedious, and painstaking work, and very few people have the skills to do it. There was, however, a functional evaluation of the deniability of hidden volumes in an earlier version of TrueCrypt by Schneier et al. that found security leaks." [1] [1]https://en.wikipedia.org/wiki/Truecrypt#Reasonable_paranoia https://en.wikipedia.org/wiki/Truecrypt#Reasonable_paranoia
- mariusmg 13y ago
  If you go down this line of thinking, you can only trust the code you wrote yourself. Having a couple of dudes publicly recognizing that they wrote TrueCrypt doesn't actually solves anything.
- miopa 13y ago
  It's about time then that few qualified cryptographers make an audit. Kickstarter project maybe.

miopa 13y ago

I'll be the devil's advocate. Insightful encryption app developer would hide his identity in order not to be bullied into putting backdoors.

cdh 13y ago

PGP? It does whole disk encryption, but I don't think it does hidden volumes. (I could be wrong.) I'm not sure if you consider it reputable or not, but the source has been available, at least for recent versions. I'm not sure about the current version. http://www.symantec.com/connect/downloads/symantec-pgp-desktop-source-code http://www.symantec.com/connect/downloads/symantec-pgp-deskt...