6 ms·

Shouldn't we already know if TrueCrypt is back-doored or not considering its popularity ?

jrochkind1 13y ago
Why would that be? I don't even understand what you're suggesting, why could we assume 'we already know' about a backdoor in a popular product?
- RexRollman 13y ago
  I believe he is just surprised that it not already vetted.
- johnchristopher 13y ago
  Sorry, see https://news.ycombinator.com/item?id=6525398 https://news.ycombinator.com/item?id=6525398
interstitial 13y ago
Like most mortals, I depend on Bruce Schneier: "Since I started working with Snowden's documents, I have been using GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit, and a few other things I'm not going to write about. There's an undocumented encryption feature in my Password Safe program from the command line); I've been using that as well." http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance http://www.theguardian.com/world/2013/sep/05/nsa-how-to-rema...
dublinben 13y ago
There have been several important legal cases that would have significantly benefited from cracking the defendant's TrueCrypt volumes. To my knowledge, these attempts have all been unsuccessful. If the NSA has a backdoor, then they're not sharing it with other law enforcement agencies, and keeping it a better secret than everything else they were up to.
- EthanHeilman 13y ago
  We only know those things that we know. The NSA must still have some secrets.
  - dublinben 13y ago
    Quite right. I wouldn't entrust my life to TrueCrypt, and hope nobody else would either.
    - willvarfar 13y ago
      So what would you trust your life to? If you are a dissident, what products and procedures would security professionals suggest? They'd be hard pressed to recommend any off-the-shelf products or practices right now? Because PKI is in shreds, nobody trusts trucrpyt, and TOR users have been rooted left right and centre recently.
      - jrochkind1 13y ago
        With my life? If a security vulnerability would be life threatening, I would not trust anything on the internet, I'd keep it off the internet -- and maybe even keep it off computers entirely. (Although if they can get physical access to my non-internet computer, they can get physical access to hard copy notes too, of course). Yeah, that's hella inconvenient. But not quite as inconvenient as being murdered or disappeared to a torture prison.
        willvarfar 13y ago
        Compare and contrast with the internet bringing democrazy and the Arab spring...
        kamjam 13y ago
        So how exactly would you communicate, share files and information if you were organizing an uprising for example? You can't always physically transport those files, and sometimes it may be more dangerous to do so (if you are wanted person for example). You also have issue if you are having those files transported cross border then you may get border issues (Philip Greewalds partner being help in UK). For speed and ease, it would have to be via the internet somehow. For higher security, it would have to be non-network connected computers and via USB. For even higher security it would be non-computer but then I would have to memorise everything and I don't have a photographic memory :( I'm not sure what I would do in this case either tbh.

Why would that be? I don't even understand what you're suggesting, why could we assume 'we already know' about a backdoor in a popular product?

RexRollman 13y ago
I believe he is just surprised that it not already vetted.
johnchristopher 13y ago
Sorry, see https://news.ycombinator.com/item?id=6525398 https://news.ycombinator.com/item?id=6525398

interstitial 13y ago

Like most mortals, I depend on Bruce Schneier: "Since I started working with Snowden's documents, I have been using GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit, and a few other things I'm not going to write about. There's an undocumented encryption feature in my Password Safe program from the command line); I've been using that as well." http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance http://www.theguardian.com/world/2013/sep/05/nsa-how-to-rema...

dublinben 13y ago

There have been several important legal cases that would have significantly benefited from cracking the defendant's TrueCrypt volumes. To my knowledge, these attempts have all been unsuccessful. If the NSA has a backdoor, then they're not sharing it with other law enforcement agencies, and keeping it a better secret than everything else they were up to.

EthanHeilman 13y ago
We only know those things that we know. The NSA must still have some secrets.
- dublinben 13y ago
  Quite right. I wouldn't entrust my life to TrueCrypt, and hope nobody else would either.
  - willvarfar 13y ago
    So what would you trust your life to? If you are a dissident, what products and procedures would security professionals suggest? They'd be hard pressed to recommend any off-the-shelf products or practices right now? Because PKI is in shreds, nobody trusts trucrpyt, and TOR users have been rooted left right and centre recently.
    - jrochkind1 13y ago
      With my life? If a security vulnerability would be life threatening, I would not trust anything on the internet, I'd keep it off the internet -- and maybe even keep it off computers entirely. (Although if they can get physical access to my non-internet computer, they can get physical access to hard copy notes too, of course). Yeah, that's hella inconvenient. But not quite as inconvenient as being murdered or disappeared to a torture prison.
      - willvarfar 13y ago
        Compare and contrast with the internet bringing democrazy and the Arab spring...
      - kamjam 13y ago
        So how exactly would you communicate, share files and information if you were organizing an uprising for example? You can't always physically transport those files, and sometimes it may be more dangerous to do so (if you are wanted person for example). You also have issue if you are having those files transported cross border then you may get border issues (Philip Greewalds partner being help in UK). For speed and ease, it would have to be via the internet somehow. For higher security, it would have to be non-network connected computers and via USB. For even higher security it would be non-computer but then I would have to memorise everything and I don't have a photographic memory :( I'm not sure what I would do in this case either tbh.