3 ms·
A naive person googling about TrueCrypt and stumbling on this article (well written with an authoritative tone) will think that TrueCrypt is completely cracked,
by alister 13y ago
A naive person googling about TrueCrypt and stumbling on this article (well written with an authoritative tone) will think that TrueCrypt is completely cracked, and not bother to use it.
This research is interesting and useful, but do we really want to scare off people from using TrueCrypt?
Couldn't you add a paragraph at the top or to the side that says, for example:
"If TrueCrypt is used in the intended way, i.e., you finish your work with TrueCrypt, dismount the TrueCrypt volume, and then shut down your computer, then the data protected by TrueCrypt is secure if your computer is lost, stolen, or copied at that point."
I understand your intended audience (I'm one of them). But TrueCrypt is the best protection we've got (in terms of price (free), quality, license terms, multi-platform support, algorithm choice, etc.). I presume the author likes it and uses it himself too.
We want more people to use it, right? So let's at least make it clear that it isn't cracked or broken when used in the intended manner.
- arbitrage 13y agoWe want more people to use it intelligently. If they're not capable of understanding the implications of this research, are they really going to be able to use this software effectively? How much hand holding do we need to do, here?
- spitfire 13y ago> How much hand holding do we need to do, here? A lot more than is currently the standard. Security is a horribly complex subject, and the people that need it most often don't have the time or knowledge to judge tools and sort out implementation details.
- nitrogen 13y agoHow much hand holding do we need to do, here? I don't know who "we" would be in this case, but in general, I'd like to see enough hand holding that everybody can use encryption safely and confidently without having to be cpercival or tptacek.
- imhlv2 13y agoAcknowledged - I added a few words about this to the end of the post.
- lstamour 13y agoThanks for the edit, I really liked the link to the cold boot abstract. Somehow I keep forgetting physical access in a world of radio-controlled computer implants and thunderbolt/firewire DMA. The examples really made the article shine. I knew you could dump memory, but seeing identification tools in action is ... too easy! :)
- altrego99 13y agoCan't Truecrypt secure erase sensitive data they keep in the RAM, say by overwriting the variables with random noise, when a volume is dismounted? If so, I'd say anyone who participates in Truecrypt's development is also intended audience.
- FireBeyond 13y agoYes and no. On one hand, we want to specify that it's not vulnerable, on the other, it is important to discuss this thoroughly. Ensure that people can understand the ramifications of this discovery - short of doing nothing, nothing is less secure than using security software "badly", or "incorrectly" - that false visage of security can be deceptive and lead to other bad practices. I just noticed that the author commented that he attempted to add some clarity to this effect.
- mcgwiz 13y agoThe addition you're recommending is somewhat orthogonal to the article. The update at the end of the article clarifies that all one must do, strictly speaking, to protect against the weakness they describe is to power the computer down. If an adversary is knocking down your door, it's seems more important to get the keys out of RAM than to first ensure filesystem and OS integrity by saving/dismounting and cleanly shutting down.
- kabouseng 13y agoYour average Joe wont be reading this article... As soon as he sees the technical nature of the discussion, he'll move on.