4 ms·

Out of curiosity, wouldn't the open-source TrueCrypt be better than the closed BitLocker? (assuming, of course, that TrueCrypt was not already compromised)

by nness 12y ago

Omniusaspirer 12y ago
That would be my opinion, but then I'd probably bet everything I own on BitLocker containing a backdoor of some sort.
theboss 12y ago
There are pros and cons to both closed source and open source. Open source is nice because the community can audit the code and see for themselves, but closed-source is nice because a company generally has the resources to maintain and build software correctly. Both of these are hypothetical, however. We've seen tons of vulnerabilities from both. IMHO Open Source works a lot better on paper but once projects get very large auditing them is really hard...which definitely cuts down on the amount of eyes looking at them.
- Nursie 12y ago
  >>closed-source is nice because a company generally has the resources to maintain and build software correctly. These two things are orthogonal, IMHO.
  - theboss 12y ago
    My post is "on paper". In reality, projects are squeezed for nickels and dimes. My point is that while open-source should be better, right now it seems that everything is equally not good enough.
grrowl 12y ago
I don't believe BitLocker can be considered secure. Cross-post (mine) from the previous thread: > Not "backdoors" but it seems Microsoft stores the BitLocker decryption key, based on this leaked slide (just found on twitter): https://twitter.com/TheBlogPirate/status/471759810644283392/photo/1 https://twitter.com/TheBlogPirate/status/471759810644283392/... > edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microsoft.com/en-AU/windows-8/bitlocker-recovery-keys-faq http://windows.microsoft.com/en-AU/windows-8/bitlocker-recov...
- danparsonson 12y ago
  > Not "backdoors" but it seems Microsoft stores the BitLocker decryption key, based on this leaked slide (just found on twitter): https://twitter.com/TheBlogPirate/status/471759810644283392/.. https://twitter.com/TheBlogPirate/status/471759810644283392/.... That looks dubious to me - if you were creating a slide, would you use 90-degree-rotated text? > edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microsoft.com/en-AU/windows-8/bitlocker-recov.. http://windows.microsoft.com/en-AU/windows-8/bitlocker-recov.... "There are several locations in which your BitLocker recovery key might have been saved" - emphasis mine - doesn't this mean they'll store the key if you log into "Your Microsoft account"? I have to admit I don't use Windows 8 so I don't know if this is mandatory or not? What about Windows 7?
  - andyjohnson0 12y ago
    Using a Microsoft account for login is not mandatory on Windows 8.
    - makomk 12y ago
      It's not mandatory to use a Microsoft account for login, but they've been hiding the option not to in increasingly obscure locations in the installer. At one point, the easiest way to do it was apparently to just unplug your internet connection!
  - MichaelGG 12y ago
    Maybe Microsoft asks or somehow prompts the user to back up their encryption keys? I mean, a user-focused OS certainly wouldn't include such a feature, right?
    - danparsonson 12y ago
      The question was not whether or not they might do it but whether or not they always did it. If a user is required to submit their encryption key to a third party for storage then the encryption solution is limited by their trust in the third party.
hrjet 12y ago
I do believe that open-source solutions are better when concerned about privacy and security. But why would a user of a mostly closed-source OS bother about the open-source nature of one component of that OS?
easytiger 12y ago
Surely it would also take very little effort to implement an alternative to truecrypt? What's the big deal
- drKarl 12y ago
  Security is hard. Encryption is hard. And don't call me Shirley!
- danielweber 12y ago
  If you are being sarcastic, you should be aware of Poe's law, which means we can't tell.
- venomsnake 12y ago
  Well implement one. While getting the encryption right is possible. There comes the pesky problems with presenting stuff to windows as a volume that works as well.
  - easytiger 12y ago
    Well peer reviewed encryption libraries would take care of a huge proportion of that. http://dokan-dev.net/en/ http://dokan-dev.net/en/ might work on windows for implementing something you might otherwise do via FUSE. Can't speak for windows as ive not used it for a decade or more.

Out of curiosity, wouldn't the open-source TrueCrypt be better than the closed BitLocker? (assuming, of course, that TrueCrypt was not already compromised)

by nness 12y ago

Out of curiosity, wouldn't the open-source TrueCrypt be better than the closed BitLocker? (assuming, of course, that TrueCrypt was not already compromised)

Omniusaspirer 12y ago

That would be my opinion, but then I'd probably bet everything I own on BitLocker containing a backdoor of some sort.

theboss 12y ago

There are pros and cons to both closed source and open source. Open source is nice because the community can audit the code and see for themselves, but closed-source is nice because a company generally has the resources to maintain and build software correctly. Both of these are hypothetical, however. We've seen tons of vulnerabilities from both. IMHO Open Source works a lot better on paper but once projects get very large auditing them is really hard...which definitely cuts down on the amount of eyes looking at them.

Nursie 12y ago
>>closed-source is nice because a company generally has the resources to maintain and build software correctly. These two things are orthogonal, IMHO.
- theboss 12y ago
  My post is "on paper". In reality, projects are squeezed for nickels and dimes. My point is that while open-source should be better, right now it seems that everything is equally not good enough.

grrowl 12y ago

I don't believe BitLocker can be considered secure. Cross-post (mine) from the previous thread: > Not "backdoors" but it seems Microsoft stores the BitLocker decryption key, based on this leaked slide (just found on twitter): https://twitter.com/TheBlogPirate/status/471759810644283392/photo/1 https://twitter.com/TheBlogPirate/status/471759810644283392/... > edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microsoft.com/en-AU/windows-8/bitlocker-recovery-keys-faq http://windows.microsoft.com/en-AU/windows-8/bitlocker-recov...

danparsonson 12y ago
> Not "backdoors" but it seems Microsoft stores the BitLocker decryption key, based on this leaked slide (just found on twitter): https://twitter.com/TheBlogPirate/status/471759810644283392/.. https://twitter.com/TheBlogPirate/status/471759810644283392/.... That looks dubious to me - if you were creating a slide, would you use 90-degree-rotated text? > edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microsoft.com/en-AU/windows-8/bitlocker-recov.. http://windows.microsoft.com/en-AU/windows-8/bitlocker-recov.... "There are several locations in which your BitLocker recovery key might have been saved" - emphasis mine - doesn't this mean they'll store the key if you log into "Your Microsoft account"? I have to admit I don't use Windows 8 so I don't know if this is mandatory or not? What about Windows 7?
- andyjohnson0 12y ago
  Using a Microsoft account for login is not mandatory on Windows 8.
  - makomk 12y ago
    It's not mandatory to use a Microsoft account for login, but they've been hiding the option not to in increasingly obscure locations in the installer. At one point, the easiest way to do it was apparently to just unplug your internet connection!
- MichaelGG 12y ago
  Maybe Microsoft asks or somehow prompts the user to back up their encryption keys? I mean, a user-focused OS certainly wouldn't include such a feature, right?
  - danparsonson 12y ago
    The question was not whether or not they might do it but whether or not they always did it. If a user is required to submit their encryption key to a third party for storage then the encryption solution is limited by their trust in the third party.

hrjet 12y ago

I do believe that open-source solutions are better when concerned about privacy and security. But why would a user of a mostly closed-source OS bother about the open-source nature of one component of that OS?

easytiger 12y ago

Surely it would also take very little effort to implement an alternative to truecrypt? What's the big deal

drKarl 12y ago
Security is hard. Encryption is hard. And don't call me Shirley!
danielweber 12y ago
If you are being sarcastic, you should be aware of Poe's law, which means we can't tell.
venomsnake 12y ago
Well implement one. While getting the encryption right is possible. There comes the pesky problems with presenting stuff to windows as a volume that works as well.
- easytiger 12y ago
  Well peer reviewed encryption libraries would take care of a huge proportion of that. http://dokan-dev.net/en/ http://dokan-dev.net/en/ might work on windows for implementing something you might otherwise do via FUSE. Can't speak for windows as ive not used it for a decade or more.