6 ms·

If you're talking about a security product -- which TrueCrypt is -- the first metric you have to concern yourself with is: does it keep you secure? The user exp

If you're talking about a security product -- which TrueCrypt is -- the first metric you have to concern yourself with is: does it keep you secure? The user experience and the adoption and the performance and all that other fun stuff is irrelevant if the product doesn't do the one thing that every user unequivocally requires of it. So yes, it's not just about the crypto...when the crypto works. But when the crypto is insecure, which is what tptacek is saying, then yes, it is ONLY about the crypto. NB: I'm plenty qualified on UX and general technical matters, but on whether crypto is secure, I defer to the experts.

diminoten 12y ago
No one knows about they cryptographic integrity of TrueCrypt, as the person/persons actually doing the work only got their act together today. http://blog.cryptographyengineering.com/2015/02/another-update-on-truecrypt-audit.html http://blog.cryptographyengineering.com/2015/02/another-upda... My only point has been that Thomas, et. al. have been telling us we don't want something like TrueCrypt, despite the fact that we very clearly do. His suggestion of "just use PGP and FS level encryption" is absurd, but NOT from a crypto standpoint (I, like you, defer to Thomas and the other experts on the integrity of the crypto itself). It is, however, absurd from a UX/workflow standpoint.
- tptacek 12y ago
  Horseshit. Round 1 and Round 2 of the audit share technical members. The guy leading the actual crypto review work has been looking at Truecrypt for more than a year. And Matthew Green, who coordinates the whole audit project, just wrote that he and his students have been reviewing Truecrypt's crypto for months. They did not "only get their act together today". They've thought about Truecrypt far more rigorously than you have, and for far, far longer. You've been almost completely unable to explain in technical terms what "UX" you want from sector-level crypto that you couldn't get from filesystem crypto. When pressed, you in effect say "yeah, well, name a tool that does that". The fact that your only options today are [insecure, easy] and [secure, difficult] does not mean that there is no [secure, easy] option possible. But militating in favor of insecure crypto goes a long way towards hiding that possibility from everyone. This isn't a pedantic point. Ross Ulbricht just got reamed in federal court because a simple physical arrest compromised virtually every secret he had. Why? Because he was relying on sector-level all-or-nothing crypto. By encouraging people to rely on tools like Truecrypt, you are, in a very small but real way, endangering them.
  - diminoten 12y ago
    Today was the day Matthew Green released an update on his blog. I was just reading it, and that's exclusively I was referring to. I look forward to the results and am grateful of the time they're spending. I hope they find nothing. Not sure why you made this about me personally.
    - tptacek 12y ago
      This is what you actually wrote: https://www.dropbox.com/s/hy5wj0t1t84hlk4/Screenshot%202015-02-18%2015.46.42.png?dl=0 https://www.dropbox.com/s/hy5wj0t1t84hlk4/Screenshot%202015-... I stand by what I just wrote.
      - deleted 12y ago
        [deleted]
      - diminoten 12y ago
        That's still up there in my comment you replied to, you realize that right?
    - DanBC 12y ago
      > Not sure why you made this about me personally. Your comments in this thread come off as ridiculously aggressive. I'm not sure if you're aware of that.
      - diminoten 12y ago
        There is admittedly a level of aggression I feel when talking to Thomas, as I find his conversational tone off-putting and generally elitist. I thought I did a better job of dealing with that for the most part, however. Maybe not.
        deleted 12y ago
        [deleted]
  - 12y ago

diminoten 12y ago

No one knows about they cryptographic integrity of TrueCrypt, as the person/persons actually doing the work only got their act together today. http://blog.cryptographyengineering.com/2015/02/another-update-on-truecrypt-audit.html http://blog.cryptographyengineering.com/2015/02/another-upda... My only point has been that Thomas, et. al. have been telling us we don't want something like TrueCrypt, despite the fact that we very clearly do. His suggestion of "just use PGP and FS level encryption" is absurd, but NOT from a crypto standpoint (I, like you, defer to Thomas and the other experts on the integrity of the crypto itself). It is, however, absurd from a UX/workflow standpoint.

tptacek 12y ago
Horseshit. Round 1 and Round 2 of the audit share technical members. The guy leading the actual crypto review work has been looking at Truecrypt for more than a year. And Matthew Green, who coordinates the whole audit project, just wrote that he and his students have been reviewing Truecrypt's crypto for months. They did not "only get their act together today". They've thought about Truecrypt far more rigorously than you have, and for far, far longer. You've been almost completely unable to explain in technical terms what "UX" you want from sector-level crypto that you couldn't get from filesystem crypto. When pressed, you in effect say "yeah, well, name a tool that does that". The fact that your only options today are [insecure, easy] and [secure, difficult] does not mean that there is no [secure, easy] option possible. But militating in favor of insecure crypto goes a long way towards hiding that possibility from everyone. This isn't a pedantic point. Ross Ulbricht just got reamed in federal court because a simple physical arrest compromised virtually every secret he had. Why? Because he was relying on sector-level all-or-nothing crypto. By encouraging people to rely on tools like Truecrypt, you are, in a very small but real way, endangering them.
- diminoten 12y ago
  Today was the day Matthew Green released an update on his blog. I was just reading it, and that's exclusively I was referring to. I look forward to the results and am grateful of the time they're spending. I hope they find nothing. Not sure why you made this about me personally.
  - tptacek 12y ago
    This is what you actually wrote: https://www.dropbox.com/s/hy5wj0t1t84hlk4/Screenshot%202015-02-18%2015.46.42.png?dl=0 https://www.dropbox.com/s/hy5wj0t1t84hlk4/Screenshot%202015-... I stand by what I just wrote.
    - deleted 12y ago
      [deleted]
    - diminoten 12y ago
      That's still up there in my comment you replied to, you realize that right?
  - DanBC 12y ago
    > Not sure why you made this about me personally. Your comments in this thread come off as ridiculously aggressive. I'm not sure if you're aware of that.
    - diminoten 12y ago
      There is admittedly a level of aggression I feel when talking to Thomas, as I find his conversational tone off-putting and generally elitist. I thought I did a better job of dealing with that for the most part, however. Maybe not.
      - deleted 12y ago
        [deleted]
- 12y ago