6 ms·

I would just use the built-in disk encryption solutions your platform offers. This is also what the TrueCrypt developer recommends.

by sdevlin 12y ago

huhtenberg 12y ago
> This is also what the TrueCrypt developer recommends. You can't be seriously deferring to that? The end-of-the-line announcement was so completely out of sync with all previous communications from the TC devs, so un-TrueCrypt like, that everything it said should be taken with a huge grain of salt. _Especially_ any advice pertaining to better managing one's security needs.
- tptacek 12y ago
  I'm not sure I know of a professional cryptography engineer who believes that what happened with Truecrypt is anything more than what that developer said. Can you cite one?
  - huhtenberg 12y ago
    They believe that, huh? Interesting wording.
  - LordKano 12y ago
    What convinces me that there is more to the story is what they haven't said.
  - compbio 12y ago
    But maybe what they did today makes that impossible. They set the whole thing on fire, and now maybe nobody is going to trust it because they’ll think there’s some big evil vulnerability in the code. But now this decision makes me feel like they’re kind of unreliable. Also, I’m a little worried that the fact that we were doing an audit of the crypto might have made them decide to call it quits. - Matthew Green TrueCrypt's developers chose not to graciously turn their beloved creation over to a wider Internet development community, but rather, ... to attempt to kill it off by creating a dramatically neutered 7.2 version ... - Steve Gibson I have no idea what's going on with TrueCrypt, Speculations include a massive hack of the TrueCrypt developers, some Lavabit-like forced shutdown, and an internal power struggle within TrueCrypt. I suppose we'll have to wait and see what develops. - Bruce Schneier.
    - tptacek 11y ago
      Matthew Green does not believe there is a Truecrypt conspiracy. Source: I've discussed this with him at length as an advisor to the TC audit project. Steve Gibson isn't a cryptographer, and your quote doesn't respond to my question. Bruce Schneier I'll have to accept as a totally valid rebuttal to my implied point. This is something that really irritates me about Schneier, for what it's worth. He's also behind a meme that elliptic curve cryptography is less safe than RSA, when the reality is almost the opposite.
      - compbio 11y ago
        I think those quotes were a bit snotty, especially considering your stature and knowledge on this. I don't think I was trying to rebut you, as much as I was simply trying my luck at advocating that user's view. Sorry for that.
- sdevlin 12y ago
  I wouldn't say I'm "deferring" to it. It does align with what I think is the best option.
  - huhtenberg 12y ago
    > This is also what the TrueCrypt developer recommends. Given the context of the thread, how is this not using developer's recommendation as an endorsement? What TC dev said bears absolutely zero weight regardless of whether it aligns with your opinion or not.
    - sdevlin 12y ago
      The context of the thread is a report with my name on it. My professional opinion is my own. The developer's opinion is also relevant (to people who don't buy into nonsensical conspiracy theories), so I mentioned it.
diminoten 12y ago
What's your opinion of XTS in general for disk encryption? Are there any known exploitations of weakness in XTS that might work their way back to TrueCrypt? Most folks use TrueCrypt's disk encryption as a "file container", when they effectively want to encrypt files. Do you know of any tools (cross-platform or otherwise) that would provide the same UX as TrueCrypt while not relying on FDE?
- sdevlin 12y ago
  I think it's fine. For the limited threat model FDE is equipped to handle, XTS does the job. I'm not sure what the best answer is to your second question. I wouldn't use TC for that. I would typically use PGP, but I don't think it has a good UX for general consumption. There may be room for someone to build a better product.
- peter_tonoli 12y ago
  Coincidentally (?), You Don't Want XTS (2014) https://news.ycombinator.com/item?id=9312599 https://news.ycombinator.com/item?id=9312599 was re-posted today, opining on this question.

I would just use the built-in disk encryption solutions your platform offers. This is also what the TrueCrypt developer recommends.

by sdevlin 12y ago

I would just use the built-in disk encryption solutions your platform offers. This is also what the TrueCrypt developer recommends.

huhtenberg 12y ago

> This is also what the TrueCrypt developer recommends. You can't be seriously deferring to that? The end-of-the-line announcement was so completely out of sync with all previous communications from the TC devs, so un-TrueCrypt like, that everything it said should be taken with a huge grain of salt. _Especially_ any advice pertaining to better managing one's security needs.

tptacek 12y ago
I'm not sure I know of a professional cryptography engineer who believes that what happened with Truecrypt is anything more than what that developer said. Can you cite one?
- huhtenberg 12y ago
  They believe that, huh? Interesting wording.
- LordKano 12y ago
  What convinces me that there is more to the story is what they haven't said.
- compbio 12y ago
  But maybe what they did today makes that impossible. They set the whole thing on fire, and now maybe nobody is going to trust it because they’ll think there’s some big evil vulnerability in the code. But now this decision makes me feel like they’re kind of unreliable. Also, I’m a little worried that the fact that we were doing an audit of the crypto might have made them decide to call it quits. - Matthew Green TrueCrypt's developers chose not to graciously turn their beloved creation over to a wider Internet development community, but rather, ... to attempt to kill it off by creating a dramatically neutered 7.2 version ... - Steve Gibson I have no idea what's going on with TrueCrypt, Speculations include a massive hack of the TrueCrypt developers, some Lavabit-like forced shutdown, and an internal power struggle within TrueCrypt. I suppose we'll have to wait and see what develops. - Bruce Schneier.
  - tptacek 11y ago
    Matthew Green does not believe there is a Truecrypt conspiracy. Source: I've discussed this with him at length as an advisor to the TC audit project. Steve Gibson isn't a cryptographer, and your quote doesn't respond to my question. Bruce Schneier I'll have to accept as a totally valid rebuttal to my implied point. This is something that really irritates me about Schneier, for what it's worth. He's also behind a meme that elliptic curve cryptography is less safe than RSA, when the reality is almost the opposite.
    - compbio 11y ago
      I think those quotes were a bit snotty, especially considering your stature and knowledge on this. I don't think I was trying to rebut you, as much as I was simply trying my luck at advocating that user's view. Sorry for that.
sdevlin 12y ago
I wouldn't say I'm "deferring" to it. It does align with what I think is the best option.
- huhtenberg 12y ago
  > This is also what the TrueCrypt developer recommends. Given the context of the thread, how is this not using developer's recommendation as an endorsement? What TC dev said bears absolutely zero weight regardless of whether it aligns with your opinion or not.
  - sdevlin 12y ago
    The context of the thread is a report with my name on it. My professional opinion is my own. The developer's opinion is also relevant (to people who don't buy into nonsensical conspiracy theories), so I mentioned it.

diminoten 12y ago

What's your opinion of XTS in general for disk encryption? Are there any known exploitations of weakness in XTS that might work their way back to TrueCrypt? Most folks use TrueCrypt's disk encryption as a "file container", when they effectively want to encrypt files. Do you know of any tools (cross-platform or otherwise) that would provide the same UX as TrueCrypt while not relying on FDE?

sdevlin 12y ago
I think it's fine. For the limited threat model FDE is equipped to handle, XTS does the job. I'm not sure what the best answer is to your second question. I wouldn't use TC for that. I would typically use PGP, but I don't think it has a good UX for general consumption. There may be room for someone to build a better product.
peter_tonoli 12y ago
Coincidentally (?), You Don't Want XTS (2014) https://news.ycombinator.com/item?id=9312599 https://news.ycombinator.com/item?id=9312599 was re-posted today, opining on this question.