Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi all! We have been experiencing an issue on site where threads have been missing the latest postings. The platform host Vanilla are working on this issue. A workaround that has been used by some is to navigate back from 1 to 10+ pages to re-sync the thread and this will then show the latest posts. Thanks, Mike.
Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest

Truecrypt development stopped. Recommend changing to Bitlocker.

13»

Comments

  • #102
    howamidifferent
    Registered Users, Registered Users 2 Posts: 1,819 ✭✭✭howamidifferent


    Flaws discovered in Truecrypt.

    http://www.itworld.com/article/2987438/newly-found-truecrypt-flaw-allows-full-system-compromise.html


  • #103
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    howamidifferent wrote:
    Flaws

    Great article, thanks! Gratifying to know that the flaws have been fixed in Veracrypt, as I use Linux version.

    According to the article Windows users may still be using Truecrypt as there aren't many encryption options for the OS.

    Compare and contrast with Linux which has built in encryption options via tools like LUKS, dm-crypt and gpg - there really is no comparison when it comes to security! :)


  • #104
    BoB_BoT
    Registered Users, Registered Users 2 Posts: 1,835 ✭✭✭BoB_BoT


    I'm going to wait the couple of days until he releases what the "flaws" are before moving any machine's over to Veracrypt.

    If it's a case where it's extremely complicated to reproduce the exact criteria to access the data, then it's not an immediate threat to the users I have on truecrypt. However, if it means the volumes/containers can be accessed externally (i.e. pop the hard drive out) with little difficulty, I'm going to have a very busy week.


  • #105
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    BoB_BoT wrote: »
    I'm going to wait the couple of days until he releases what the "flaws" are before moving any machine's over to Veracrypt.

    If it's a case where it's extremely complicated to reproduce the exact criteria to access the data, then it's not an immediate threat to the users I have on truecrypt. However, if it means the volumes/containers can be accessed externally (i.e. pop the hard drive out) with little difficulty, I'm going to have a very busy week.

    Do you have many machines using Truecrypt Bob? I completely understand your options on Windows are limited. It's a shame that Veracrypt can't open Truecrypt containers any more! :)

    Update : It seems according to Veracrypt FAQ that the software actually still can open Truecrypt volumes and can be installed alongside Truecrypt without any issues. We need more info as you say on what these flaws are! :)


  • #106
    beauf
    Closed Accounts Posts: 22,648 ✭✭✭✭beauf


    I still will use truecrypt for file containers. It's much handier than Vera. I just use it for privacy not security.

    I must try Vera again. I didn't like it the last time I tried it. Was a bit clunky.

    There's a few commercial options for windows. You see those a lot in big organisations.


  • #107
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    beauf wrote: »
    I still will use truecrypt for file containers. It's much handier than Vera. I just use it for privacy not security.

    I must try Vera again. I didn't like it the last time I tried it. Was a bit clunky.

    There's a few commercial options for windows. You see those a lot in big organisations.

    Can I ask beauf what you mean about using Truecrypt for privacy but not for security?

    As you say there are a few alternatives for Windows - I wonder though how many there are for system encryption - haven't used Windows for a long time! :)

    Update : My learned friends has pointed me to this website for encryption program alternatives, particularly if you don't fancy relying solely on Bitlocker.


  • #108
    beauf
    Closed Accounts Posts: 22,648 ✭✭✭✭beauf


    I just if I lose the device, laptop, flash drive, so regular scrotes can't muck with it. I doubt they'll be able to use these flaws to decrypt the data. I'm not encrypting any sensitive information. Or all my account details in the caymans. That warrants attention from someone more technical. I'd be more at risk from hacker exploiting some browser flaw, when I was logging on to something, or buying something.


  • #109
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    beauf wrote: »
    I just if I lose the device, laptop, flash drive, so regular scrotes can't muck with it. I doubt they'll be able to use these flaws to decrypt the data. I'm not encrypting any sensitive information. Or all my account details in the caymans. That warrants attention from someone more technical. I'd be more at risk from hacker exploiting some browser flaw, when I was logging on to something, or buying something.

    Ah, I see what you mean, you're not trying to protect yourself from jackbooted government thugs seizing your equipment so much as idiotic thieves who might break in and steal it, gotcha!

    You're right in saying that there are many more risks associated with going online. Then again if you encrypt your data on an airgapped machine you're very unlikely to have issues either way - not very helpful though if you want to buy an airline ticket online I admit! :)


  • #110
    beauf
    Closed Accounts Posts: 22,648 ✭✭✭✭beauf


    Indirectly I have that already. As my data is on encrypted external disks. Mainly because a SSD is my main disk and isn't big enough for the data anyway.


  • #111
    BoB_BoT
    Registered Users, Registered Users 2 Posts: 1,835 ✭✭✭BoB_BoT


    Bit more detail on the actual vulnerabilities although not exactly how they're exploited. http://thehackernews.com/2015/09/truecrypt-encryption-software.html

    After reading the above, I'm still not overly worried. It sounds like the users have more chance of having their data hijacked by a piece of malware.

    The main concern I had is if the disk / flash drive could be removed from a device, plugged into another and decrypted without the encryption key. Anytime I've used truecrypt for laptops/pc's it was full disk encryption, time to move them onto something else I think. May even have to go down the managed encryption route.


  • Advertisement
  • #112
    BoB_BoT
    Registered Users, Registered Users 2 Posts: 1,835 ✭✭✭BoB_BoT


    anvilfour wrote: »
    Do you have many machines using Truecrypt Bob? I completely understand your options on Windows are limited. It's a shame that Veracrypt can't open Truecrypt containers any more! :)

    Running it on a couple of personal machines, not so much on clients, except for some that just wanted basic encryption without the cost of management etc...
    I was using it on work flash drives for years, but moved to hardware based encryption for ease of use.

    Again I don't transport anything that's sensitive, but it'd be a pain in the hole and embarrassing if I potentially lost client data (sensitive or not) that could be picked up by someone off the street.


  • #113
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    BoB_BoT wrote: »
    Running it on a couple of personal machines, not so much on clients, except for some that just wanted basic encryption without the cost of management etc...
    I was using it on work flash drives for years, but moved to hardware based encryption for ease of use.

    Again I don't transport anything that's sensitive, but it'd be a pain in the hole and embarrassing if I potentially lost client data (sensitive or not) that could be picked up by someone off the street.

    Again this is one of the beauties of linux... the disk manager can format and encrypt a USB drive with AES straight out of the box... Pleased to hear you're keeping your customer's information safe, I wish all companies were that obliging! :)


  • #114
    trout
    Registered Users, Registered Users 2 Posts: 9,945 ✭✭✭trout


    Just spotted this ... the German government sponsored Fraunhofer Institute for Secure Information Technology audit of TrueCrypt is complete; report is published.

    "Overall, the analysis did not identify any evidence that the guaranteed encryption characteristics are not fulfilled in the implementation of TrueCrypt. In particular, a comparison of the cryptographic functions with reference implementations or test vectors did not identify any deviations. The application of cryptography in TrueCrypt is not optimal. The AES implementation is not timing-resistant, key files are not used in a cryptographically secure way and the integrity of volume headers is not properly protected."

    http://sseblog.ec-spride.de/2015/11/truecrypt-analysis/

    http://www.theregister.co.uk/2015/11/23/truecrypt_anlaysis/

    Not exactly a ringing endorsement, nor a scathing criticism ... can't imagine too many people will change their habits as a result.


    tl;dr ... TrueCrypt, meh


  • #115
    DublinWriter
    Registered Users, Registered Users 2 Posts: 9,559 ✭✭✭DublinWriter


    I always thought the issue with TrueCrypt was the storage of keys in the Windows .hib file?


  • #116
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    DublinWriter wrote: »
    I always thought the issue with TrueCrypt was the storage of keys in the Windows .hib file?

    Hi DublinWriter,

    There are a number of security concerns. My understanding is that Truecrypt can encrypt the hibernation file but in fairness to the manual on the website it does say that you can't rely on full disk encryption when a device is hibernated versus being fully shut down (indeed I ran afoul of this myself a few years back but that's another story!).

    You're right in saying though that one of the main concerns is with the Windows version. A string of random numbers is saved into the header of each volume for no good reason (in Linux the same area is just an encrypted string of zeroes).

    That said I suppose it's academic to debate it's trustworthiness now it's not in active development. I've had a fun time using Veracrypt on my Mac but as for Linux, it's probably best just to use the built in encryption tools.


  • #117
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    Just been reading the abstract of what seems to be a very interesting paper on how Police are responding to full disk encryption.

    See also here a few case studies where Police genuinely have been stumped by someone using Encryption.

    The first paper mentions the 'Iceman' Case:
    In the Max Ray Butler (Iceman) case, the digital investigators expected to encounter encryption and the on-scene search was planned accordingly to maximize the opportunity to gain access to running systems, whether they were locked or not. Gaining access to cryptographic data during the search permitted the subsequent decryption of his FDE systems and an assortment of encrypted containers on external drives. This greatly added to initial evidence of the sale of encoding data for several thousand credit cards, leading to Butler’s eventual conviction for the theft of data for nearly 2 million unique payment cards. It also gave investigators access to artifacts
    from more than a hundred intrusions over several years.

    So it seems that given enough resources and if the Police are aware you use FDE, it informs their procedures accordingly. I don't see anything too scary here though. Most of the strategies employed involve them being able to make a copy of a live system so as long as you keep your devices fully powered off, you don't have too much to worry about - also the techniques they employ wouldn't be much good if you'd stored your encrypted data on removable media.


Advertisement