Slashdot Mirror
VeraCrypt Security Audit Reveals Many Flaws, Some Already Patched (helpnetsecurity.com)
Orome1 quotes Help Net Security: VeraCrypt, the free, open source disk encryption software based on TrueCrypt, has been audited by experts from cybersecurity company Quarkslab. The researchers found 8 critical, 3 medium, and 15 low-severity vulnerabilities, and some of them have already been addressed in version 1.19 of the software, which was released on the same day as the audit report [which has mitigations for the still-unpatched vulnerabilities].
Anyone want to share their experiences with VeraCrypt? Two Quarkslab engineers spent more than a month on the audit, which was funded (and requested) by the non-profit Open Source Technology Improvement Fund "to evaluate the security of the features brought by VeraCrypt since the publication of the audit results on TrueCrypt 7.1a conducted by the Open Crypto Audit Project." Their report concludes that VeraCrypt's security "is improving which is a good thing for people who want to use a disk encryption software," adding that its main developer "was very positive along the audit, answering all questions, raising issues, discussing findings constructively..."
Anyone want to share their experiences with VeraCrypt? Two Quarkslab engineers spent more than a month on the audit, which was funded (and requested) by the non-profit Open Source Technology Improvement Fund "to evaluate the security of the features brought by VeraCrypt since the publication of the audit results on TrueCrypt 7.1a conducted by the Open Crypto Audit Project." Their report concludes that VeraCrypt's security "is improving which is a good thing for people who want to use a disk encryption software," adding that its main developer "was very positive along the audit, answering all questions, raising issues, discussing findings constructively..."
VeraCrypt/True were already secure -enough-. Cracking through the holes is usually more effort than local law enforcement, your boss or the local mob will care about. If you're on the radar of worse people, they can toss you in jail or threaten your family. So while I consider better security a good thing when it doesn't increase cost or inconvenience, it's not really an essential move forward.
The bigger problem is common passwords, leaving the volume open, having open drives automatically backed up to "the cloud", emailing documents... things these security code fixes cannot address. We don't hear often that the Feds have used a security hole to extract data from a user's system.
Honest question. Should we be using TrueCrypt 7.1a instead? I, personally, am. We live in scary times, and it is hard to trust any authority. I feel that TrueCrypt 7.1a, the last version prior to the strange shut down of the project, is probably less likely to have backdoors than any of the newer TrueCrypt versions or forks (specifically, VeraCrypt and CipherShed). Can someone convince me otherwise?
Has there been any similar audit of dmcrypt?
I am not a security expert and can't tell you whether Veracrypt is 100% secure, but I've been using it and I'm reasonably convinced that at least nobody short of a 'state actor' is likely to get at my data, and they're not the people I'm securing data from. It's the petty thieves who might steal my backup drives, or somebody who finds a USB stick I accidentally drop on the ground, that I'm protecting myself from.
I've been to the support forums for Veracrypt and my impression is the developer is trying hard to be transparent and responsive and make the product as secure as possible.
RETURN without GOSUB in line 1050
VeraCrypt forces long iteration on shorter passphrases (>70 sec on my laptop, i.e. unusable), regardless of how secure that passphrase actually is. There is no way to switch this off. No response on a complaint. This and some other things lead me to not trust this person. I am back to the last TrueCrypt version that does not have this brain-dead and insulting limitation.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I'm a long time Truecrypt user who recently tried Veracrypt. It's okay, some nice new features, but as this shows the devs don't seem to be security experts or even skilled at writing secure code.
It's also a little less stable than Truecrypt. I've had some system lockups that don't happen in Truecrypt with SSDs.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Would be nice if VC had FDE on Linux. (Yes I know about LVM and LUKS)
Veracrypt may provide decent cryptographic functionality, but given that its main audience is Windows and Mac users, the two huge security holes they cannot fix are called "MicroSoft" and "Apple". You can make Veracrypt as secure and error-free as you want, as long as it has to expose the decrypted data to some commercial, closed-source operating system that phones home like crazy to provide its manufacturer with valuable data, there is no actual security. Not to mention the backdoors builtin for certain 3-letter-agencies.
My Apple computers do not phone home. Citation needed or stfu.
"I think so. TrueCrypt 7.1a has, as far as I remember, only local exploits that matter. In the regular scenario (laptop), there is no other user and they do not matter at all. I do not trust the VeraCrypt person."
Mod parent up.. Fuck VC.
i like to clap my cheeks together while saying, "You're such a cheeky fellow".
So you're saying if some lowlife steals my encrypted laptop, it's useless because all they have to do is ask MS or the NSA for my data?
Of course they would be happy to help random methheads commit identity theft.
Security is not that black&white you know, there are several enemies.
"Anyone want to share their experiences with VeraCrypt?"
I don't remember which version I tried exactly - it was at the begining of last year. When I tried to mount volume it hanged for more than 60 seconds (I don't remember exactly - maybe more). I tried different algorithms - the same behaviour on all. I don't know if it's normal VeraCrypt behaviour.
I installed TrueCrypt - it works for me. Maybe NSA can break it - maybe not. I don't care. I care about protecting my data agains normal thiefs that could steal my laptop. And against these stupid servisants from asus service that wanted my password.
This is exactly the problem. Security, especially encryption, is usually so far above people's heads, that there is no possibility of them self-analysis their own risk. You think you are safe using it, but you admit that you have no reasonable reason to think that.
My Apple computers do not phone home. Citation needed or stfu.
Would you like to see my little snitch logs? Mac OS gets chattier with every new release.
The problem is for travellers. Can the chat down at a crossing result in a scan of working hardware show any and all encryption?
The user is then asked to decrypt.
Domestic spying is now "Benign Information Gathering"
TrueCrypt 7.1a
TrueCrypt 7.1a hashes.
TrueCrypt from Switzerland -- Swiss Mirror
VeraCrypt is hosted on a Microsoft web site: VeraCrypt at codeplex.com.
That scares me. Consider this Network World article: Windows 10 is possibly the worst spyware ever made. Quote: "Buried in the service agreement is permission to poke through everything on your PC."
Didn't Thomas Ptacek and/or iSec do an audit of TrueCrypt 7.1a? Don't recall the results exactly, but presumably these are different items. Does that mean Ptacek and company missed these items, or were these introduced by VeraCrypt?
We don't HEAR often that the Feds have used a security hole to extract data from a user's system.
Emphasis added. We already know authorities use "parallel-construction", which is when they fabricate a fraudulent evidence-trail to convince people they obtained crucial information through some not-so-secret means.
air max Pas Cher Mais ça c’était avant. Avant que la crise de 2008 ne conduise ces mêmes constructeurs au bord de la faillite. Avant que le smartphone ne remplace la voiture dans le cur des jeunes générations. Avant que la sortie de la Tesla Model S démontre que l’on pouvait produire en moins de 10 ans non pas la meilleure voiture électrique, mais la meilleure voiture du monde tout court. Avant le développement exponentiel de start-up comme Uber, Lyft ou Zipcar.Depuis, le monde du transport regarde vers la Silicon Valley pour connaître son futur. Les grands constructeurs et équipementiers y ont installé des centres de recherche et d’innovation.
VeraCrypt supports unicode passwords...
Sadly this is how I feel as well. Trust is a very complicated and difficult problem to solve. I always say, "At least Goober can't access my family photos". But if a powerful nation state wanted to access my hard drive (I use LUKS for full disk encryption and truecrypt 7.1a for containers) I don't feel so good about that. I lead a pretty straight life anyway, but it bothers me that there is no truly trustworthy solution, even if what we have is ultimately secure. How would you know?
Now we have one laptop with Windows 10 and I can't even do full DE with TrueCrypt. So what did we do? Bitlocker (shudders). Goober still can't access it but the government can pretty much just snap their fingers and they will get in. So Bitlocker is a true joke in my opinion and only useful for keep Goober out.
What is Microsoft's influence on VeraCrypt? It seems to me that Microsoft has strongly positioned itself as a company that cannot be trusted.