Im not really sure where I got that from, and was honestly surprised to see the source available. Its one of those things you "just know and have known for ages", which apparently was incorrect.
Side-channels have historically hit hardware encryption harder than software, as it is easy to do something dumb like storing the encryption key in a rom chip or something. Hey look, we have hardware AES, and you dont even have to provide the password!
The distinction between "software" and "hardware" implementations of an algorithm are irrelevant when looking at the quality of the implementation; all it really indicates is that the hardware one will not use any host resources, and will be easier to port across systems. It doesnt tell you whether its faster (will usually be SLOWER), or more secure, or anything else.
Truecrypt is closed-source, which seems to defeat GP's (incorrect) point.
Why not simply have someone analyze whether the USB drive is, in fact, using AES, and that the key is not stored in a decrypted state anywhere? That can all be done without the manufacturer's help.
Encryption software needs to be inspectable and verifiable in order to be trusted with anything worth protecting.
Truecrypt is close-sourced. Its also one of the most popular and trusted encryption solutions.
Your statement is simply not correct, as regardless you can verify the software's output in many cases. Provide test input, provide test key, verify that you can decrypt the output on your own.
All that matters is that the encryption algorithm is open, vetted, and trusted; and that you can confirm that the software is, in fact, using that encryption algorithm.
Just an fyi, a system using biometrics, RFID, or tokens is going to be insecure: unless they are using the fingerprint itself as the encryption key (highly inadvisable as you would have to get the same image every time), they are storing the key in the USB device itself, which will be terribly convenient for any attacker.
The only proper way is to have the key derived from the "unlock code", so that the USB device has no knowledge of what the key actually is; "access" is granted merely by providing a decryption key that actually returns data.
My answers could be biased; i could be accused of twisting the facts.
I am confident enough in the information that is readily available out there that I think it speaks for itself. Anyone who truly cares about learning something, will learn in the most convincing manner-- thru their own research-- and I wont be wasting my time on everyone else.
What you have is speculation. My comments focus on the actual verifiable history Google has of telling various governments to get stuffed when their requests overreach either their authority, or the bounds of "acceptable" (ie censorship, GFW).
Theyre not perfect, but theyre pretty darn good considering that theyre a business and not a non-profit.
Google has many times the Chinese govt to get stuffed and used their weight to try to resist those laws. I dont remember the details, but I do recall that it was a stark contrast with Yahoo who almost immediately folded in several requests for the identities of bloggers (leading to arrests for political activisim), and MS who now owns Skype which has a custom-built chinese version called Tom which wiretaps all calls made.
Of the 3 major search companies (MS, Yahoo, Google), which has said no to China's requests for call monitoring (skype), search censorship, and to reveal the names of political bloggers?
Of the 3 major search companies, who has actually ever said "get a warrant" when asked for information extra-judicially by the US Govt?
Google has a far better track record than just about anyone else in this regard. They have said no to the US before, and they have said no to China before, many many times.
Why do yahoo, bing / MS, et al get a free pass on this? MS already works with China (via skype) to intercept VOIP, and theyve also cooperated with China's censorship in varying degrees; Yahoo has already worked with China to reveal political bloggers. Yet noone gets on their case, simply because theyre not the big dog on the block.
Honestly? Im happy that of all the possible tycoons of the advertising age, we have someone who puts up some token of resistance towards governernmental requests.
Windows 8 (the underlying OS) wasnt ever bad, I dont think anyone had a problem with it until trying to use it on non-tablet hardware and accidentally hitting the start button.
I must have been mixing things up with stats I saw for ICBMs. I suppose that though they do travel ~mach 23, you'd have to have some pretty good aim to hit a fighter with an ICBM.
Missiles are substantially smaller and less burdened than aircraft. For instance, they have no need to return to base, so less fuel, no landing gears, less weight, more speed.
Missiles go ~mach 8-10. Jets generally dont exceed Mach 2, except in extreme cases.
By the same logic, Linux was simply a Minix / Unix imitator, Ext3 simply expanded on Ext2, Samsung simply copied Apple who copied the previous person with a touchscreen cellphone who copied Nokia.....
I suppose that MS made Office and Exchange (which apparently there still isnt a viable competitor for for 95% of businesses) is of no account, as well.
Slashdot Mirror
I stand corrected, Im not sure where I got the idea it was closed source.
Im not really sure where I got that from, and was honestly surprised to see the source available. Its one of those things you "just know and have known for ages", which apparently was incorrect.
Anologue is better than digital. Hardware is better than software.
Most recent hardware is digital. The reason software tends to be digital is because the underlying hardware is digital.
Side-channels have historically hit hardware encryption harder than software, as it is easy to do something dumb like storing the encryption key in a rom chip or something. Hey look, we have hardware AES, and you dont even have to provide the password!
The distinction between "software" and "hardware" implementations of an algorithm are irrelevant when looking at the quality of the implementation; all it really indicates is that the hardware one will not use any host resources, and will be easier to port across systems. It doesnt tell you whether its faster (will usually be SLOWER), or more secure, or anything else.
Truecrypt is closed-source, which seems to defeat GP's (incorrect) point.
Why not simply have someone analyze whether the USB drive is, in fact, using AES, and that the key is not stored in a decrypted state anywhere? That can all be done without the manufacturer's help.
Encryption software needs to be inspectable and verifiable in order to be trusted with anything worth protecting.
Truecrypt is close-sourced. Its also one of the most popular and trusted encryption solutions.
Your statement is simply not correct, as regardless you can verify the software's output in many cases. Provide test input, provide test key, verify that you can decrypt the output on your own.
All that matters is that the encryption algorithm is open, vetted, and trusted; and that you can confirm that the software is, in fact, using that encryption algorithm.
Just an fyi, a system using biometrics, RFID, or tokens is going to be insecure: unless they are using the fingerprint itself as the encryption key (highly inadvisable as you would have to get the same image every time), they are storing the key in the USB device itself, which will be terribly convenient for any attacker.
The only proper way is to have the key derived from the "unlock code", so that the USB device has no knowledge of what the key actually is; "access" is granted merely by providing a decryption key that actually returns data.
My answers could be biased; i could be accused of twisting the facts.
I am confident enough in the information that is readily available out there that I think it speaks for itself. Anyone who truly cares about learning something, will learn in the most convincing manner-- thru their own research-- and I wont be wasting my time on everyone else.
What you have is speculation. My comments focus on the actual verifiable history Google has of telling various governments to get stuffed when their requests overreach either their authority, or the bounds of "acceptable" (ie censorship, GFW).
Theyre not perfect, but theyre pretty darn good considering that theyre a business and not a non-profit.
Google has many times the Chinese govt to get stuffed and used their weight to try to resist those laws. I dont remember the details, but I do recall that it was a stark contrast with Yahoo who almost immediately folded in several requests for the identities of bloggers (leading to arrests for political activisim), and MS who now owns Skype which has a custom-built chinese version called Tom which wiretaps all calls made.
I note that Skype TOM still exists, and MS apparently makes no attempt to disguise what it does:
https://support.skype.com/en/faq/FA10910/what-is-tom-online
And facebook, and Yahoo, and ebay, and any company that uses Google Analytics....
This is absurd.
Of the 3 major search companies (MS, Yahoo, Google), which has said no to China's requests for call monitoring (skype), search censorship, and to reveal the names of political bloggers?
Of the 3 major search companies, who has actually ever said "get a warrant" when asked for information extra-judicially by the US Govt?
Ill leave you to research and consider that.
Google has a far better track record than just about anyone else in this regard. They have said no to the US before, and they have said no to China before, many many times.
Why do yahoo, bing / MS, et al get a free pass on this? MS already works with China (via skype) to intercept VOIP, and theyve also cooperated with China's censorship in varying degrees; Yahoo has already worked with China to reveal political bloggers. Yet noone gets on their case, simply because theyre not the big dog on the block.
Honestly? Im happy that of all the possible tycoons of the advertising age, we have someone who puts up some token of resistance towards governernmental requests.
For the record, "10 year old kernel" would be 2.4.
So "yes, but only embedded folks".
To be fair, you could make that argument for every feature each new version brings, until youve just backported the entire new OS.
You do realize that MS has a business model because theyre a business, right?
Windows 8 (the underlying OS) wasnt ever bad, I dont think anyone had a problem with it until trying to use it on non-tablet hardware and accidentally hitting the start button.
I must have been mixing things up with stats I saw for ICBMs. I suppose that though they do travel ~mach 23, you'd have to have some pretty good aim to hit a fighter with an ICBM.
Missiles are substantially smaller and less burdened than aircraft. For instance, they have no need to return to base, so less fuel, no landing gears, less weight, more speed.
Missiles go ~mach 8-10. Jets generally dont exceed Mach 2, except in extreme cases.
Thats the most ridiculous idea ever.
Im pretty sure Microsoft makes a hefty profit in their productivity and server markets.
Courts are not elected by votes, so lobbying doesnt generally work on them.
Try again.
and exfat
By the same logic, Linux was simply a Minix / Unix imitator, Ext3 simply expanded on Ext2, Samsung simply copied Apple who copied the previous person with a touchscreen cellphone who copied Nokia.....
I suppose that MS made Office and Exchange (which apparently there still isnt a viable competitor for for 95% of businesses) is of no account, as well.
their operating systems are found lacking, their office products are crap
Businesses everywhere find your words intriguing, and would like to subscribe to your newsletter.
I hear they released a suitable FS called EXT2 some time ago.
Whatever the solution is, we dont need another FS.