Hacker News new | ask | show | jobs
by testtesttest 3592 days ago
Nowadays facts don't matter. Everybody follows whatever they already believe, including myself.

If we look at the TrueCrypt audit report: https://opencryptoaudit.org/reports/TrueCrypt_Phase_II_NCC_O...

It says they found 2 high severity issues, 1 low severity issue, 1 undermined severity issue. All in the cryptography category.

There were additional issues found by the Project Zero: http://googleprojectzero.blogspot.de/2015/10/windows-drivers...

Even when faced with this clear evidence, people consider TrueCrypt as being safe.

VeryCrypt is under active development, so the situation is much better since the issues can be fixed in the future releases. However, people might blindly follow whatever is reported and consider VeraCrypt bulletproof regardless of the previous experience with other crypto projects.
2 comments
wepple 3592 days ago
> Even when faced with this clear evidence, people consider TrueCrypt as being safe.

I don't understand. If your definition of 'safe' requires that no vulnerabilities can ever be discovered in a product, you're going to have to give up and never use a computer again.

Having some high-end crypto experts and some of the best bug hunters audit your product and then fix the discovered vulnerabilities puts you at the higher end of the security spectrum.

> VeryCrypt is under active development, so the situation is much better since the issues can be fixed in the future releases.

Counter-point for consideration: any non-maintenance code changes may introduce new issues that weren't part of this audit.

link
whamlastxmas 3592 days ago
It is safe. It's safe in the same way that your valuables locked inside a 4 ton safe in your basement are safe. Or in the same way that being a passenger on a plane is safe. Or even in the same way that SSL is safe.

From the report you linked:

> While CS believes these calls will succeed in all normal scenarios, at least one unusual scenario would cause the calls to fail and rely on poor sources of entropy

Essentially, there are outlying circumstances in which it might be more vulnerable than usual, which is true of pretty much anything.

link