News for hackers. Stuff that matters.
Re:TrueCrypt Security Assessment [pdf] by dmix on Monday April 14, 2014 @11:41AM (#7586796)
Does anyone know if Tomb [1] or ecryptfs [2] is a safe choice for encrypting a local directory?

Everyone always talks about Truecrypt which is clearly most popular but both of the above are fully open-source. The latter is even part of the kernel. I'm curious what the appeal of Truecrypt is besides maybe portability (which is a pretty strong selling point).

[1] http://www.dyne.org/software/tomb/

[2] http://ecryptfs.org/

Re:TrueCrypt Security Assessment [pdf] by ewams on Monday April 14, 2014 @12:09PM (#7586992)
TrueCrypt is also opensource: http://www.truecrypt.org/downloads2

The security assessment is for the Windows version of TrueCrypt only. Which also answers your question, TrueCrypt is appealing because it works on *nix, BSD, and Windows. It is also free and open source. The Windows version is easy to use, has a nice GUI and actually works as stated.

Re:TrueCrypt Security Assessment [pdf] by Buge on Monday April 14, 2014 @02:19PM (#7587849)
The license has been criticized as not being truly "Open Source" or "free".

https://en.wikipedia.org/wiki/TrueCrypt#Licensing_and_Open_S...

Wikipedia lists it as "source-available".

Re:TrueCrypt Security Assessment [pdf] by mhogomchungu on Monday April 14, 2014 @04:09PM (#7588538)
tomb is a front end to cryptsetup[3] and it uses LUKS as an encrypted volume format. LUKS is more secure than TrueCrypt encrypted format because it takes steps to make it harder to brute force the LUKS header.

TrueCrypt for example uses fixed and low pbkfd2 iteration counts as specified in the report.LUKS on the other hand uses adaptive pbkdf2 iteration count number that goes up automatically when a LUKS volume is created on a faster computer.

The appeal of TrueCrypt other than portability atleast among linux users is an easier to use GUI.Fortunately, there is a project called zuluCrypt[1] than supports TrueCrypt volumes among others and has a GUI window that is comparable to TrueCrypt's GUI.

If you are a user of tombs,zuluCrypt can also open tombs through its "gpg" and "tomb" plugins[2]

[1] http://code.google.com/p/zulucrypt/

[2] https://github.com/dyne/Tomb/issues/105

[3] http://code.google.com/p/cryptsetup/

Re:TrueCrypt Security Assessment [pdf] by dublinben on Monday April 14, 2014 @11:58AM (#7586918)
The appeal of Truecrypt is that it works on Windows. As you've suggested, there are better encryption programs and schemes for users of GNU/Linux operating systems.

The questionable license, and obscure nature of the project should be significant reasons not to use Truecrypt. That doesn't even begin to consider the actual security of the program.

Re:TrueCrypt Security Assessment [pdf] by doreo on Monday April 14, 2014 @02:05PM (#7587775)
The appeal of Truecrypt is the deniable encryption and the alternatives for that are sparse and bad on any operating system
Re:TrueCrypt Security Assessment [pdf] by yabatopia on Monday April 14, 2014 @07:47PM (#7589568)
Too bad Windows 8 isn't supported, so Truecrypt loses much of its appeal to Windows users.
Re:TrueCrypt Security Assessment [pdf] by lawnchair_larry on Monday April 14, 2014 @09:43PM (#7589878)
I replied to this comment using a TrueCrypted Windows 8 machine.