Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German BSI withholds Truecrypt security report

golem.de

Post reply on HN
Print view View original

31–40 of 86 posts

Re: German BSI withholds Truecrypt security report

#31

Post by atlanta90210 »

Grumbledour wrote: post #3

It is sad to see the state still making freedom of information requests so difficult and using copyright as a flimsy excuse to hinder citizens to share the information when they finally manage to get it out of them. I find it especially sad to see something like this held back by an entity that claims to want to protect security in information technology and doubly so since this information would be relevant to the d…

Jail any government worker who hinders an open records request - like Georgia is trying to do today:

https://www.ajc.com/news/local-govt--politics/trial-start-mo...

Re: German BSI withholds Truecrypt security report

#32

Post by Forbo »

kjaftaedi wrote: post #22

If you're going to comment, it's highly preferable that you read the article where all of this is explained.

As per the guidelines:

> Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."

Re: German BSI withholds Truecrypt security report

#33

Post by chmod775 »

blattimwind wrote: post #8
chmod775 wrote: post #5

> As Truecrypt got no further releases the software is still vulnerable for all those weaknesses. [...] > The BSI knew all that. [...] > The results were communicated to the Truecrypt foundation, however the Truecrypt developers didn't consider them to be relevant. BSI furthermore says that the results were not intended to be published. This is looking pretty terrible for Truecrypt. It means they ignored a vulnerabil…

Truecrypt has been abandoned for ~seven years or so.

This was in 2010. Truecrypt wouldn't be 'deprecated' for like five more years after that.

Re: German BSI withholds Truecrypt security report

#34

Post by chmod775 »

Grumbledour wrote: post #9
chmod775 wrote: post #7

Earlier quoted context omitted.

> since this information would be relevant to the developers and many state entities that use the software and its successor. The BSI actually did communicate the findings of the report to the TrueCrypt developers in 2010, which the developers ignored: > The results were communicated to the Truecrypt foundation, however the Truecrypt developers didn't consider them to be relevant. BSI furthermore says that the result…

Yes, but they neglected to tell the veracrypt developers once truecrypt stopped being developed. Though they also do know many municipalities using both applications. They should have told the veracrypt developers and advised the municipalities to switch to the newer version. And the whole argument about the information being outdated by then when both are clearly in use seems negligent of their duties.

Veracrypt didn't exist back then and Truecrypt would only be 'deprecated' five years later. This was in 2010.

Personally I would've given up after a few months of trying to get a vulnerability fixed. Can't really blame them this got buried after five years.

Re: German BSI withholds Truecrypt security report

#35

Post by unixreply55 »

aasasd wrote: post #28
jmakov wrote: post #13

"... in the simplest case a user can mount a Truecrypt volume that contains a file with suid root permission that will open a shell. Golem.de was able to replicate this scenario in a current version of Veracrypt."

This surprised me the most―never thought about this before. Aren't all permission-supporting filesystems vulnerable to this if mounting by a user is permitted? I presume filesystems don't go through the files and downgrade root ownership.

Yes; that is why it is recommended that untrustworthy drives be mounted with the `nosuid` flag.

Re: German BSI withholds Truecrypt security report

#36

Post by treljherthj »

onetimemanytime wrote: post #26

Much safer to assume that a decent nation state can decrypt Truecrypt and a lot of other things. You can hide stuff from your wife, friends or banana Republic countries, but I wouldn't bet against NSA with 30 years in jail.

True, but not by outright cracking the encryption.

They will get your password instead, by implanting your keyboard, putting a camera behind you on the wall, or grabbing you just after you've entered your password.

Re: German BSI withholds Truecrypt security report

#37

Post by onetimemanytime »

treljherthj wrote: post #36
onetimemanytime wrote: post #26

Much safer to assume that a decent nation state can decrypt Truecrypt and a lot of other things. You can hide stuff from your wife, friends or banana Republic countries, but I wouldn't bet against NSA with 30 years in jail.

True, but not by outright cracking the encryption. They will get your password instead, by implanting your keyboard, putting a camera behind you on the wall, or grabbing you just after you've entered your password.

Good point. Another thing: even if they can decrypt it, they'd save that for Osama types, not ruin it over a small tax case. Otherwise bad guys would stop using it. Maybe decrypt but not use in court...

Re: German BSI withholds Truecrypt security report

#38

Post by nolok »

EsssM7QVMehFPAs wrote: post #24

Why would they release an audit that effectively provides them with zero-days into encrypted suspect disks. They release now because no one is using TrueCrypt any longer..

They did not publish publicly but did report their findings to the true crypt foundation so that it could be fixed (but they in return didn't agree that those were flaws worth thinking)

Re: German BSI withholds Truecrypt security report

#39

Post by zmzrr »

jmakov wrote: post #13

"... in the simplest case a user can mount a Truecrypt volume that contains a file with suid root permission that will open a shell. Golem.de was able to replicate this scenario in a current version of Veracrypt."

Isn't Veracrypt just a container, like a hard disk? Why should Veracrypt care about what filesystem you store inside of a container, and whatever you do with its permissions?

Re: German BSI withholds Truecrypt security report

#40

Post by aasasd »

unixreply55 wrote: post #35
aasasd wrote: post #28

Earlier quoted context omitted.

This surprised me the most―never thought about this before. Aren't all permission-supporting filesystems vulnerable to this if mounting by a user is permitted? I presume filesystems don't go through the files and downgrade root ownership.

Yes; that is why it is recommended that untrustworthy drives be mounted with the `nosuid` flag.

Ah, so even though filesystems don't go through files, they still can block the operation of suid. This suggests then that Veracrypt can simply enable the nosuid option when mounting a device.
Post reply on HN