111–120 of 280 posts
Earlier quoted context omitted.
Yeah man we've been saying negative things about them for like 40 years must we constantly dwell on what they do wrong? It's time we find positive angles
They keep doing negative things that influence the industry and infringe upon the freedoms of hundreds of millions of people. Yes we should keep dwelling on that.
Earlier quoted context omitted.
Long time ago TrueCrypt suddenly and abruptly shut down with a vague goodbye message saying "everyone please move on and use bitlocker instead" Prevailing theory is they were pressured to put in a backdoor and couldn't disclose it, so they had to make a seemingly ridiculous statement (because who in their right mind would trust bitlocker) to call attention that "something is very wrong"
>so they had to make a seemingly ridiculous statement (because who in their right mind would trust bitlocker) to call attention that "something is very wrong" Alternately, they don't want people to rely on abandonware for security. Also, despite the conspiracy theories of backdoors I'm not aware of any bitlocker exploits that work on TPM + pin, which is the intended "secure" configuration[1]. All exploits rely on TPM…
"Security professionals generally recommend avoiding reliance on any single encryption system and instead evaluating well-reviewed full-disk encryption alternatives such as VeraCrypt". If they put a backdoor into FDE it would make more sense to advise people to stop using windows at all and using Linux instead. If they put a backdoor in FDE you can be sure there is not just one backdoor in the operating system itself…
I don't use Microsoft products generally but not with even with your computer would I run VeraCrypt.
This has got to be the most surprising encryption-related comment I've ever read from you. Please tell us what you're thinking about VeraCrypt. What would you say about TrueCrypt v7.1a, the last known good release?
Earlier quoted context omitted.
Presumably, not paying out for these bugs which often take weeks of research to find.
Who in their right mind bets on bug bounties to cover their basic needs? They should be highly employable with these kind of skills.
Earlier quoted context omitted.
I'm not aware of the connection between truecrypt and bitlocker, want to enlighten us?
Long time ago TrueCrypt suddenly and abruptly shut down with a vague goodbye message saying "everyone please move on and use bitlocker instead" Prevailing theory is they were pressured to put in a backdoor and couldn't disclose it, so they had to make a seemingly ridiculous statement (because who in their right mind would trust bitlocker) to call attention that "something is very wrong"
Earlier quoted context omitted.
I don't use Microsoft products generally but not with even with your computer would I run VeraCrypt.
Curious to see this take from you! I followed TrueCrypt for years, but always thought it was very strange that they were anonymous, and then the mysterious shutdown happened, and I have no idea what to make of VeraCrypt. It's been in my "possibly good, but too many weird flags around the whole project" bucket. Anything in particular that makes you wary? I'm aware of the 2016 and 2020 audits ( https://ostif.org/the-ve…
If it's a backdoor, that's a serious fraud against their customers.
Earlier quoted context omitted.
What if you forget the passphrase after not using it for many years and you suddenly need a file on the drive?
Print it on a piece of paper and put it in a lock box.
* Your preferred memorized passphrase and will never be written down anywhere.
* A random key you can print and store in a box somewhere.
Then if your backup paper gets lost, you can revoke/replace it without having to abandoned your memorized favorite.
Earlier quoted context omitted.
What if you forget the passphrase after not using it for many years and you suddenly need a file on the drive?
Print it on a piece of paper and put it in a lock box.
If you keep it in a dark environment that's not super humid the ink should last a really long time. Even in non-optimal conditions (NY summers with high humidity, etc.) I've had regular pen ink last for decades with no signs of fading away.
From: https://infosec.exchange/@wdormann/116565129854382214 >In a normal WinRE session, you have a X:\Windows\System32 directory that has a winpeshl.ini file in it >However, with the YellowKey exploit, it looks like Transactional NTFS bits on a USB Drive are able to delete the winpeshl.ini file on ANOTHER DRIVE Interesting. I dont know about this environment - some kind of naive file handle contructing/passing? But t…
>The thousands of winre thumb drives are certainly out of reach; maybe the bitlocker side update the access permissions? Would it require unenc/reenc? The part that isn't mentioned is that the win re is privileged because windows stores a decryption key in the TPM that allows win re to decrypt the disk even without the recovery key. That's why the attack requires win re in the first place, rather than booting into an…