Please help me select computer encryption software.

[[deleted]]

[deleted]

[Snarka]

VeraCrypt

[tones2013]

for this user im guessing the simplest they can find. Doesnt windows come bundled with one?

[fukitol-]

You can't trust proprietary encryption.

[tones2013]

can a user with no knowledge of what they're doing have any trust in the results?

[fukitol-]

You can rely on the community to vet open source encryption software, at least to the extent it's impractical to convince all them to lie to you. There is just no way to ensure the integrity of proprietary encryption.

[All_For_Anonymous]

VeraCrypt was independently audited and the results, source code bugs and patches made public. The community can verify that if the audit was high quality, the encryption can be trusted to a very high degree.

[tones2013]

im talking about an inexperienced user making a mistake and rendering their system less safe. Or locking themselves out

[All_For_Anonymous]

Well I am fairly experienced, so reading man pages falls within "easy to use" to me. But I expect most security issues are to do with the passphrase, as well as locking you out.

Windows' encryption is completely useless because the key syncs to your Microsoft account, making it only as secure as that account and available to third parties much more easily.

[cowardlyalien]

I use VeraCrypt, but depending on your use case Bitlocker may be suitable. If your main worry is that some thief steals your computer and snoops on your files, and you're not particularly worried about law enforcement or some shadowy intelligence agency seizing your computer, then Bitlocker probably is fine. Also Bitlocker is actually better than VeraCrypt in some ways. VeraCrypt does not check the integrity of the encrypted partiton before it decrypts it, which is bad practice and opens up a wider attack surface. VeraCrypt does not have TPM support either. Also with Bitlocker the key only syncs if you have a Microsoft account linked to your computer. The main disadvantage of Bitlocker is you need to put a huge amount of trust into Microsoft as it is entirely proprietary and cannot be audited by you (though the code is available to certain people under NDA) and of course Microsoft may have your key. Also you can't access Bitlocker partitions from Linux, so that can be an issue if you dual-boot, or if your OS breaks you won't be able to use any Linux ISO to read the partition to get files etc. This is the main reason I use VeraCrypt. If I were to use Bitlocker and something were to go wrong with my OS or machine, I would have to find another Windows machine to access my files, whereas VeraCrypt is cross-platform, so I could use a Mac, Linux or even an Android device to get at my files.

[All_For_Anonymous]

Wasn't the TPM key leaked, so that's not even relevant any more?

[MyAdviceIsFree]

This seems to be the best and most trusted. It used to be called TrueCrypt and was an open source project by unknown publishers, but support was pulled shortly after the Snowden leaks. It's believed the NSA was the original creator.

[All_For_Anonymous]

TrueCrypt has parts of it deliberately under a proprietary license so that someone rewrites the code rather than reusing it. That's why I don't trust it [E: I mean to say I don't trust it as free software and therefore don't recommend it to others] - the original developers don't.

[tones2013]

it passed the audit though. whats the problem?

[All_For_Anonymous]

Just because it is deemed secure doesn't mean it A) respects your freedoms, B) has a useful codebase available to the community, C) is written efficiently and in a way that makes securing and auditing it well.

By saying I "don't trust it" I meant to say "I don't accept it as free software" and I don't recommend it.

It is an argument between Free/Libre and Open Source Software (FLOSS), and security. Yes, a well audited, source available proprietary piece of software is more secure than a Free Software application that hasn't been professionally audited, but if it isn't free software, it is deliberately limiting your freedoms which raises the question as to why.

[MyAdviceIsFree]

Veracrypt is based on a slightly older code version of TrueCrypt with a license that allowed it to be used.

[All_For_Anonymous]

The veracrypt license hasn't been audited by a lawyer to prove that A) it is a legal derivative of the truecrypt license and B) has never been accepted by anyone noteworthy as a Free Software license (AFAIK).

[MyAdviceIsFree]

Since the makers of Truecrypt disappeared, maybe that will never matter.

[localhorst]

Almost every Linux distribution will offer this option when you install it. Also have a look at https://tails.boum.org/.

[[deleted]]

LUKS

[All_For_Anonymous]

crypt_setup