Free file encryption software?

superscaper

peter999 wrote: »

Not sure, how do you tell a good one from a bad one ??
Are you experts ??

You don't have to be a cryptographer to see how weak winzip is with all the password "recovery" tools out there which defeats the point of the security in the first place, whereas there isn't a single one for truecrypt. If you want expert opinion then I suggest you read Bruce Schneier's literature etc.

peter999

superscaper wrote: »

http://www.cse.ucsd.edu/users/tkohno/papers/WinZip/

Bringing an old thread back is one thing but as I mentioned you brought it back without adding anything new (ie suggesting winzip). If something is really that useful then post a new thread, that way it doesn't confuse readers with possible out of date information.

Interesting analysis on WinZip 9 in 2004.

You may notice that Microsoft releases regular updates & security patches, that's normal for all software.

As I said before, old threads are still relevant & have good information.
No need for me to post new thread, as this thread has good information.

peter999

superscaper

peter999 wrote: »

Interesting analysis on WinZip 9 in 2004.

You may notice that Microsoft releases regular updates & security patches, that's normal for all software.

As I said before, old threads are still relevant & have good information.
No need for me to post new thread, as this thread has good information.

peter999

Then you'll also note that Winzip has NOT changed it's encryption method and implementation since that paper. And the password recovery statement I made is still valid for version 11.

If everyone brought back nearly two year old threads because they thought "they still contain useful information" then we'd never be able to read the new threads from people with genuine problems from sifting through all the old stuff. It still seems really random that without anyone needing the info such an old thread is bumped, and you may as well have simply posted a "bump" since your suggestion had already been posted and it would have been clearer that it was an old thread being moved for the sake of being moved.

sra

Security Now have several podcasts on encryption ending in one on Truecrypt itself.

One thing is stressed several times is that you can't trust any encryption software unless it's open source.

Blacksheep1979

sra wrote: »

One thing is stressed several times is that you can't trust any encryption software unless it's open source.

You can't really say that though as whilst DES's algorithm which is fairly standard in banking is public knowledge the design prinicples are kept secret.

sra

Blacksheep1979 wrote: »

You can't really say that though as whilst DES's algorithm which is fairly standard in banking is public knowledge the design prinicples are kept secret.

Unless a piece of software is Open Source you have to put your faith in its creater that there are no backdoors or vulnerabilities. It might be encrypting your data with the most powerful cipher ever invented, but you're still having to trust that things are being done correctly.

For example, just knowing the limited amount I know about how Truecrypt works, I can think of an extremely easy way it could be modified to create a backdoor into any file created with it.
If it were closed source, the authors could do that. But since it's open source the techies out there would notice in about 5 secs

Blacksheep1979

sra wrote: »

Unless a piece of software is Open Source you have to put your faith in its creater that there are no backdoors or vulnerabilities. It might be encrypting your data with the most powerful cipher ever invented, but you're still having to trust that things are being done correctly.

For example, just knowing the limited amount I know about how Truecrypt works, I can think of an extremely easy way it could be modified to create a backdoor into any file created with it.
If it were closed source, the authors could do that. But since it's open source the techies out there would notice in about 5 secs

Ok thats true, but to an extent you could say that about any piece of software - it may log user activity, passwords etc

Asus_Mobo

Im going to hide my pen drive up my botty

superscaper

Asus_Mobo wrote: »

Im going to hide my pen drive up my botty

I could make a crude joke about backdoor access but I won't. :rolleyes:

superscaper

Blacksheep1979 wrote: »

Ok thats true, but to an extent you could say that about any piece of software - it may log user activity, passwords etc

Yep you could. There's a certain element of faith in all commercial software. But when it comes down to encryption where presumably there's by definition data you definitely don't want others to see then you're better not taking the risk of commercial software. I'm sceptical of most conspiracy theories but I'm quite prepared to believe the influence of the NSA on software companies and also considering the attitude of the Government in this country with the likes of the RIP Act I'm sure very similar stuff goes on here as well where we're just as draconian over encryption or even more so.