lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list] 
Date: Fri, 30 May 2014 10:58:07 +0200
From: Mateusz Lenik <mlen@...n.pl>
To: fulldisclosure@...e.net
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] Full disk encryption for OS X alternative to TrueCrypt

On Thu, May 29, 2014 at 02:45:12PM -0700, CIURANA EUGENE (pr3d4t0r - Full Disclosure) wrote:
> FileVault is suspect -- we have no
> guarantee, one way or another, that Apple doesn't have some kind of back
> door into it. 
> 
> That's why I believe we need an alternative for OS X
> users who rely on TrueCrypt and want better security than what is
> provided by Apple. 
> 
> Note: I love Apple products, but given Prism and
> other disclosures, I don't trust their software to be safe. That's why
> OTR, TrueCrypt, and GPG/PGP are in my arsenal for secure storage and
> communications. 

When you don't trust FileVault, because Apple may have put a backdoor in, then
you shouldn't trust the whole platform, as Apple may have put another backdoor
that allows remote access to your machine. 

There is Back to My Mac, that allows you to connect to your machine from
everywhere. What's the guarantee that some three letter agencies won't use it,
or something else we're not aware of, to access your machine behind you back?

If they can access your machine, then no encryption whatsoever will solve the
problem, as GPG, OTR and disk encryption keys are stored unencrypted in memory
when you use them.

Cheers!
mlen

Content of type "application/pgp-signature" skipped


_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists