Continue the TrueCrypt discussion: Windows 10
- Albert Zenkoff
- 2015-08-21
I already pointed out previously that I do not see any alternative to the TrueCrypt for encrypting data on disk. TrueCrypt is the only tool that we can more or less trust so far. You will probably remember that Bruce Schneier recommended to use Windows encryption, the BitLocker, instead of TrueCrypt and I called that idea nonsense. To prove me right, here comes the Windows 10 End User License Agreement (EULA) that states explicitly Microsoft will retain the keys to the encryption.
This is rather amazing but, indeed, if you used the BitLocker to encrypt the data on disk, the key will be copied by Microsoft to the OneDrive servers. Of course, that makes the encryption quite pointless as the OneDrive servers are controlled by Microsoft and they will give the key to government authorities and intelligence agencies.
Moreover, Microsoft actually reserves the right to do anything they want with all your data, which by definition includes your keys and the data protected by the encryption:
We will access, disclose and preserve personal data, including your content (such as the content of your emails, other private communications or files in private folders), when we have a good faith belief that doing so is necessary to protect our customers or enforce the terms governing the use of the services.
So, really, all of your information is not only accessible to the government and intelligence agencies but even the company itself will access and manipulate your data whenever they believe it “necessary”.
Yes, TrueCrypt remains the only tool for disk encryption on Windows and you cannot, in good faith, claim that BitLocker is a good substitute for it. And, really, go Linux already.
Comments List
Albert Zenkoff2015-08-21 10:32 /
It is one thing to deal with the data under your own control and try to protect it from casual thieves. It is quite another to give your data (un)knowingly to a third party and be happy about it.Leave a Reply
About the author
Albert Zenkoff
Managing corporate security in both technical and business sense in the context of long-term business strategy and sustainability.
For security consulting, training, certification and audit mail albert@aruberusan.com.
Share and stay updated
Sven Türpe2015-08-21 10:22 /
You seem to presume a rather extensive threat model. In practice, however, disk encryption alone defeats only simple, unsophisticated adversaries, such as thieves. A common thief will pick opportunities rather than particular targets and spend little time and resources trying to get around your encryption. Any encryption is good enough in this scenario. A sophisticated adversary targeting your data in particular, on the other hand, may visit your device multiple times and use techniques like hardware keyloggers or reading keys from RAM. To defeat such an attacker, you'll need comprehensive operational security around all your data on every place (the attacker might attack your VPN rather than your laptop computer, or bribe your admin or abduct your relatives). Disk encryption then becomes a small building block and no publicly available solution will give you sufficient assurance.