Amazon Web Services (AWS) has issued some advice on how it uses the kept mum on whether it will dump the troubled TrueCrypt platform used to encrypt data imported and exported to its Simple Storage Service, Amazon EBS snapshots and Glacier cold storage offerings. . The popular crypto platform recently became a pariah after its …
The popular crypto platform recently became a pariah after its shadowy developers posted a note to the official website claiming it was compromised and users should adopt rival Microsoft Bitlocker.
This has as much truth as a Psaki™ State Department Official Statement™ on the situation in Ukraine.
El Reg reported Truecrypt version 7.2 was dropping malware executables
YouTube video or it didn't happen.
They made recommendations for alternatives for all the main OSs. Bitlocker was the Windows one. They also recommended other approaches for OSX and GNU/Linux. What would YOU recommend as an altnerative to Truecrypt on Windows?
I know this is a radical approach, but at our company we keep our information on internal servers only. Crazy I know; 10GB throughput between switches, full redundant backups, and I sign the paychecks of every person who has access to the server room.
I've never seen any convincing argument for placing any company data on cloud servers.
Whilst I wouldn't go near the cloud and thought it was a bad idea from the very start, I have on occasion worked for SME's who have struggled to have anyone permanent to manage their data storage and security.
However, they will have business broadband, so all their jewels are effectively exposed.
In those circumstances, a well managed cloud service would be more secure than what they currently have.
So encrypt your data before sending it to S3. Why would anyone not do this?
More than Microsoft...
But then I don't really have anything worth covering up to such an extent that it's worthwhile to hack.
Previous evaluation by respected security experts found no immediate cause for concern, and an independent scrutiny of the TrueCrypt source code is now well under way.
Assuming that code passes, I see no reason anyone would stop using that version of the product because of any subsequent action by the developers. Perhaps Amazon have already conducted an internal review of the source code and didn't find any reasons not to use it exclusively.
Assuming the audit comes back okay, Amazon should fork it and carry on. If they release back to the community this would be an excellent thing for both Amazon (more feedback and fixes) and the rest of us (an Open Source and supported encryption tool).
I wasn't aware AWS were using TrueCrypt. It's a bit shocking to be honest. They flog their products up to government levels, but rely on an encryption solution where nobody even knew who developed it?
Don't get me wrong. I think TrueCrypt is fntastic, and I'm using it across platforms myself (droid, win 7, linux). But if a large service such as S3 relies on a product, they should at least use something where the makers are to some level accountable or at least traceable.
> I wasn't aware AWS were using TrueCrypt.
It's offered as an option when you import/export from/to physical media that you ship to them. That's all.
where the makers are to some level accountable or at least traceable
Why though? Just to tick the box in the compliance statement?
Re: Just to tick the box in the compliance statement?
If you can't just tick the box in the compliance statement, it ain't getting deployed here bub.
Sure, in theory you can audit the code, but most places don't have a stable of world class security boffins available to work on that. Which means you need traceability to known trusted sources. Anonymous places on the interwebs don't make that cut.
"It's a bit shocking to be honest"
What, that they had not funded such an audit themselves with that sort of a budget?
you scratch my back and I'll spend tax payers money on you.
TrueCrypt may be totally secure, even today. But the real issue is that the OS's are the weak point. The keys are stored in the OS's RAM, and data must transfer through the OS to be stored or accessed. The data may be in Fort Knox, but the keys are sitting on the mantlepiece under a painting of George Orwell.
Apple and Microsoft are both US companies, even RedHat, so there would be no problem to add legal intercept to the OSes with a secret request. Amazon is in exactly the same boat, US as well, hell they have even started to get U.S. government work. Sounds like a bit of back scratching to me.
Ubuntu is in the UK, so GCHQ can give them secret requests to add legal intercept.
Re: you scratch my back and I'll spend tax payers money on you.
It depends on what you use Amazon for. If it is cloud backup then you never have to send the keys - just have the TrueCrypt volume on there, even with DropBox that works (diff sync only changes/ sends the blocks that are updated not the multi-GB file).
If its a VM running something then yes, it is fairly easy to grab the system memory while it is running.
If $SPYAGENCY with billion $CURRENCY budgets is willing to go as far as knobbling your OS via a targeted update (as opposed to a general 0-day vun or _NSAKEY style of arrangement) then you don't stand much chance anyway.
Better than nothing
This is just for when you ship physical media to bulk import into S3. It's optional to protect the data in transit. If some random postman grabs your HDD then I think it's unlikely they'll be able to decrypt your TrueCrypt volume. Surely still a much better option than no encryption at all.
Out of genuine interest, do MS or Google's clouds offer import of encrypted data when you ship bulk data?
Even better would be to encrypt it yourself then wrap it in Truecrypt, at least that would delay anyone wanting to have a nose at your private data before it's dumped onto, a, gasp, public, cloud. Oh.
I'd also much prefer to use something that's open source (apart from the Win binaries) and auditable rather than something who's sourcecode will probably never see the light of day.
You've got to worry who's doing the audit though. I mean, who's really doing the audit?
Given the amount of time now passed the most obvious logical conclusion is that the devs fell on their swords so they wouldn't have add any code helpfully provided by our friends in *insert shady gov acronym here*.
Clearly once a cryptography app reaches a level of popularity gov bods are going to want to insert a get-around mechanism. The only way around that is to kill the app and reminisce about the good old days when privacy on the web actually existed. The newly forked app may just become the next big thing but then the new devs are going to have the same gov bods knocking their at the door just like the old ones did.
Security through obscurity is a much safer bet IMO.
Sounds to me like the devs knew that the audit was going to turn something up eventually and decided to just go ahead and stop now.
- Product round-up Coming clean: Ten cordless vacuum cleaners
- Product round-up Too 4K-ing expensive? Five full HD laptops for work and play
- 'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
- Worstall @ the Weekend BIG FAT Lies: Porky Pies about obesity
- 'Snoopers' Charter IS DEAD', Lib Dems claim as party waves through IP address-matching