AWS breaks silence over Truecrypt's role in data import/export

So encrypt your data before sending it to S3. Why would anyone not do this?

Trust Truecrypt

More than Microsoft...

But then I don't really have anything worth covering up to such an extent that it's worthwhile to hack.

I wasn't aware AWS were using TrueCrypt. It's a bit shocking to be honest. They flog their products up to government levels, but rely on an encryption solution where nobody even knew who developed it?

Don't get me wrong. I think TrueCrypt is fntastic, and I'm using it across platforms myself (droid, win 7, linux). But if a large service such as S3 relies on a product, they should at least use something where the makers are to some level accountable or at least traceable.

you scratch my back and I'll spend tax payers money on you.

TrueCrypt may be totally secure, even today. But the real issue is that the OS's are the weak point. The keys are stored in the OS's RAM, and data must transfer through the OS to be stored or accessed. The data may be in Fort Knox, but the keys are sitting on the mantlepiece under a painting of George Orwell.

Apple and Microsoft are both US companies, even RedHat, so there would be no problem to add legal intercept to the OSes with a secret request. Amazon is in exactly the same boat, US as well, hell they have even started to get U.S. government work. Sounds like a bit of back scratching to me.

Ubuntu is in the UK, so GCHQ can give them secret requests to add legal intercept.

Better than nothing

This is just for when you ship physical media to bulk import into S3. It's optional to protect the data in transit. If some random postman grabs your HDD then I think it's unlikely they'll be able to decrypt your TrueCrypt volume. Surely still a much better option than no encryption at all.

Out of genuine interest, do MS or Google's clouds offer import of encrypted data when you ship bulk data?

Even better would be to encrypt it yourself then wrap it in Truecrypt, at least that would delay anyone wanting to have a nose at your private data before it's dumped onto, a, gasp, public, cloud. Oh.

I'd also much prefer to use something that's open source (apart from the Win binaries) and auditable rather than something who's sourcecode will probably never see the light of day.

You've got to worry who's doing the audit though. I mean, who's really doing the audit?

Fork TrueCrypt?

Given the amount of time now passed the most obvious logical conclusion is that the devs fell on their swords so they wouldn't have add any code helpfully provided by our friends in *insert shady gov acronym here*.

Clearly once a cryptography app reaches a level of popularity gov bods are going to want to insert a get-around mechanism. The only way around that is to kill the app and reminisce about the good old days when privacy on the web actually existed. The newly forked app may just become the next big thing but then the new devs are going to have the same gov bods knocking their at the door just like the old ones did.

Security through obscurity is a much safer bet IMO.

Sounds to me like the devs knew that the audit was going to turn something up eventually and decided to just go ahead and stop now.