TrueCrypt Alternatives

Updated:  Wanted to add https://www.grc.com/misc/truecrypt/truecrypt.htm green shaded box (scroll down a little) shows correspondence from devs of Truecrypt.

TL:DR Confirms that this was just an odd way of quitting.


****

For the couple people that might have missed drama with TrueCrypt see http://krebsonsecurity.com/2014/05/true-goodbye-using-truecrypt-is-not-secure/

TL:DR Looks like people(s) behind TrueCrypt are done supporting it & suggest people use something else, additionally version released with this information only decrypts previously encrypted data, won't encrypt.

In light of this situation, many people are looking for alternatives, best list I have found so far, though I know very little about the suggestions, is http://www.ghacks.net/2014/05/29/list-truecrypt-encryption-alternatives/

Security & Hacking: DEFCON 20 "Can You Track Me Now?"

DEFCON 20: Can You Track Me Now? Government And Corporate Surveillance Of Mobile Geo-Location Data

This was posted on Youtube November 22, 2012, so was well before Snowden release of information in May of 2013.

Main emphasis of this talk was tracking of cell phones.

But Christopher Soghoian briefly covers, at 31:05, that both Android (Google) & iOS (Apple) device encryption can be defeated by Google & Apple respectively.

This is a service they provide for Law Enforcement & other Government agencies.

Google can force a password reset for Android device, they don't require physical access.

Apple appears to use what Soghoian calls a "Master Skeleton key," they require departments to provide actual device (ie physical access).  They then provide unencrypted data on a CD, while device remains encrypted.

I wonder if they might actually need device to decrypt data with way devices since iPhone 4S & iPad 2 have been designed (they have hardware based encryption).

Entire video is worth watching, though it is rather long, they joke about having 3 different audience during the course of the talk.
 

Very interesting NYT article about Snowden, Laura Poitras, & Glenn Greenwald

Longer, more in depth article http://www.nytimes.com/2013/08/18/magazine/laura-poitras-snowden.html?pagewanted=all and a shorter one that is also used in longer article http://www.nytimes.com/2013/08/18/magazine/snowden-maass-transcript.html

Lot of people know who Snowden and Greenwald are now, I think fewer know who Laura Poitras is, sad to say I didn't before seeing this article.

For quick reference about these people see their Wikipedia links:

• Poitras http://en.wikipedia.org/wiki/Laura_Poitras
• Greenwald http://en.wikipedia.org/wiki/Glenn_Greenwald
• Snowden http://en.wikipedia.org/wiki/Edward_Snowden

Lot of things of interest in above links.

Close reading of the NYT's article can provide some useful insights and tidbits to serious security.

I also want to note one comment by Snowden: 

"I was surprised to realize that there were people in news organizations who didn’t recognize any unencrypted message sent over the Internet is being delivered to every intelligence service in the world. In the wake of this year’s disclosures, it should be clear that unencrypted journalist-source communication is unforgivably reckless. "

Introduction to Encryption: "Locking the bad guys out with asymmetric encryption"

http://arstechnica.com/security/2013/02/lock-robster-keeping-the-bad-guys-out-with-asymmetric-encryption/

If you already know a fair bit about encryption, you could skip to the comments http://arstechnica.com/security/2013/02/lock-robster-keeping-the-bad-guys-out-with-asymmetric-encryption/?comments=1

Peter Bright, the author of the article, knows more about the topic than he wrote, he was trying to keep it readable and understandable for people with no background knowledge.

I know I am going to refer people to this article frequently for some time to come, instead of trying to explain it myself.

Mobile Security: Encryption Bug & Fix for iOS devices that shipped with iOS 3.0

I know lot of gamers are computer geeks & hackers, but not all gamers are, I also know lot of computer geeks prefer Android to iPhone, but you may still have friends or family that use iPhone, or maybe you use iPad or iPod yourself for music.

Anyway, my gf has iPad, so I have been doing a lot of research on iOS security.

Found out some real interesting things about iOS security.

See this Elcomsoft pdf for details, they also cover several password keepers in detail in that pdf.  Elcomsoft is a company that build hacking software and tools for governments and police agencies.

If your using an iPhone 4S or iPad2 or newer (ie A5 or newer chip), and use a strong password and lock the iOS device, your pretty darn secure.

Though iPhone 3GS & current gen iPod touch are fairly secure, they can be hacked by companies like Elcomsoft, or people using tools made by those types of companies from what I understand currently.

Apple may have a backdoor, but if they do it has not made news yet, you also need to be careful what you put on the iCloud, cause Apple states in EULA & etc for iCloud that they can view and even delete data from there.

There are password keepers that encrypt on the device but use iCloud or Dropbox for syncing and backup of encrypted data.

Only problem I have found is that there is a Bug that can prevent iOS device from encrypting data if it shipped with iOS 3.0

Full Story with fix at tidbits.com/article/12049.

You can check to see if your iOS device is using encryption by going to Settings > General > Passcode.  Scrolling to bottom of the screen and look for "Data protection is enabled".

You can see a screen shot of this message from an iPhone near bottom of this page http://support.apple.com/kb/HT4175 

Stay Safe,

Cliff