I don't believe that open-source automagically means "more secure" than closed-source... just look at how long the chunked-transfer exploit bug was in Apache until it was found & patched.
However, I strongly believe that you should never used closed-source version of systems like TrueCrypt, because that's one field where Security Through Obscurity fails miserably. Sure, a company making money off a product might have greater interests at stake, but that doesn't stop them from writing shitware and trying to cover up the facts behind code obfuscation etc. Anybody remember the Diebold voting machine horror stories? Or the
gaping security holes in Skype that were found even through skype is heavily obfuscated? (thankfully it wasn't exploited on the massive scaled that I had predicted). Microsoft uses code reordering to make it harder to detect what's patched in their hotfixes in order to make exploit-writing harder, but
bindiff was constructed in order to overcome that... There's a lot of other examples as well.
Yes, there's more to security than "just using TrueCrypt", but if somebody needs decent encryption it really is the best choice (for several reasons), and a sentence like "
but it's not exactly secure but most users consider it secure enough." is plain wrong and misleading. It's not fanboyism, it's just the product being the best choice. Might be overkill for what
siouxdax needs, but I can't advocate using software that gives a
false sense of security
PS: I've never had any stability issues with TrueCrypt, and it's definitely not heavy-weight either.
Recent Posts
- and I don't feel a need to say them either. While I don't use the terms in speech and try to use them somewhat sparingly on forums and the like, I do use a lot of them pretty often on IRC, IM services and when writing SMS'es...
