Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Diskcryptor is an open-source competitor to TrueCrypt for Windows. It has an edge over Truecrypt for system encryption, because it allows for more than one independently encrypted system partition, and this is exactly why I use it.

Can anyone here confirm that this program doesn't have backdoors and is as secure as Truecrypt? Is anyone aware of any security analysis of this product?

By secure I mean: lack of backdoors, proper handling of encryption, and even resistance against the evil maid attack.

share|improve this question
    
Secure is subjective. What sort of attacks are you looking to protect against? –  Steve Mar 23 '12 at 20:00
    
I can't find any documentation on how key derivation works. There are some mentions of PBKDF2, but that's about it. –  CodesInChaos Mar 23 '12 at 20:13
    
I mean as secure as TrueCrypt is, with all the caveats. I'll update the question. –  Adam Ryczkowski Mar 23 '12 at 20:38

3 Answers 3

You do know that Truecrypt is also free and open-source, right?

Aside from commissioning independent testing, the only assurance you are likely to get is from users/hackers discovering issues and publishing them on the web, so your first port of call should be a google search for Diskcryptor advisories

Number of advisories published can be a reasonable indicator of development quality, when considered along with usage numbers - obviously a product with large numbers of users could be expected to have more issues reported than a less popular one. Alternatively, look at the documentation on their development and testing processes - or their bugfix revisions.

Finally, you could look into the authors of each tool and see whether you can place some reliance in their work.

share|improve this answer
    
There are some concerns about security of the TrueCrypt: krebsonsecurity.com/2014/05/… . –  Adam Ryczkowski May 29 at 9:12
    
The developers have abandoned the project, but that doesn't mean that TC is not secure. The audit has finished it first phase and it shows only minor flaws: istruecryptauditedyet.com –  Martin Argerami Jun 1 at 16:16

Ultimately when I look at software, I tend to rate the reliability based on how long it has been around and how solid of a community it has, plus I'll look at how it's being used and what the buzz on the internet is around it.

When it comes to DiskCryptor, although I can't answer your question with a yes/no, what you might want to do is search around and see the history, the usages, partners, etc. and from there decide whether or not it's what you need.

share|improve this answer

I'm all for opensource and free, however depending on the application (work computers VS. personal laptop) you may want to consider a paid third party program to shift "plausible deniability" from yourself to the manufacturer who is selling the encryption software to your company. Otherwise if something goes wrong, your company may try to hold you liable for any damages and or losses. To detect any possible "backdoors" you could run wireshark and just sniff your own traffic and see. There are also several free firewalls that could help in detecting a program trying to communicate to outside sources. I'd start with wireshark.

share|improve this answer
4  
Almost all software - paid or free has an AS IS clause in the EULA so the company is shielded from exactly the scenario you mention. Regardless of the case, the responsibility is pretty much always placed on the person who deploys and manages the system. If makers were liable, Microsoft and others would be bankrupt by now –  theonlylos Mar 26 '12 at 23:43
1  
Most of the time this is correct, however depending on the type of business that it's used there are manufacturers that actually have service level agreements and business associate agreements, say for example HIPAA or HITECH acts. LuxSci sells a product for email encryption and they provide several written contracts that help offset the liability of the tech who would impliment it. Check out luxsci.com/extranet/hipaa-baa-standard.html There is always some level of liability of the one who impliments it, but premium providers usually have something that will help cover your butt. –  Brad Mar 27 '12 at 16:04
    
Ah, thanks for the clarification on that. As I don't often deal with regulated environments I typically have clients using less stringent software. –  theonlylos Mar 28 '12 at 1:47
    
Thank you very much for your time in explaining. I'm self-employed, so it doesn't really matter for me who would be responsible for leakage of data. I just want' to make sure it doesn't happen. –  Adam Ryczkowski Mar 28 '12 at 8:14
    
Since you are a consultant I'd hire an attorney to go over any contracts that you have clients sign and make sure that you have a clause that would limit damages and make sure that you have a good umbrela policy in case you need it. If you deal with any retail stores you will have to deal with PCI compliance for handling credit cards so don't let those clients skimp on any security costs and be sure to cover EVERY aspect in your contract with them. –  Brad Mar 29 '12 at 15:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.