1

After looking for software to store information, I found a program that caught my attention instantly. I purchased a license but after a while, I realized that the program had a big vulnerability.

On the official page, it specified that it is possible to protect the information using encryption with a password. However, by doing tests, I discovered that all the supposedly encrypted information could be accessed without entering the password, although not in a way that every user would do.

At this point, I already feel that I have no trust for this software. If you use encryption, isn't the information supposed to be inaccessible?

So, I would like to send this program somewhere to see if it complies with, at least, the user's data protection, because I want to trust that my data is totally private when using that program. At least, know that it does not have a backdoor.

Updated:

The BUG was reported and corrected within 2 days. However, it does not give me confidence because it is using the same form and it makes me that this time it has simply made the information not visible. I do not think it is applying an encryption.

Improve this question
4
  • Exactly what do you mean by "complies with the user's data protection"?
    – Anders
    Nov 12, 2018 at 8:13
  • @Anders I mean, in the worst case, if it is not possible that there is a back door and the information is not in good hands.
    – MarianoM
    Nov 12, 2018 at 8:28
  • Are you talking about complying with some specific laws? Or just complying with good security practice in general?
    – Anders
    Nov 12, 2018 at 8:31
  • @Anders I think that a software without backdoor is a good practice of general security. I'm not saying I have it, but it's hard to trust after discovering this BUG and ensuring that the information was encrypted. How do I know that it fulfills what it says? What would you do in my place?
    – MarianoM
    Nov 12, 2018 at 8:37

1 Answer 1

Reset to default
2

Unfortunately, there is nowhere you can send software to be independently audited for free. While you can send a bug report to the authors as already mentioned, that will not result in a comprehensive audit. Software audits are complex and take a lot of time, which means they can be quite expensive.

If the software seems like it's not written well, or you suspect that there are likely other severe bugs hiding in there, the best thing to do would simply be to look for an alternative. This is especially important if the software is obscure or rarely used and is unlikely to attract a lot of reviewers.

Improve this answer
2
  • Thank you very much for answering. I did not know it was so hard to review software. The truth is that this software that I use, is unique, I have not yet found one that is the same and that is why I decided to buy the license. Do you think that if you have a backdoor, only blocking the program's connection to the internet would be enough?
    – MarianoM
    Nov 12, 2018 at 9:00
  • @MarianoM If it actually has a backdoor, then blocking its connection will not be enough. However it's unlikely that it has a real backdoor. It might be buggy, but backdoors are very rare.
    – forest
    Nov 13, 2018 at 3:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .