I notice that encfs fails to mount a filesystem when a wrong password is entered.
However, this capability of detecting whether a password is right or wrong can allow brute-force attacks to be carried.
Is there a way to disable password checking in encfs?
I realize this will have some drawbacks such as silent failures when a genuine user enters a wrong password. However, this could be mitigated by the user by a custom script. For example, a script that mounts encfs and then does a cat mountPoint/welcomeMessage.txt
. The user would know from the output whether mounting was successful or not. This I believe is much safer because brute-force attacks are not possible without prior-knowledge of the contents of welcomeMessage.txt.
If it is not possible to disable password checking in encfs, is it a vulnerability?
cat mountPoint/welcomeMessage.txt
automatically? – CL. Apr 30 '14 at 8:42