Hacker News Reader

Comment by vengefulduck | Hacker News Reader

> Encrypted is Encrypted

This is very much not the case as their are numerous side channel attacks against unauthenticated symmetric ciphers with regards to padding

   [1] http://www.cs.colorado.edu/~jrblack/papers/padding.pdf

View on HN

That's not what my comment, or the article is about at all though. There are a number of attacks, my question was in regards to some of the copy on their site.

We would spend our entire day here if we had to discuss attack surfaces and different encryption trade offs if that was the original topic I was discussing.

I understand, but your first comment was criticizing how the comparison was misleading and their are valid concerns that people who are using veracrypt on the cloud might have if their data was unauthenticated; which cryfs addresses.

I still think it is misleading. Once you have a veracrypt container created, an attacker can't just modify a file inside of it without you noticing because it'll just be garbage data at that point.

That is, unless they have your container password / key then it's all over anyway so that point is moot regardless.

Actually I think, the misunderstanding is on your side. Unauthenticated DOES mean that the attacker can modify anything without you noticing. You might only notice because you are getting a file that looks like random junk but you wanted it to be a picture. But that is not something you should rely on for security.

Reply on news.ycombinator.com