Attention VeraCrypt version 1.26.1 is not safe

github.com

17 points·medo-bear··4 comments

Open articleView on HN

I agree with wendig0x here. Specifically, I find the following quite suspicious:

1. One of the PR submitters have two[1][2] GitHub users, both used in commits in the PR.

2. The PR is made up of commits from 3 different GitHub users[1][2][3].

3. The PR contains many changes and does not describe them well enough

4. It does not seem that any meaningful amount of code review by maintainers went into the PR

[1]: https://github.com/Van-Fouran

[2]: https://github.com/felixreichmann

[3]: https://github.com/Bruna2803

From maintainer:

This PR will be reverted on master and then put on a dedicated branch. Version 1.26.1 is a test version whose objective was to gather feedback from the community about ideas proposed by Van-Fouran

Speaking of which, what's the status of TrueCrypt btw? Is it still discouraged? I've been using it for years.

And if I wanted to make the effort to move to VeraCrypt, are they compatible? Can VeraCrypt open TrueCrypt files? What about vice-versa?

EDIT: to expand a bit, encryption software is something I'm especially weary of changing. In the ideal world I'd just use forever a version which I know is safe. As far as I'm aware, no audit ever found significant issues with TrueCrypt. Is this still the case?

TrueCrypt is secure cryptographically. There are potentially severe vulnerabilities in its Windows implementation that allow for ACE and privesc, but they're pretty boutique.

Reply on news.ycombinator.com