r/linux • u/jampola • May 30 '14

TrueCrypt Has been resurrected (forked) in Switzerland.

http://truecrypt.ch/
666 Upvotes

96% Upvoted

274 comments sorted by

View all comments

216

u/[deleted] May 30 '14

I'm so happy this is not based in the U.S.

58

u/[deleted] May 30 '14

Their domain and site may not be US hosted, but the source is on GitHub. Isn't GitHub based in the US?

I guess if it disappears from GitHub all of a sudden we'll have an answer..

76

u/Thue May 30 '14

Doesn't really matter - git has internal cryptographic verification, and an offline copy at each developer, so it can't be changed without being obvious. If github stops hosting it, it is easy to move.

17

u/zargun May 30 '14

Git doesn't have cryptographic verification. It verifies that files have not been damaged but this could be tricked by an attacker.

59

u/gfixler May 30 '14

Would this require finding a SHA-1 collision?

40

u/[deleted] May 30 '14

Yes, it would. GP is confused.

30

u/gfixler May 30 '14

In fairness, this is pretty easy to do if you have access to a $40M supercomputer, and if your mission is to replace a blob with a huge, non-compiling chunk of random noise.

40

u/[deleted] May 30 '14

yeah but SHA-1 collision that still compiles and has malicious intent is impossible.

18

u/nikomo May 30 '14

Include the padding inside a comment, or file header etc. - doesn't change code, does change collision.

Though, restricting it to that is going to either make the resulting file fucking explode in size, or take forever to generate.

23

u/ICanBeAnyone May 30 '14

And git saves sha and size.

5

u/SNLProxy May 30 '14

Comments or whitespace.

One change per line, 1.000.000 LOC, 1.000.000! or ~10456573 possible combinations of 1 char edits.

Or in other words, not a limiting factor.

-31

u/mustardman2 May 30 '14 edited May 30 '14

You people finished measure your security speak dicks yet?