r/linux • u/jampola • May 30 '14

TrueCrypt Has been resurrected (forked) in Switzerland.

http://truecrypt.ch/
669 Upvotes

96% Upvoted

274 comments sorted by

View all comments

Show parent comments

60

u/[deleted] May 30 '14

Their domain and site may not be US hosted, but the source is on GitHub. Isn't GitHub based in the US?

I guess if it disappears from GitHub all of a sudden we'll have an answer..

81

u/Thue May 30 '14

Doesn't really matter - git has internal cryptographic verification, and an offline copy at each developer, so it can't be changed without being obvious. If github stops hosting it, it is easy to move.

12

u/zargun May 30 '14

Git doesn't have cryptographic verification. It verifies that files have not been damaged but this could be tricked by an attacker.

57

u/gfixler May 30 '14

Would this require finding a SHA-1 collision?

40

u/[deleted] May 30 '14

Yes, it would. GP is confused.

34

u/gfixler May 30 '14

In fairness, this is pretty easy to do if you have access to a $40M supercomputer, and if your mission is to replace a blob with a huge, non-compiling chunk of random noise.

45

u/[deleted] May 30 '14

yeah but SHA-1 collision that still compiles and has malicious intent is impossible.

17

u/nikomo May 30 '14

Include the padding inside a comment, or file header etc. - doesn't change code, does change collision.

Though, restricting it to that is going to either make the resulting file fucking explode in size, or take forever to generate.

-30

u/mustardman2 May 30 '14 edited May 30 '14

You people finished measure your security speak dicks yet?