[HN Gopher] Ask HN: What do you use for encrypting your personal...
       ___________________________________________________________________
        
       Ask HN: What do you use for encrypting your personal stuff?
        
       I used to use Truecrypt (file based virtual encrypted disk). But it
       shut down under mysterious circumstances. Now there is veracrypt
       based on the same source code, but I am not sure I trust it. Are
       there better alternatives? What does everyone use?
        
       Author : yangikan
       Score  : 23 points
       Date   : 2022-10-24 21:17 UTC (1 hours ago)
        
       | aborsy wrote:
       | LUKS is the de facto disk encryption in Linux. For file system
       | encryption, use fscrypt and ZFS native encryption. For backups,
       | use restic or Borg. For encrypted synchronization, use
       | cryptomator, gocryptfs or rclone. File encryption is rarely
       | needed anymore, but GPG works fine for that.
       | 
       | Depends what you want to encrypt.
        
       | schainks wrote:
       | LUKS on linux works great. Restic can encrypt your backups before
       | they go into whatever cloud will store it the cheapest.
        
       | e12e wrote:
       | Generally zfs native encryption these days (as well as native
       | encryption in macos and windows).
        
       | freedomben wrote:
       | For encrypting files, I use AEScrypt[1]. Cross platform, simple
       | to use, and easy to audit.
       | 
       | [1]: https://www.aescrypt.com/
        
         | tptacek wrote:
         | I probably wouldn't. It looks pretty old, uses a fucky bespoke
         | KDF for passwords (I'm looking at the 3.16 source code), has
         | file metadata that doesn't appear to be authenticated, and does
         | a weird dance of including the PID and time in the IVs for what
         | looks like CBC mode?
         | 
         | You could build something more secure using the hello-world
         | code for Go's Seal/Unseal crypto/ libraries, or Rust's Ring
         | crate.
        
       | Arubis wrote:
       | Bit rot. If my backups aren't redundant and I don't care to
       | access something for long enough, it eventually becomes
       | inaccessible to others.
       | 
       | Full-disk encryption from your OS vendor (FileVault, LUKS,
       | whatever windows does) will accelerate this process.
        
       | paulpauper wrote:
       | zipcrypto...jk
        
       | hot_gril wrote:
       | Encrypted sparse bundle disk images on macOS. No extra software
       | needed.
       | 
       | On Linux, there's LUKS as mentioned already.
        
       | m-p-3 wrote:
       | Cryptomator for cloud-based storage, as it allows my to encrypt
       | each files inside the vilolume separately, which makes it much
       | more bandwidth friendly to desktop synchronization software.
        
         | yangikan wrote:
         | Does this work on Windows/Linux?
        
       | trog wrote:
       | It sounds like you're running Windows?
       | 
       | On Windows I just use the built-in Bitlocker encryption.
       | 
       | It is a bit annoying understanding what this means between
       | Windows Home and Pro editions though.
       | 
       | On Home, it's not technically 'Bitlocker' - it's Device
       | Encryption - hit Windows key & type 'device encryption' - if you
       | see 'Device Encryption Settings', you should have it available.
       | If you do not, it's probably not available on your device e.g.
       | maybe you don't have a TPM, although I've had Windows machines
       | that showed it as not available but then I was able to get it
       | running with a bit of messing around and registry hacking.
       | 
       | It is still Bitlocker under the hood, but it's missing some
       | features. You can get some of them by logging into your machine
       | with a Microsoft account, but if you're running a local account
       | (like I am) you get a more budget experience (e.g. I don't think
       | there's an easy way to get the Bitlocker encryption key or have
       | it backed up online).
       | 
       | If you only want to run local accounts, the easier and probably
       | safer solution is to shell out for Windows Pro and take advantage
       | of the full Bitlocker experience.
        
       | [deleted]
        
       | c7b wrote:
       | TrueCrypt still works and doesn't have any known vulnerabilities
       | afaik. For low-risk files I also sometimes use WinRAR, which
       | according to the docs should have ok encryption (AES-256).
       | Curious for other suggestions too.
        
       | rmind wrote:
       | rvault for small documents: https://github.com/rmind/rvault
       | 
       | It uses envelope encryption with one-time password (OTP)
       | authentication. I like to store data on my systems and just run
       | backups regularly.
        
       | runjake wrote:
       | VeraCrypt.
       | 
       | The VeraCrypt FAQ addresses your concern:
       | https://www.veracrypt.fr/en/FAQ.html
       | 
       | Direct link to audit: https://blog.quarkslab.com/security-
       | assessment-of-veracrypt-...
        
       ___________________________________________________________________
       (page generated 2022-10-24 23:01 UTC)