How can you be sure that the downloadable binaries are based on the publicly available source code? The geeks at C’t tried to verify this and found that it is amazingly complicated. How often is someone willing to invest that much time and take such a close look as did the Ubuntu team? But there is another, perhaps bigger, problem. However, this can only be considered as a random sample. They didn’t find backdoors, and their only criticism was that the key files were not well protected. The Ubuntu Privacy Remix Team had the time in 2011 and analyzed TrueCrypt 7.0a. You have to rely on people who are blessed with a lot of time. However, in practice, this is not really a realistic option for the average IT pro. Some Open Source supporters argue that you can always check the source code if you have doubts about the trustworthiness of the software. Not really trustworthy-at least questionable-for a security solution, if you ask me. The digital signature of TrueCrypt 7.1a is owned by the TrueCrypt Foundation and is expired. The domain was registered to dubious postal addresses in different countries and now belongs to TrueCrypt Developers Association LC, a letterbox company in Nevada. What surprised me most in the C’t article is that it is unclear who is really behind TrueCrypt. Implementation flaws happen to the best developers and can even make encryption schemes vulnerable that have been mathematically proven secure.

I am not talking about common security holes like the FireWire attack or the Stoned hack.

Whereas I had my doubts that this is always true for relatively unknown Open Source software, I assumed that at least the popular tools, such as TrueCrypt, are safe because the community is big enough to ensure that the code is clean. It is one of the mantras of the Open Source movement that the community guarantees the security of free software by relentlessly inspecting the source code for vulnerabilities and backdoors. 118-119) regarding the trustworthiness of TrueCrypt. I am not really known as an Open Source enthusiast, but even I was surprised when I heard about the results of the C’t magazine inquiries (2013/16, p.

Prism 7.0a download