Do you think that cryptomator is a reliable program?

On Tue, 19 Apr 2022 12:12:26 +0000 (UTC), Anonymous
<nobody@remailer.paranoici.org> wrote:

>Do you think that cryptomator is a reliable program?

Their "encryption" seems to be one of their own making. Schneier says
very simply to never trust proprietary encryption.

As for open source, how many true crypto experts will spend their time
analyzing, testing their proprietary encryption? It takes awhile to
trust any new encryption, even it is "open source".

With external HDs so cheap and large these days, who needs a "cloud"?
After all, this "cloud" nonsense is merely another set of servers
operated by - whom?

And - their "open source encryption" aside, just how secure are not
only their encryption, but their servers?

I trust only PGP or TrueCrypt. (A recent security review of TrueCrypt
found no dangerous security holes in the program. I cannot use
VeraCrypt because despite their claim even the older version crashes
after a while on my XP machine.)

https://www.extremetech.com/computing/202610-security-review-finds-no-critical-flaws-in-truecrypt-7-1a

An excerpt from the above page:
"What the audit team didn’t find

In the words of cryptographer Matthew Green, “Based on this audit,
Truecrypt appears to be a relatively well-designed piece of crypto
software. The NCC audit found no evidence of deliberate backdoors, or
any severe design flaws that will make the software insecure in most
instances.”

This is the second audit that TrueCrypt has now been through, which is
two more than most other free, cross-platform security suites. Even
the forks of TrueCrypt, like Ciphershed and VeraCrypt, haven’t been
audited yet — and while the developers of VeraCrypt have publicly said
they’ll fix Truecrypt’s flaws, it’s also possible (despite the best of
intentions and skill) that the teams behind VeraCrypt and Ciphershed
could introduce new bugs that weren’t present in Truecrypt."

So, for me it's simple: TrueCrypt containers or encrypt the entire C:.
If not that, it's PGP.

Ain't saying that nothing else is trustworthy, but these two programs
have won battles in court over the Black Hats - meaning gov't tyrants
and hateful ex's.

> I trust only PGP or TrueCrypt. (A recent security review of TrueCrypt
> found no dangerous security holes in the program. I cannot use
> VeraCrypt because despite their claim even the older version crashes
> after a while on my XP machine.)

Thank you

>
> I trust only PGP or TrueCrypt. (A recent security review of TrueCrypt
> found no dangerous security holes in the program. I cannot use
> VeraCrypt because despite their claim even the older version crashes
> after a while on my XP machine.)
>
I lost a huge amount of data last month because my veracrypt files suddenly would no longer decrypt. I was able to get one of my veracrypt files to decrypt, but it was a veracrypt hidden files. It could be that making all your files hidden files will keep you from having the loss I experienced. I used truecrypt for years before switching everything to veracrypt and never had any problems with it. I would suggest staying with the original truecrypt program. I am now just using encrypted 7-zip to protect my files.

On Tue, 19 Apr 2022 17:27:22 -0500, harry@invalid.com wrote:

>On Tue, 19 Apr 2022 12:12:26 +0000 (UTC), Anonymous
><nobody@remailer.paranoici.org> wrote:
>
>>Do you think that cryptomator is a reliable program?
>
>Their "encryption" seems to be one of their own making. Schneier says
>very simply to never trust proprietary encryption.

You might take note of this, too.

(The best encryption is worthless if your password is 12345678.)

http://www.stack.nl/~galactus/remailers/passphrase-faq.html

These are examples of passphrases and the PS numbers associated with
them. If you can work through these and get the same numbers, then you
are well on your way to understanding how to make passphrases good or
bad.

..280 An average phrase
There is a sucker born every minute.

..761 Phrases with some random letters.
Ignorance is bliss. spgemxk Education cures ignorance.

..855 Nonsense phrase
betty was smoking tires in her peace of pipe organs and playing tuna
fish.

1.05 A random bunch of characters.
A6:o@6 Ls+\` uGX%3y[k

1.125 Random words
paper factors difference votes behind chain treaties never group

1.34 Odd capitalization/punctuation and nonsense.
Web oF thE Trust is BrokEn cAn You Glue it Back ToGether? and give it
xRays.
=========
There is Diceware for creating passphrases, but I choose a faster but
less secure way to create my passphrases. I use this site which I
downloaded to my computer for use offline.

https://www.fourmilab.ch/javascrypt/pass_phrase.html

I create maybe twenty 10 letter passphrase. But I do not use one of
the entire phrases. I skip about choosing a number of words to
combine into a passphrase for my use.

Yeah, it might not be as secure as Diceware, but by misspelling a few
of the words, and adding a couple of punctuation marks, it's fine
enough for the joe smith nobody. Matter of fact, I think after the
slight changes I make, I don't think any hacker or gov't is going to
hack a 8 - 10 word phrase made my way.

Here is a damn good page from Schneier's site.
https://www.schneier.com/essays/archives/2007/01/secure_passwords_kee.html

And since I still use XP, I can use Disk Investigator to search my
entire C: drive to see if Windows secretly has captured and stashed
any of my passwords/passphrases somewhere on the C:. (It is available
in some other sites for 64 bit.

https://www.majorgeeks.com/files/details/disk_investigator.html

This site says it's available for newer versions of Windows. I don't
know if that is true. Many download pages have erroneous info about
which version of Windows a certain download will work with.
https://disk-investigator.en.lo4d.com/windows

And, for the helluva it - something I learned the hard way more than
once.

Schneier says WRITE DOWN YOUR GODDAMN PASSWORDS!
https://www.schneier.com/news/archives/2010/11/bruce_schneier_write.html

On Wed, 20 Apr 2022 13:42:44 -0500, "rmd"
<remedy@not-for-mail.invalid> wrote:

>>
>> I trust only PGP or TrueCrypt. (A recent security review of TrueCrypt
>> found no dangerous security holes in the program. I cannot use
>> VeraCrypt because despite their claim even the older version crashes
>> after a while on my XP machine.)
>>

>I lost a huge amount of data last month because my veracrypt files
>suddenly would no longer decrypt. I was able to get one of my
>veracrypt files to decrypt, but it was a veracrypt hidden files. It
>could be that making all your files hidden files will keep you from
>having the loss I experienced. I used truecrypt for years before
>switching everything to veracrypt and never had any problems with
>it. I would suggest staying with the original truecrypt program. I
>am now just using encrypted 7-zip to protect my files.

Don't trust 7zip. Some explanatory links here:

https://duckduckgo.com/?q=7zip+security&t=h_&ia=web

>
> Don't trust 7zip. Some explanatory links here:
>
> https://duckduckgo.com/?q=7zip+security&t=h_&ia=web

Thanks. CHM file deleted.

harry@invalid.com wrote:

>>Do you think that cryptomator is a reliable program?
>
> Their "encryption" seems to be one of their own making. Schneier says
> very simply to never trust proprietary encryption.

Actually, they use AES-CTR... it's all in their documentation:
https://docs.cryptomator.org/en/latest/security/architecture/#file-
content-encryption

> I trust only PGP or TrueCrypt. (A recent security review of TrueCrypt
> found no dangerous security holes in the program. I cannot use
> VeraCrypt because despite their claim even the older version crashes
> after a while on my XP machine.)

Totally different use case - for the use case Cryptomator adresses,
TrueCrypt (which is outdated and not maintained any longer anyway!) or
VeraCrypt simply don't work:

Cryptomator is used for accessing individual files stored in a
filesystem
stored on a cloud service. With a container-based encryption like
TrueCrypt, you'd have to download the entire container from the cloud
to
open it, which simply isn't practical, especially on a mobile platform
(where Truecrypt isn't available anyway...)

On Thu, 21 Apr 2022 08:48:45 +0100, LO AND BEHOLD; Juergen Nieveler
<usenet@nieveler.org> determined that the following was of great
importance and subsequently decided to freely share it with us in
<XnsAE806378B8481juergennieveler@nieveler.org>:
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= harry@invalid.com wrote:
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?=
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= =?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= =?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= Do you think that cryptomator is a reliable program?
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= =?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= Their "encryption" seems to be one of their own making. Schneier says
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= =?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= very simply to never trust proprietary encryption.
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?=
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= Actually, they use AES-CTR... it's all in their documentation:
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= https://docs.cryptomator.org/en/latest/security/architecture/#file-
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= content-encryption
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?=
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= =?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= I trust only PGP or TrueCrypt. (A recent security review of TrueCrypt
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= =?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= found no dangerous security holes in the program. I cannot use
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= =?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= VeraCrypt because despite their claim even the older version crashes
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= =?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= after a while on my XP machine.)
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?=
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= Totally different use case - for the use case Cryptomator adresses,
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= TrueCrypt (which is outdated and not maintained any longer anyway!) or
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= VeraCrypt simply don't work:
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?=
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= Cryptomator is used for accessing individual files stored in a
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= filesystem stored on a cloud service. With a container-based encryption
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= like TrueCrypt, you'd have to download the entire container from the
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= cloud to open it, which simply isn't practical, especially on a mobile
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?= platform (where Truecrypt isn't available anyway...)
=?UTF-8?B?8J+Ps++4j+KAjfCfjIg=?=

keep in mind that you're replying to someone who can't figure out how to google "cryptomator encryption algorithm"

https://www.google.com/search?q=cryptomator+encryption+algorithm

par for the course for usenet trolls who want to sock up anonymously because they keep losing their freebie accounts spreading their conservative hatespeech like so much manure.

"4 out of 5 pet rocks" won't comment on this poast...

On Sun, 30 May 2021 12:23:08 +0000 (UTC), LO AND BEHOLD; Red Elephant
<none@yourbusiness.com> determined that the following was of great
importance and subsequently decided to freely share it with us in
<s9003c$6mc$1@gioia.aioe.org>:
✡ That Jen creature is still gone? HAHAHAAH Love it Fucking gender queers
✡
✡ https://ibb.co/HKHGK5z https://ibb.co/fFK3bMT https://ibb.co/TtBrHtY

--
[THIS POAST HAS PASSED TRIMCHECK® VALIDATION]

THIS SPACE FOR RENT
https://www.youtube.com/watch?v=iB6B8jGSdLA

-

"Also, it makes you look intellectually weak if you constantly spout derogatory opinions about people, but can never back any of them up with valid reasons. In alt.checkmate, someone will challenge that every time." - _The Most Ironic Thing Ever Said_ by Checkmate in <MPG.3a6d564ad426be8d989eb1@news.alt.net>

-

"Starting with the World's Ugliest Chimp, Maxine Waters. That bitch is
hideous! It's no wonder "she always mad," to put it ebonically." - Checkmate "looking intellectually weak" (and racist AF) in <MPG.3a81d71c7c7ba04998a064@news.alt.net>

-

"Subject: THE GREAT MASK MYTH... UNMASKED" - Checkmate the anti-masker in https://groups.google.com/g/alt.checkmate/c/ROknxOsPeEE/m/I-cujRAzBQAJ

-

"Conservatives aren't looking for a war. Libtards are planning one, and it
starts with the cowardly antifa punks who dress in black, cover their
faces, wear helmets, and surround elderly citizens, poking them with
metal-tipped umbrellas. You know, like fascists." - another borken prediction from Checkmate (umbrella guy was later found to be a fascist) in <cue77g.ten.19.9@news.alt.net>

-

"It will always be with you. Why do you think I hate those bastards as much as I do? I've been watching a lecture series on the history of the muzzies... many hour's worth, in fact, and the muzzies have been that way for thousands of years. It's in their culture. Every few hundred years, they try to invade Europe or some other region nearby, and have to be beaten back. They just need to be eliminated to whatever extent that's possible. You can't kill ideas completely, but you can set them back a few generations when necessary.

One important distinction between islam and christianity, is both religions have historically used their "beliefs" as a means to control the ignorant Unwashed Masses, only Western civilization became educated enough to take that power away from the clergy. The muzzies like their citizens to remain dumb, brainwashed, and obedient. That's why the radical ones are nearly all from The Land That Time Forgot. They're still stuck back in the fourteenth century, and suffer from the delusional notion that they're going to drag the rest of the world back there with them. As I see it, there's only one solution to that problem, and it's the same one we use to rid ourselves of rats, cockroaches, and other vermin." - Checkmate said this psycho lunatic shit in <MPG.34138d3d6e7bb33c991772@news.altopia.com>

-

"What you see happening in Europe now... defiant muzzies openly proclaiming that they have no desire to "assimilate" or co-exist with Europeans, and stating that their objective is to turn all of Europe into a muzzie dominated region under sharia law, is the harbinger of what they have planned for the US. To what extent they'll be successful with that here can be debated, but should not be underestimated. I wish I could share your optimism in that regard, but I don't.

Terror attacks are only one page out of the muzzie play book. They serve more as a distraction. The real goal is occupation, and that's already well underway. They've got that frog pretty well boiled in Europe now, and they're getting bolder by the day. The longer the Europeans wait to do something about it, the harder it's going to be TO do anything about it. It may already be too late IMO. This is going to get real messy in a hurry." - Checkmate crying about some bullshit about muslims in europe that's he's convinced himself is true.

-

"Bitches don't get to use the Pussy Card when they initiate an
assault." - Cuckmate the Wonder Klown in <dfrauh.8sn.17.129@news.alt.net>

-

"Thanks to muzzies and their apologist-enablers like puppy whistle, this seems to be the new norm in the world. It's spreading like a cancer, and it's time we admit we're at war with pure evil. We need to put an end to this muzzie plague, or life on Earth is going to become pure hell everywhere. We need to get these people out of every civilized country, and there's only one way to do it. IOW, we have to become like them, with an emphasis on expediency over cruelty." - Herr Fuhrer Checkmate (of alt.checkmate)

-

"Pussy Willow has just proven that Trump's crackdown on previously unenforced immigration policies is working. We'll deal with the domestic terrorists as needed, but we don't need to be letting the muzzie terrorists get a foothold in our country too. One need only look at what they're doing in Europe right now to know we're doing the right thing by keeping them out, which is our right and our duty. - Checkmate (#1 pussy willow fan)

-

"You just made puppy whistle's sig line longer." - Janithor

-

STOP! (janithor time.):

i hope his sails weren't torn asunder with words on a screen, or
somesuch, but also i hope that his pain is not as bad as the murderguy
who got hit with a skateboard. - anynonymous

-

"If I have a complaint about the (Southern Poverty) Law Center's description (of the alt-right movement), it is the phrase "heavy use of social media," which implies the alt-right is a real-world movement which uses a lot of social media. This is backwards: it is an online movement which occasionally appears in the real world. Where it gets punched." - Jason Rhode

-

"I think we should destroy every last fucking mosque in America." - "Checkmate, DoW #1" <Lunatic.Fringe@The.Edge> proves for us that white males are violent in Message-ID: <MPG.32c5bfefd18c9a698f0a8@news.altopia.com>

-

"I wasn't even aware that I HAD a religion. I'm pretty-much against all of The Big Three, but the muzzies are at the top of the list." - Checkmate

-

"Such "places of worship" are terrorist breeding grounds, as has been proven on many occasions. Please refrain from morphing out of my
killfile." - Checkmate on his belief that all Mosques are where terrorists are.

On Thu, 21 Apr 2022 08:48:45 +0100, Juergen Nieveler
<usenet@nieveler.org> wrote:

>harry@invalid.com wrote:
>
>>>Do you think that cryptomator is a reliable program?
>>
>> Their "encryption" seems to be one of their own making. Schneier says
>> very simply to never trust proprietary encryption.
>
>Actually, they use AES-CTR... it's all in their documentation:
>https://docs.cryptomator.org/en/latest/security/architecture/#file-
>content-encryption
>
>> I trust only PGP or TrueCrypt. (A recent security review of TrueCrypt
>> found no dangerous security holes in the program. I cannot use
>> VeraCrypt because despite their claim even the older version crashes
>> after a while on my XP machine.)
>
>Totally different use case - for the use case Cryptomator adresses,
>TrueCrypt (which is outdated and not maintained any longer anyway!) or
>VeraCrypt simply don't work:
>
>Cryptomator is used for accessing individual files stored in a
>filesystem stored on a cloud service. With a container-based
>encryption like TrueCrypt, you'd have to download the entire
>container from the cloud to open it, which simply isn't practical,
>especially on a mobile platform (where Truecrypt isn't available
>anyway...)

As for Cryptomator being "secure" - Big Maybe

https://www.schneier.com/essays/archives/1998/01/security_pitfalls_in.html

schneier.com Essays: Security Pitfalls in Cryptography Bruce Schneier

"Strong cryptography is very powerful when it is done right, but it is
not a panacea. Focusing on the cryptographic algorithms while ignoring
other aspects of security is like defending your house not by building
a fence around it, but by putting an immense stake into the ground and
hoping that the adversary runs right into it. Smart attackers will
just go around the algorithms."

and

A cryptographic system can only be as strong as the encryption
algorithms, digital signature algorithms, one-way hash functions, and
message authentication codes it relies on. Break any of them, and
you’ve broken the system. And just as it’s possible to build a weak
structure using strong materials, it’s possible to build a weak
cryptographic system using strong algorithms and protocols.
---
As for Fraud - claiming to use a "secure" encryption when NOT -

Take a look at the popularity of these encrypted proggies by Gregory
Braun.

https://duckduckgo.com/?q=gregory+braun+encryption&t=h_&ia=web

Then see this -

http://web.archive.org/web/20050421234022/http://www.fortunecity.com/skyscraper/coding/379/caz6a.htm

"Abstract

Braun pretends to use the BlowFish algorithm to provide secure
encryption in his application Crypto v3.5. Actually the algorithm used
is a weak proprietary one."
----------
Who can you trust? No one. Only TIME will tell the real tale as to
the security of an algorithm. So far, Truecrypt and PGP have made
the cut.
-----
>Cryptomator is used for accessing individual files stored in a
>filesystem stored on a cloud service. With a container-based
>encryption like TrueCrypt, you'd have to download the entire
>container from the cloud to open it, which simply isn't practical,
>especially on a mobile platform (where Truecrypt isn't available
>anyway...)
When I mentioned TrueCrypt i was speaking of its general usage, not of
storing volumes online. My mentioning PGP was meant for such usage.
I would only trust uploading an encrypted file created by myself with
PGP. As far as I'm concerned, trusting to use the Online company's
encryption for uploading "secret" info is a no-no
--------
As for claims by some "expert" or other of having analyzed an
encryption proggie - as Schneier wrote, ask them, "Who are you?"

If they don't have the history and qualifications of a Schneier, why
trust their results?
----------
My intuition regarding trusting Cryptomator is the same as I hold
regarding any site and their claims of security.

I ain't no expert regarding encryption and its pitfalls, so I can only
follow the advice of experts like Schneier.

Like my Mama use to say, it's better to be safe than sorry.