The problem with most file encryption tools. A case study.

Before I begin, I am a software developer, not high profile just a nobody software developer who codes for an organization.
I've been going through the source code of a lot of file encryption tools such as Cryptomator, Age, Picocrypt etc.
Let's start with Cryptomator. It is a tool that mounts a folder of encrypted files. It has 10.3k stars on github (pretty good). It uses AES256 bit encryption. So I decided to build it myself, which was fairly easy. The problem starts when I check the dependencies, It has dozens of those, some written by the same team under org.cryptomator. We trust open source software but how can someone even read the source code without spending a significant amount of time. There are around 40 repos and going through the relevant ones is not feasible for most people who can code. Let's say a few people with time and knowledge have reviewed the code but that doesn't mean that the 3rd party libraries are also reviewed. Security issues can happen anywhere (remember log4j).
Next I tried Age, lots of github stars, lots of reputation, made by a cyber celebrity (Filippo), The codebase seems simpler compared to cryptomator, but again, not so noob friendly, it will certainly take a lot of time and knowledge to review the code for any weird choices made, something most users, including me, don't have. But if I take it by it's reputation, why is it not recommended by Privacyguides.org, the answer is here . Apparently, the cryptography choices made could be better, no nonce and 128 bit key are not the best that's out there. Not an expert here, just thinking why they chose to do so.
If you opened the link and looked closely, there are two major players in the encryption software game talking in the discussion, HACKERALERT (Picocrypt) and samuel-lucas6 (Kryptor). So I went through the code of Picocrypt next, tbh, great ideology, simplest codebase and most noobs can actually make sense of what's there. Then I quickly notice something, the libraries imported in the code were from forks of the standard go libraries and one such fork of the official go crypto library was 7 commits ahead of, 113 commits behind of the official repo. This indicates that picocrypt is using code that is modified from the official library. There goes whatever faith I was starting to develop.
Moving on to kryptor, claims are being made that it is better than AGE but happens to be not so popular on github for some reason, if it's better than age, why are people not flocking to it. I stopped at this point. I am paranoid and I am stuck in this loop of misery knowing that, no tool out there has simplicity, code readability and reliability in one single repository that someone without a Phd and 48 hrs in a day can read. They claim to be modern but they are all the same as GPG, either they die out or they become too complex in attempts to support a wider audience.

Edit:- This is not a criticism of the tools, this is a criticism of the divide between software developers and end users and the trust between them. The tools are great and I am deeply grateful for having them. submitted by /u/shifter0909
[link] [comments]


http://dlvr.it/T1SxHQ