Cryptainer versus TrueCrypt

[n8chavez]

I know there is an older thread on this issue but it was too old and I was not able to reply to it.

Do most people still prefer TC as they did then. I ask because TC is great but the fact that it requires administrative privileges means that I cannot use it on a pyblic system with my flash drive. Does the same hold true for Cryptainer? Does their moble mode help with this issue?

[dantz]

I haven't used cryptainer in quite awhile, but according to their FAQ it sounds as though their mobile mode can't do what you want unless you pre-install a full version of Cryptainer on the host computer:

snipped from:
http://www.cypherix.co.uk/faqs/faqs_cryptainer.htm#admin

"Can Cryptainer Mobile be installed without administrator privileges?

Unfortunately this is not possible. Cryptainer runs as a process within the Windows framework. It needs be enabled as well be started up and shut down on request. It is necessarily constrained, by the overall Windows configuration, of the client machine.

Please note that while Cryptainer Mobile cannot be used without Administrative Privileges, The full version (Cryptainer) can be installed on any machine, with or without Admin privileges."

[Fano effect3]

{QUOTE->

Do most people still prefer TC <-QUOTE}

I prefer Truecrypt over Cryptainer, because I only use encryption tools that are open source, for obvious reasons.


Cypherix Software

503, Buildage House, 146 VS Marg, Mahim
Mumbai, Mah 400016 India

No thanks....
One of the reasons can be found here (http://www.mayin.org/ajayshah/MEDIA/1999/encryption.html) .

[n8chavez]

{QUOTE-> I haven't used cryptainer in quite awhile, but according to their FAQ it sounds as though their mobile mode can't do what you want unless you pre-install a full version of Cryptainer on the host computer: <-QUOTE}

I have a preinstalled version on my system. In fact, I just bought their PE version. What I'm talking about is similiar to TrueCrypt's 'traveler Mode'.

{QUOTE->
"Can Cryptainer Mobile be installed without administrator privileges?

Unfortunately this is not possible. Cryptainer runs as a process within the Windows framework. It needs be enabled as well be started up and shut down on request. It is necessarily constrained, by the overall Windows configuration, of the client machine.

Please note that while Cryptainer Mobile cannot be used without Administrative Privileges, The full version (Cryptainer) can be installed on any machine, with or without Admin privileges." <-QUOTE}

I'm having a little trouble understanding what you mean here; these seem to be contradictory statements to me.

[LockBox]

You need admin privileges for both.

The second part about "The full version (Cryptainer) can be installed on any machine, with or without Admin privileges" doesn't really make sense as you can configure the computer to not allow installations. The same would (obviously) apply to Truecrypt. If a PC is wide-open for anyone to install, you can install one or both.

I'd go with TC over Cryptainer.

[n8chavez]

That's a bummer. It look like I'll be ditching Cryptainer and be going back to Rohos Disk Encryption. It's a good thing there is a 30 day money back guarantee for Cryptainer.

[LockBox]

There are dangers with ROHOS and other software which basically decrypts to disk and then re-encrypts. You just as well use SecureZip, WinZip or something like that. It's all the same. The dangers with decrypting to disk is that you have to worry about Windows leaks and making sure the data on the disk is wiped after each and every use.

[n8chavez]

Rohos is similar to TruCrypt in that it encrpts on the fly by volume and not by individual files, like programs such as Blowfish Advanced CS and Axcrypt. Why then would there be a danger in using Rohos?

[dantz]

{QUOTE-> I'm having a little trouble understanding what you mean here; these seem to be contradictory statements to me. <-QUOTE}
Those weren't my words, I was just quoting from the Cryptainer FAQ that I posted the link to. But the gist of it is that if you don't have admin privileges on the host (i.e. the public) PC, you would have to install the full version of Cryptainer on that PC before you could use your Cryptainer Mobile encrypted flash drive with it.

I would expect all on-the-fly portable encryption programs to require adminstrative privileges, since non-admins can't install the necessary device drivers. I'm surprised to hear that Rohos might be able to do it. Guess I'll have to look into it.

All other decryption methods will probably require the intermediate step of first decrypting the files to disk and then reading them back into memory, which is a less secure method than reading the decrypted files directly into memory.

However, the danger mainly lies elsewhere and not so much in the encryption scheme. Once you decrypt and open a file then it becomes exposed to whatever software is running on the host PC (i.e. the public PC) and thus it can easily be captured without your knowledge. If the PC is untrusted then there is no way you can use it to safely access confidential data, and this would still be the case even if you had encrypted the flash drive using TrueCrypt or Cryptainer. The main purpose of encrypting a flash drive is to protect your data in the event that the flash drive is lost or stolen, but this in no way prevents your data from being surreptitiously copied by a third party once you provide the password and open the encrypted device or container on an untrusted computer.

[LockBox]

{QUOTE-> Rohos is similar to TruCrypt in that it encrpts on the fly by volume and not by individual files, like programs such as Blowfish Advanced CS and Axcrypt. Why then would there be a danger in using Rohos? <-QUOTE}

Sorry, I missed this question on Friday. Any OTFE product that can be opened without admin privileges must decrypt to disk. Meaning, it's not true on-the-fly encryption. It's basically a compressed file (volume) and decompresses the needed files by actually writing them to your disk. If you use a USB flash drive, the files will decrypt to the flash drive. You then have a scenario where your files are in the clear - on the drive. The temporary files created must be wiped at the conclusion of each session without admin privileges. This is tricky with flash drives due to wear-leveling mechanisms. True OTFE that decrypts with admin privileges decrypts to memory. There's a big difference.

By the way, I confirmed what they do by reading this page:
http://rohos.com/desktop-security/rohos_disk_browser.htm

[chosenone]

Check this out
BestCrypt Traveller software
from jetico

[dantz]

{QUOTE-> Check this out
BestCrypt Traveller software
from jetico <-QUOTE}
snipped from http://www.jetico.com/bctraveller.htm:

"Please note that the user should have administrating privileges to run BestCrypt Traveller software."