PGP Encrypted disk bug

[Nikita]

A Nasty Security Bug that affect PGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt

scary thought. Just wanted to share.

[DaKahuna]

Interesting. I wonder if this works for whole disk encrypted with PGP 9?

I am currently investigating whole disk encryption products for my company and PGP is one of the contenders.

[WarHippy]

Re: PGP Encrypted disk bug

Maybe my latest experience with PGP will help. I purchased PGP Desktop Pro V9 with an Aladdin Etoken Pro. I wanted to encrypt my bootdisk, thinking that the rest of the system would be safe then. Maybe it would have. I configured the token with 128 bit encryption, even though it could be configured up to 256 bit. The PGP program allowed me to wholedisk encrypt my bootdisk with the token. That was the last time I was able to access that system. After a week of e-mails to their tech support, receiving more questions than answers about what I did, where the error was, my Moms favorite cereal(JK), etc., I searched all their install and help files, and noticed that in one of the answers to someone elses problem, the token has to be configured with the full AES256 or it won't unlock the disk. I e-mailed PGP and was told, "oh yeah, it won't work any other way" The bottom line is; the game "Pacman" checked each move for validity BEFORE the move was allowed. This security program didn't, and the tech support was unaware of this major flaw in the program too. I told the tech support to advise his boss about the problem, he sent me a URL to advise them about it. I don't think they wanted to hear about it. So, you decide. Personally, I'm not a programmer, and intuition is an adjective describing the adjustment to someone's lack of knowledge, ie. the user interface.
Just my humble opinion

[DaKahuna]

Re: PGP Encrypted disk bug

Maybe my latest experience with PGP will help. I.........
Just my humble opinion

Wow - that is very insightful. We have been using PGP since version 8.0 as best I can determine but primarily for the encyption of email. Moving forward to whole disk encryption, without tokens I might add, is a step I want to ease into instead of rush headlong.

Thanks again for sharing your expereince.

[TheCotMan]

Re: PGP Encrypted disk bug

Maybe my latest experience with PGP will help.

This is a good example of replying to an old thread (2 months old) with information that is on-topic, of direct use and is perfectly acceptable. :-)

Good call on deciding to post it, even though the thread is a bit old.

[WarHippy]

Re: PGP Encrypted disk bug

Thanks, but to be honest, I didn't see the date, I was here to find a solution to that problem, found some pretty good info, and noticed that someone might be able to benefit from an IMPARTIAL opinion about the program. I wish I had read my post BEFORE I bought their program. I could write a book about useless security programs. It's too bad I bought em all before I found out how useless they were. The conclusion I've reached about security is, if somebody wants access to your system, it doesn't matter at all what security you have in place, the deciding factor is the intruders knowledge of Assembly, and now I realize I should have kept up on it beyond 8 bit processors.....