Due to the fact that TrueCrypt is "not secure" I've been looking for some other way to encrypt the data.

WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues You should download TrueCrypt only if you are migrating data encrypted by TrueCrypt.

Could you provide some information about pros & cons connected with hardware-based encryption? What if the firmware is controlled by a third-party malicious? I'll be glad if could recommend some SSD which cover the following points:

  1. There is no problem with BIOS compatibility.
  2. The quality of the encryption is similar to the TrueCrypt.
  3. Firmware of the drive haven't been compromised.

By the way... Have you heard about TOMB?

  • This site was created for questions seeking specific hardware recommendations given a set of definitive requirements. General computing hardware issues are on topic at Super User. Commented Sep 16, 2015 at 13:52
  • Their support from the software side is currently lacking. If you do not want to be tied to Windows only, your best bet is probably software full disk encryption + regular SSD. Commented Oct 25, 2015 at 16:29
  • I definitely recommend this, the performance is much better than with software encryption. BIOS compatibility: most support it, but some hash passwords differently, so you may not be able to use the encrypted HD on a different computer. Quality of encryption/firmware: I'm afraid you just have to take this on trust, there's nothing that an end user can do to validate this.
    – paj28
    Commented Dec 15, 2015 at 14:58

1 Answer 1


Whether the firmware has been compromised is a valid concern — it happens (it's been done for show, and it's rather rare but it has been found in the wild).

But a bigger concern is whether the firmware has been programmed correctly. Many SSD firmwares don't implement secure erase properly. Should you trust them to implement crypto properly? I haven't seen a reliable study on the topic, but I've heard (private rumors in some security communities) that some “self-encrypting drives” are actually mere password-protected drives, with no encryption if you just bypass the controller. As a consumer, there's absolutely no way to know whether a particular device does it right¹.

The upshot is that I wouldn't rely on the encryption capabilities of a storage device.

There's not much point in doing encryption on the drive itself rather than in the CPU anyway. This isn't the 1990s, most CPUs have plenty of spare cycles, of which encryption will only cost a little. Major operating systems come with native encryption: Bitlocker under Windows, dm-crypt under Linux, etc. If you have one of the cheaper editions of Windows that don't have full-disk encryption, or if you need an encrypted removable drive that's portable between operating systems, use VeraCrypt, the successor of TrueCrypt (which was discontinued because the maintainers didn't want to maintain it anymore, not because it was fundamentally flawed).

¹ Finding a way to attack a particular model can have a cost in the $10k–100k range, so it's not something you can do casually — but once the attack is found, carrying it out on a particular drive has an incremental cost that can be in the $10–100 range, or <$1 if it's a pure software attack on a buggy firmware.

  • Bitlocker isn't a very good choice. Thank you for pointing out the successors of the TrueCrypt. Commented Sep 11, 2015 at 10:01
  • 1
    But if you 'really' want to use BitLocker there is also the possibility of installing a Trusted Platform Module (TPM). [quietpc.com/gc-tpm]: "Easy to install on TPM-ready motherboards from Gigabyte and ASUS" "Allows Microsoft BitLocker drive encryption to fully operate" "Because the TPM uses its own internal firmware and logic circuits for processing instructions, it does not rely upon the operating system and is not exposed to external software vulnerabilities."
    – minidec
    Commented Sep 13, 2015 at 8:12
  • 1
    Great answer. In general, I would trust a solution that you can control over something that is virtually inaccessible by you as a customer (i.e. software vs manufacturer firmware). As always, I'd recommend that you actually run tests that closely simulate your actual usage conditions. That way, you can make sure that, for your use case, the solution works. Commented Sep 14, 2015 at 18:57
  • use one of the TrueCrypt successors this link is non-existent and as of 2022 TrueCrypt has no viable alternatives (is VeraCrypt it?), so the problem of encrypting the drive in a cross-platform environment has no working solution.
    – Suncatcher
    Commented Jul 9, 2022 at 19:01
  • @Suncatcher Why do you think VeraCrypt isn't viable? Commented Jul 10, 2022 at 8:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.