> It looks as though cryptkeeper makes assumptions about encfs' command-line interface that are no longer valid.<p>This looks like a developer mistaking a command line interface for an API.<p>Unless an (interactive) CL interface is explicitly marked as being an API, and documented in such a way, and regression tests exist to make sure the interface remains backwards-compatible - you should never program against it. Ask for a proper API to access.<p>(edit: formatting)
Ouch. For a long time this form of error was the #1 cause of system breakage in SunOS. Someone would go in and change an option or add a 'version' line that would print before the output, or re-order how you typed args, and <i>blam!</i> a bunch of bug reports would come flying in what some program was broken (sometimes commercial programs where now source was available) because they had system('foo bar bletch'); in them somewhere.<p>Very hard to test for as there weren't explicit dependencies and no amount of 'don't count on this output staying the same' warning messages helped.
The 'p' it sends is asked for by encfs when setting up a new encrypted folder (not when mounting an existing in encfs).<p>As the comment in the code says, it's for setting the pre-configured "Paranoia" mode (AES, PBKDF2, IV-chaining, etc) in encfs.<p>Bad that it's not checking any results whatsoever when sending stuff..<p>[1] <a href="https://linux.die.net/man/1/encfs" rel="nofollow">https://linux.die.net/man/1/encfs</a>
> But later, when I mounted it once again, cryptkeeper said the password is wrong (though, I 100% know, it's true!).<p>Is it a vulnerability if the product wasn't even working in the first place?
This issue highlights another common problem on FOSS:<p>If I create a small utility "just for fun" and someone includes it in a major distro and then nobody (including myself) touches it for 10 years, who is to blame if there are security (or any other) issues with the software?
The bug here is probably with encfs and most frontend tools to enc are doing exactly what cryptkeeper is doing.<p>For those who want alternative to cryptkeeper,there is SiriKali[1], next version will be released on Feb 1st and it will have support for OSX.<p><pre><code> execlp ("encfs", "encfs", "-S", crypt_dir, mount_dir, NULL);
</code></pre>
That line of code also has a bug as its wrong to pass NULL in C++ to a variadic function. IMHO,usage of NULL in C++ should be strongly discouraged in all cases.<p>[1] <a href="https://github.com/mhogomchungu/sirikali" rel="nofollow">https://github.com/mhogomchungu/sirikali</a>