I have been in extensive contact with Taylor regarding his security audit which was not correct on some parts in my opinion. The result was that Taylor agreed to edit his audit report and also the conclusion.
The updated version is here:
The original version is here:
Based on Taylor's will to update the report, I did not feel the need to publicly respond to his report in our blog anymore. This thread here must have slipped through my fingers.
Should we be worried? No, not at all. Regardless of the quality of a 10-hour security audit - which is better then nothing, but not enough to fully understand the inners of EncFS or any other encryption software - 5 out of 7 issues identified are related to the authenticity features in EncFS which Boxcryptor Classic does not have. Boxcryptor Classic guarantees confidentiality but it makes not assumptions about the authenticity of the encrypted data. (An attacker could modify your encrypted data without you noticing it - but he would still not be able to decrypt it.)
So only 2 out of 7 issues (2.2 and 2.3) could actually be applied to Boxcryptor Classic. I agree that these are valid issues but no real attack vector has been found and their real-world impact is not clear, e.g. "EncFS's stream encryption is unorthodox [..] This should be removed and replaced with something more standard.".