Encfs didn't survive its security audit very well: https://defuse.ca/audits/encfs.htm (I don't know how much has it improved since then, though)