The Sudden Policy Change In Truecrypt Explained 475
X10 (186866) writes "I use Truecrypt, but recently someone pointed me to the SourceForge page of Truecrypt that says it's out of business. I found the message weird, but now there's an explanation: Truecrypt has received a letter from the NSA."
Anyone with a firmer source (or who can debunk the claim), please chime in below; considering the fate of LavaBit, it sure sounds plausible. PCWorld lists some alternative software, for Windows users in particular, but do you believe that Microsoft's BitLocker is more secure?
That's not proof! (Score:5, Insightful)
You're taking twitter posts too seriously. That's just speculation based on what appeared on their site the other day, followed by:
"Alyssa Rowan @AlyssaRowan
@munin @0xabad1dea @puellavulnerata I can confirm presence of TrueCrypt duress canary as per 2004 conversation"
Sorry, who the fuck are you?
Re: (Score:2, Interesting)
I am however very sorry to hear that TrueCrypt may be going away. I personally use LUKS (being a Linux user), but this is still bad news for end users in the computing community.
Re:That's not proof! (Score:4, Informative)
Ya think? Really? You are hereby awarded the prize for most spectacular understatement of the obvious. Sorry, I do not intend to be mean; it just hit my funny bone; peace, man. It's somewhat akin to stating that the US "may be entering a period of decline" or saying in 2004 the space shuttle program "may be winding down".
OTOH, seriously, the project may have gone deader than a doornail overnight, but use of 7.1a is still just as viable as it was before the stunning suicide note. It has passed the independent stage 1 security audit with thumbs up, and if you don't already have a copy it's not hard to find out there. Pretty sure in the long run somebody will pick up the pieces and carry on. The HQ for the next project will clearly have to be located some place other than the inheritor of the Nazi Germany/Soviet Russia mantle of most despicable police state.
LUKS is very good, but until someone works out a way to do hidden containers, it's not even close to a replacement for the most critical feature of TrueCrypt.
Re:That's not proof! (Score:4, Informative)
Already there, dude.
http://truecrypt.ch/ [truecrypt.ch]
Switzerland!
Re:That's not proof! (Score:4, Insightful)
It's a good step, no doubt about it, although given recent caving [rt.com] of Swiss entities to US bullying I do not feel as ebullient as I want to.
Re:That's not proof! (Score:4, Informative)
LUKS is very good, but until someone works out a way to do hidden containers, it's not even close to a replacement for the most critical feature of TrueCrypt.
Hidden containers are less useful than you might imagine in practice for a variety of reasons. Some of these points are relevant [google.com]. I don't have any use for hidden containers, although I do use LUKS on a large number of systems.
Re: (Score:2)
"Alyssa Rowan @AlyssaRowan @munin @0xabad1dea @puellavulnerata I can confirm presence of TrueCrypt duress canary as per 2004 conversation"
Sorry, who the fuck are you?
If it's the real Alyssa Rowan tweeting that then it's a pretty reliable source.
Re: (Score:2)
Re:That's not proof! (Score:5, Interesting)
Could you clarify? Who is Alyssa Rowan to TrueCrypt? Sorry for my ignorance, I tried Googling a bit and just got links to this article.
It's someone who has been active in the crypto/security community for awhile now. Personal details are pretty scarce (i.e. it could be a front for the NSA for all anyone knows), but the persona has been active in crypto. If you want something to Google on try "alyssa rowan cryptography".
Re: (Score:3)
Or we could just, like, not bother.
Re: (Score:2)
clearly the name is an anagram that you aren't Robert Langdon enough to suss out.
TC developer used hidden message!!! (Score:4, Interesting)
"WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues"
Re: (Score:3)
Yes, it seems pretty clear to me that this is a warrant canary.
It may still be that they triggered it (or let it self-trigger via inaction) out of lack of desire to continue the project.
In any case, the presumed goal of the canary - making sure that no one trusts any future TrueCrypt version released via the normal channel - has certainly been successful.
TC developer used hidden message!!! (Score:5, Funny)
Haha. Frankly, usable crypto kits need security audits.
Re:TC developer used hidden message!!! (Score:4, Insightful)
Frankly, useless crypto kits backdoored entire time are.
FTFY
Re:TC developer used hidden message!!! (Score:5, Insightful)
WARNING: Using TrueCrypt is notsecure as it may contain unfixed security issues
But this raises many questions.
(1) If Truecrypt were secure in the first place, a National Security Letter would have been of no use: the developers would be no more help de-crypting something than anyone else. So in the usual context, a NSL has no point whatever.
(2) A demand for other records, say about the developers, would also not invalidate the CODE of Truecrypt in any way.
So that only leaves a couple of possibilities as legitimate reason for a canary: (3) Possible coercion by the government to somehow weaken their crypto.
(4) Discovery of some prior "backdoor" that had somehow been inserted in the past.
(5) Maybe some of the developers wanted to remain strictly anonymous and so any overtures made by the government at all created panic.
Since the people doing the security audit have announced that it will continue, if it turned out to be (4) it will be discovered soon. Which it seems to me leaves only (3) and (5) as any kind of government "threats" that make any sense.
Any other ideas?
Re:TC developer used hidden message!!! (Score:5, Insightful)
I would guess that they were NSL'd for their signing keys; that would make it less secure in the future so the correct option is to burn the brand now. Reports said that both signing keys signed the new (crippled/canaried) executable, and that the keys had been re-uploaded with the same content on sourceforge. Their legit URL points to their sourceforge site. Instances of "U.S." in their source code were replaced with "United States".
It looks to me like they went through a lot of trouble to burn the brand down before any damage could be done with the NSA's new-found signing keys. It's a very, very bad sign that this happened to TrueCrypt. Good on them for being brave enough to inform us, despite the real risks they faced in doing so. If this project is forked, we can only hope the new maintainers are brave enough to do the same when the NSA goes after them. It also raises the question: how much other infrastructure has been compromised while the maintainers have stood silently by?
Re: (Score:3)
I would guess that they were NSL'd for their signing keys; that would make it less secure in the future so the correct option is to burn the brand now.
I know that it sometimes doesn't mean much given today's Federal government, but an NSL would not cover this eventuality. A NSL only gives the government authority to grab information without a warrant that would otherwise be grabbable with a warrant.
Their signing keys do not qualify. There is no law in this country authorizing the seizure of this kind of information. It is a "trade secret", nothing else. The ONLY thing the government could want signing keys for is nefarious purposes.
Re:TC developer used hidden message!!! (Score:5, Interesting)
Let's assume that the government would be breaking the law by NSLing the signing keys. (As opposed to the law being so mucked up that such an action is entirely legal.)
1) What lawyer is going to be able to fight this battle against the US Government and win? Let me narrow that list down a bit. What lawyer that the TrueCrypt developers would hire would be able to fight this battle against the US Government and win?
2) Would the TrueCrypt developers even be allowed to see a trial or would they be arrested on "unrelated" charges and sent to prison? Or worse. (There is plenty that a power hungry governmental agency can do to someone that says "no" to them that makes "being arrested on unrelated charges" preferable.)
Re: (Score:3)
Mod up. This is exactly the explanation. There can be no doubt whatsoever. No proof, but no doubt. You can interpret the whole message of the suicide note to be the following, in the form of a veiled suggestion of course:
"We were NSL'ed and would face the vengeance of the grandaddy of all police states if we said that here, or if we told you in plain language to just keep using 7.1a as acquired cleanly before this thuggery, or henceforward compiled from source which you can convince yourself is a clean copy
Re: (Score:3)
At first you just get the build ability. Then a safe, expected build with the surrounding jargon and skill set is tried.
If the community did not notice the change to the staff or build or site then a project can be turned.
The new tame staff are slowly rolled out to the wider community with a full 'crypto' history on the web to be found.
If the community did not notice then a project can be altered to ensur
Re: (Score:3)
The most interesting thing is that there are 2073 line additions and 10163 line deletions
7.2. is a one-way - decryption only - file recovery tool.
Speculation (Score:5, Insightful)
There is no concrete information that the NSA or a national security letter was involved. When did we start linking to random blogs for speculation presented as fact? May as well just posted a link to reddit thread about this.
Re: Speculation (Score:2)
That's probably where they got this anyway.
Re: (Score:2, Insightful)
Ever since actual news stopped mattering and what everyone cares about is clicks (read as money).
Re:Speculation (Score:5, Insightful)
We do not need concrete information.
When a major encryption project like this closes shop, without any explanation, duress should be assumed.
The current climate requires it.
Re:Speculation (Score:5, Funny)
That's exactly what I thought first. But then it came to my mind that Bitlocker is much more secure than Truecrypt, because it has been developed and carefully audited by a corporation with a proven track record in cyber security. That fact makes it practically 100% certain that the developers of Truecrypt just thought "nah, fuck it, we now have Bitlocker, which uses military-grade encryption against all kinds of criminals and cyber-threads, and there are minor to medium potential problems with our code, so we just throw the towel and give up all the work on Truecrypt."
That's obvious, right?
Re:Speculation (Score:5, Funny)
Speculation (Score:3, Insightful)
This is Slashdot. No one cares whether something is true or not as long as it is negative towards the government. Sad really, since it diminishes any sort of real discussion about actual concerns about the government rather than made up fantasy.
Re: (Score:3, Insightful)
It's not necessarily the NSA you always want to protect things from. What if your laptop gets stolen, would you want the thieves to be able to look through the contents?
Re: (Score:3, Insightful)
Secret plans? About what? If you have secret plans that the government should be interested in, then I want them to find out about it - because unless you are planning terrorist activity, there is no reason to fear so much.
Wow. Did you seriously just use "Nothing to hide, nothing to fear"... seriously? Are you retarded, or do I have to point out that hundreds of millions of people were abused and/or murdered by governments--including the US government--throughout history? If you knew, then why do you seem so confident that people who wants to keep their plans secret must be doing something immoral? History just isn't on your side, fool.
Re: Speculation (Score:5, Insightful)
Ah, yes... "If you aren't doing anything wrong, then what do you have to worry about"
Except there are plenty of cases of persecution if you happen to be:
- Gay,
- A former member of the communist party,
- Union organizer,
- Whistle blower,
- Protester, objector, not in line with corporate America,
- Catholic, Jewish, Japanese, or anything else not favorable at the time...
None of these people are terrorists, but clearly lost their liberties, reputation, or assets when they were "outed"
Re: (Score:2, Insightful)
There is no concrete information that the NSA or a national security letter was involved.
Before Snowden we used to say the same thing about NSA messing with encryption standard bodies, or NSA conductive widespread warrant-less surveillance of everybody.
We used to think people wasn't subjected to secret trails in the US. That's no longer the case, we now know by fact that the US doesn't honor basic human rights, not for it's citizens or anybody else.
Do we really need more proof. This isn't the worst thing the NSA have attempted yet.
Re:Speculation (Score:5, Insightful)
It must be sad living in a world of such heightened paranoia.
...sez the AC.
Re:Speculation (Score:5, Interesting)
Not really, when the project used an incompatible license all along and while marginally "open source," they were clearly taking a hostile stance towards other FLOSS projects, as nobody could integrate their work with anything else.
In that context their explanation makes perfect sense; they didn't do it for love of FLOSS, they did it because there was no other portable options that included support for all windows versions. Without XP, that ceases being true.
As a supporter of Free Software that reasoning might sound lame to me, but it is very consistent. And if their whole point was to provide an option for windows users, then recommending bitlocker is actually consistent. Having different values doesn't imply he's lying about his.
As far as canaries go, you have to have the live bird before going into the mine, and then have the dead bird. In this case there was no live bird in advance, and there is dead bird afterwards. Not only have we not been warned by a canary, nobody actually even claims to have seen one, dead or alive.
The name of the person who registered a non-profit and for-profit for TrueCrypt in the US was David Morgan. That person has already verified the posted information from an email address @truecrypt, so this other person not known to be associated with TrueCrypt should be ignored.
Re:Speculation (Score:5, Insightful)
What are you doing with your computer that BitLocker doesn't count as safe?
That's none of your concern. That being said, you're kinda missing the point of privacy. The use of encryption in no way implies that you are doing anything wrong. Just the opposite - you've taken steps to insure your data is not accessed by an unauthorized person. So in fact, you're doing something right.
tc-play is a reimplementation of Truecrypt (Score:5, Informative)
Fyi Truecrypt, with its dubious code provenance, has been suspect for a long time anyway, regardless of these developments. S there already is a re-implementation of Truecrypt from the ground up for Linux and BSD by non-anonymous(?) developers: https://github.com/bwalex/tc-play
Also, cryptsetup-LUKS (recent versions only) can mount truecrypt containers under Linux.
Re:tc-play is a reimplementation of Truecrypt (Score:5, Informative)
You are behind the times.
The binary build was duplicated from the source.
The source has been audited.
Re:tc-play is a reimplementation of Truecrypt (Score:4, Informative)
The audit of the source is complete. The next phase of the audit is cryptanalysis.
Re:tc-play is a reimplementation of Truecrypt (Score:5, Insightful)
There is actually a code audit underway, and so far they've found nothing.
the concept of anonymitty means nothing, because we live in an age where reputation can be bought.
all that matters is if the source code can be inspected, and if the source code matches the binaries.
who actually makes it does not matter as long as its audited properly.
stop with the FUD.
What else? (Score:2)
It has to be an NSL. What should be the other explanation? The truecrypt accounts hacked? I don't think so.
However, it is too early for a story "The Sudden Policy Change In Truecrypt Explained". There is no proof of this speculation yet.
Re:What else? (Score:5, Informative)
The simplest explanation is that the developers simply got tired of the project and decided to abandon it. It's been years since any update and it's certainly plausible that those developers remaining simply decided it wasn't worth it to keep the project alive when no one was maintaining it. .
Re:What else? (Score:4, Insightful)
The simplest explanation is that the developers simply got tired of the project and decided to abandon it. It's been years since any update and it's certainly plausible that those developers remaining simply decided it wasn't worth it to keep the project alive when no one was maintaining it.
Fine. The simplest way to do that is to put a clear and unambiguous message on their webpage staing that development is frozen at version 7.1a, and the project will no longer be maintained. Instead they gave no explanations, but very bizzare set of statements that raise more questions than they answer.
This has the flavor of a practical joke or an unstable mind. Certainly not someone you would trust to protect your data.
It's a shame. I really liked the application.
It is all pretty obvious (Score:3, Interesting)
The message is clear what happened.
Google's cache (Score:2)
http://webcache.googleusercont... [googleusercontent.com]
still speculation (Score:5, Informative)
According to this page - someone e-mailed a dev contact and claims they called it quits due to lack of interest
https://www.grc.com/misc/truec... [grc.com]
(Scroll to the bottom, the green box).
The only real "confirmation" we have is the info on the TrueCrypt page. It's over (no matter what the reason is), best to move on.
Re: (Score:3, Funny)
Rightr because everything that Steve Gibson does is completely accurate. Right?
Re: (Score:2)
It's just his page, read the actual quote I referenced, it's nothing to do with Steve Gibson - he is just quoting two people on twitter.
Bottom line - we have no evidence of warrant canary or "dev rage quit".
Also: https://twitter.com/0xabad1dea... [twitter.com]
Personally I'm more inclined to believe the devs calling it than any NSA scheme, but again.
No. Evidence.
Re:still speculation (Score:5, Interesting)
Two guys - working working over a decade without funding etc.
Ennead was 29 in 2005 (http://www.wolfmanzbytes.com/windows/70-truecrypt-encryption.html) and they obviously developed it on their freetime.
Fast forward from that to today and you got couple of middle-aged devs, probably with more demading careers and perhaps even families and maybe with young kids.
They started it as a Windows project, when Windows was...a completely different beast than it is today.
It's no wonder TrueCrypt didn't get very many (any?) releases in the past couple of years.
It's certainly a very interesting way to exit stage.
Re: (Score:2)
I tend to agree, we will never really know why . Even if someone comes up and clearly says 'hey i was with the team and we did it due to xyz', since the team was anonymous how can you be sure hes with the team, and even he was, if hes telling the truth?
No matter what the reason, or even if there is a legit reason the game is over and it really doesn't matter why, other than curiosity. The code ( or group ) can no longer be trusted, and who knows how far back this breach goes.
Time to move on to something els
Re: (Score:3, Interesting)
Reality check: TrueCrypt for Windows could never be trusted, even if you aren't knowledgeable enough to understand that.
TrueCrypt was a nothing more than a block device driver for Windows, it was a kernel module. Any other kernel module or the kernel itself could hook into the chain between TrueCrypt and the rest of the system and read the clear text data.
Because of the reality of working with Windows, TrueCrypt is no more trustworthy than BitLocker on Windows. They don't need to back door the BitLocker s
Re:still speculation (Score:5, Insightful)
TrueCrypt never claimed to protect you from a compromised system. The point of it was offline security. Once unmounted the contents of an encrypted container are inaccessible to anyone without the key.
Once you understand what TrueCrypt is for you can see why it is so valuable.
The project needs to be given away... (Score:2)
Literally give the source code and rights to continue development to anyone and everyone.
A new project will pick it up and continue development without breaking the law. And at that point its unlikely the NSA will be able to do anything to it.
Re: (Score:2)
I don't see how it could... and even if it did... just leak it.
I Voted This Submission Down (Score:5, Interesting)
No evidence is presented. The reference to a "canary" is suspect, as it isn't discussed what that canary was.
Some semi-random tweeter is reposted on some random blog? I don't think so.
It's possible that this is accurate, but without evidence, why bother? As I asked in the original discussion about the shuttering of TrueCrypt, who stands to benefit?
Re: (Score:3)
In fact, Alyssa Rowan (quoted in TFA and a known persona in the crypto community) detailed the canary in the previous ./ article, posting as an AC: http://it.slashdot.org/comment... [slashdot.org]
Re: (Score:3)
In fact, Alyssa Rowan (quoted in TFA and a known persona in the crypto community) detailed the canary in the previous ./ article, posting as an AC: http://it.slashdot.org/comment... [slashdot.org]
Mayhap it is, and mayhap it isn't. Either way, TrueCrypt is dead. Anything else, without documentary evidence (and that means independently verifiable evidence, not mysterious tweets and AC posts) is just speculation, IMHO. Feel free to disagree with me, I don't mind.
Re:I Voted This Submission Down (Score:4, Insightful)
The canary is the fact that the "explanation" of the EOL of XP is inconsistent with the stated goals and roadmap for the product as of recently.
If they'd wanted people to believe they'd gotten tired of the product, they'd have said "We're tired of working on this, we've changed our licensing terms, and releasing the code to everyone for future development."
If you can't say why you're taking the product down, you have two alternatives: either say nothing, fueling suspicion, or lie so poorly that everyone's suspicions are raised even higher.
The government can compel you to neither confirm nor deny any secret orders from any secret courts. (This also ought to be intolerable in a free society, but we're well past that tipping point.) What it cannot do is require that you be a sufficiently good liar that anyone believes your explanation. They can't charge you for not mentioning the secret court's secret letter because to do so would expose said letter's existence, which is precisely what the government wants hidden in the first place. Warrant canaries are a legal catch-22 of the government's own making.
Yes, it's suspicious. Yes, the suggestions make little or no sense to anyone with technical knowledge.
As I said, the report might be accurate.
However, extraordinary claims require extraordinary evidence. I see no evidence. At all. It's all supposition and guesswork. Present me with actual evidence, and I can be convinced. Until then, it's all noise and hand waving, IMHO.
Re: (Score:3)
Don't worry man, you obviously don't need secure volume protection from anyone more hostile than the guy next door.
This is not an extraordinary claim. It is the most plausible explanation. This is simply someone posting their observation to bring a little light to people with their heads too buried in the sand to realize.
For the rest of us, an NSL was pretty obvious from the start. And a good reason to toss the last version and move on to something else.
My requirements are irrelevant. And, as I've said twice now (I guess reading comprehension isn't required for ACs?), the claim about an NSL or some other sort of government involvement is certainly possible. However, I'm not going to go off half-cocked without actual, verifiable information.
You'll note that I most certainly did not say "Oh, everything is perfectly fine. Nothing to see here. Go on about your business, citizen.
Given the product involved and the current environment, some paranoia is certai
AC in last thread mentioned a warranty canary (Score:5, Informative)
An anonymous coward in the last thread said that a known warrant canary was seen:
http://it.slashdot.org/comments.pl?sid=5212985&cid=47117051
Please upmod parent. (Score:3)
-metric
It has to be true! (Score:2)
Not only is this mercurial and virtually unknown Alyssa Rowan spotted a canaryu, but so has PeeWee Herman! He just tweeted.
If It Is Private, Keep It Private (Score:3, Insightful)
I never use cloud resources. Too many users have been severely inconvenienced if not outright burned by cloud services that have been hacked, suppressed by some government, gone out of business, or gone down for several hours. I keep all my data where I can access it, either on my PC or on a removable hard drive that I store remotely from my PC but easily reached.
I encrypt my most sensitive data. No, I do not rely on some corporation's declaration: "Trust us. We are good. We will protect you." Instead, I use an OpenPGP application that has been reviewed by outside experts and that I have installed on my PC. The data on my removable hard drive are encrypted. Some of my PC files are also encrypted. My pass-phrase, without which my private key is useless for decryption, exists only in my head and in an envelope in my safe deposit box at a bank. My private key is on my PC in a non-standard location. If somehow someone else were to access my private key, I have a much greater problem than the compromise of my sensitive data.
See my http://www.rossde.com/PGP [rossde.com]
Re: (Score:3)
envelope in my safe deposit box at a bank
That the government can legally get a search warrant for.
However the one your head it's protected by the 5th amendment.
Think about it.
Ars Scholae Palatinae (Score:5, Informative)
I can't comprehend the conspiracy theories flying around about this.
[TrueCyrpt] is a barely-maintained Open Source project (no updates in the past two years), with an outdated, messy code-base, serious build dependency problems, and lacking in full support for the newest Windows release. It likely only has a small development team - perhaps only one or two people.
The developers are absurdly secretive, and when they do come out of hiding to make a statement, they are confrontational (take, for example, their response to Fedora's queries over the clause in their license that reserves the right to sue for copyright infringement).
If this was any other project, we'd all just assume the developers had decided to call it a day. However, because of the nature of the software, everyone assumes security agencies or reptilians are involved.
Maybe the developer was a security researcher who has decided to retire to a tropical island. Or maybe there were two developers, and they have had a dispute. Maybe the primary developer took a job offer at a security firm, with a clause prohibiting him from working on external projects. There are an almost infinite range of possibilities... assuming that the cause was the devious acts of state-sponsored actors is leaping to a pretty big conclusion.
If I developed a piece of security software, and wanted to cease development, I'd make a similar statement.
"Don't use this anymore. It's not maintained, and should therefore be considered insecure".
Otherwise, if a vulnerability is discovered, everyone will scream: "Fix it now! Nobody told us to stop using it!"
''TrueCrypt is not secure,'' official SourceForge page abruptly warns [arstechnica.com]
[Ars stats for Marlor: 1279 posts > registered Oct 3, 2003 > 0.01% of all posts > 0.33 posts per day]
Re: (Score:3)
This all makes sense to me, until you add in a few strange parts:
1) Why did they nuke all previous versions of the software? The disclaimer is there. There's was no need to nuke the old versions.
2) Why neuter v7.2 so it can't encrypt? Heck, why even release a neutered version? The disclaimer is there. If I was ending my work on a project, I wouldn't end it on 'here's a broken version, and I erased all the good versions.'
2) Why the unprofessional webpage, with screen shots? Screen shots take time to ge
More speculation (Score:4, Interesting)
There's nothing in TFA that hasn't been speculated in great detail already.
No explanation totally makes sense. Here's my working model of what happened (all speculation of course):
The project has been gradually disintegrating over the last few years -- developers leaving and not being replaced, remaining developers having less time to spend on the project for whatever reason, and the perceived reward for fixing increasingly difficult bugs is not enough to keep people interested. It's just not fun any more.
The to-do list has some really nasty bugs that are difficult to fix and could potentially compromise all TC containers. The remaining developers in the project have been grinding away at these bugs, but haven't made much progress for reasons outlined above. They realized that the project was going to fizzle out before they got anything fixed. A cursory look at the 7.2 code suggests that they had committed to some major rewriting of the code, and bit off more than they could chew.
At this point, what can they do? Reporting the vulnerabilities would be irresponsible since no fixes are forthcoming. Lives depend on some of the secrets their software keeps. Best to push people gently away from TC until the problems can be fixed, if ever, while keeping the details of the vulnerabilities as secret as possible, and giving people realistic expectations about the future of TC development (i.e. none).
They probably had a plan for creating a migration plan that actually made sense, but ran out of resources before finishing, and decided to go with what they had on hand. At this point they were probably down to one very part-time developer and maybe a few unreliable volunteers. ("Hey Jim, where's that page you were writing about Linux FDE? Jim? Hello? Anybody there?")
There was really no good way forward with the resources remaining, so they did the best they could.
Why didn't they find someone else to take over the project? I guess they tried, but couldn't find anyone in their immediate circle of trust who was willing and able. Perhaps they felt that expanding their circle of trust would jeopardize their anonymity.
On the other hand....
"WARNING: Using TrueCrypt is *not *secure *as ..."
Where is the Kickstarter to re-implement it? (Score:4, Interesting)
I'm surprised there hasn't been a Kickstarter setup to re-implement TrueCrypt from the ground up.
What would be the dollar cost to hire a team of developers to do it?
Re: (Score:3)
I'm surprised there hasn't been a Kickstarter setup to re-implement TrueCrypt from the ground up. What would be the dollar cost to hire a team of developers to do it?
We know the cost of the audit:
Since September 2013, a handful of cryptographers have been discussing new problems and alternatives to the popular security application. By February 2014, the Open Crypto Audit Project---a new organization based in North Carolina that seeks formal 501(c)3 non-profit status---raised around $80,000 toward this goal on various online fundraising sites.
TrueCrypt audit finds ''no evidence of backdoorsâ or malicious code.'' [arstechnica.com]
It's reasonable to assume that any attempt to resurrect TrueCrypt would fail without an independent audit on the same scale.
We don't know the size of the TrueCrypt team or the man-hours invested in its development, but we do know it took ten calendar years to take TrueCrypt to version 7.1,
Re:Where is the Kickstarter to re-implement it? (Score:5, Interesting)
I think it would be great for the EFF and the ACLU to sponsor it. It would immediately cause problems for someone to get ham-handed about it.
Old code still available (Score:5, Informative)
It appears grc [grc.com] has created page where the last final version of TrueCrypt and all source code could be downloaded.
My hope would be that someone will fork the project and continue development for Linux, and Windows XP/2003, at least, AND preferably work on new Version of Windows.
Bitlocker is REALLY not good enough, for most users won't have access to it -- since it is only in the ENTERPRISE version of Windows 7; in particular... Windows 7 Standard and Professional do not have the feature.
Re: (Score:3)
I don't understand the confidence in bitlocker. If you assume TC got NSL'd, how would MS react in the same situation? Do you honestly believe that MS hasn't already been handed several NSL's over the years? And it's not open source, anything could be in there, including a back door. If you're paranoid about security, a closed-source product run by a big company based in the USA is the last place you'd be looking for a security product.
I don't think an NSL can (legally) require you to actively DO anythin
Re: (Score:3)
Interesting... (Score:4, Insightful)
Truecrypt - Based in the US? (Score:4, Interesting)
Is there any proof that the contributors are even in the US and thus subject to a NSL? At least one of them seems to be from the Czech Republic (David Tesaík).
Is the truth even possible? (Score:4, Interesting)
Given the anonymous nature of the TrueCrypt developers, would we even believe someone who claimed to be a dev and gave us an explanation?
Not sure I would. I've read a lot of different articles and comments about this ordeal and I'm frankly not sure what to believe. I'm not sure if I'd believe someone if they said they were a dev.
I know we'd all laugh if the NSA came out publicly and said "we had nothing to do with it."
No master key (Score:3)
Unlike with Lavabit, there's no single master key for TrueCrypt that can be gotten from the developers that'll decrypt any TC partition. The best the NSA could get is the ability to create their own signed binary package with their own modifications and have it appear as the official package on TC's site. The problem with that is that the TC code's open so anybody can build from source and compare with the official build and see that they aren't the same. And any compromise of the source (eg. weakening the cryptography) would be instantly revealed in the diffs. The whole NSL thing sounds dodgy, and doesn't quite fit. It seems more likely that, with Win7 and later moving to supporting only GPT disks, the TC developers found they can't add that support and decided to throw in the towel.
In any case, the version of TC from before this change is still available and as far as anyone can tell is still secure. I'd be leery of switching to other encryption software that's known to be less secure until someone comes up with a definitive vulnerability in 0.71.
Re: people ruin everything (Score:2, Informative)
https://t.co/x1H2T6UtEv
Re: people ruin everything (Score:5, Interesting)
still doesn't answer the question on if it's like lava bit. true crypt may be just as secure as it was last week, but maybe it's also been owned by NSA from day one.
Re: (Score:3)
As well as food, and ammunition
If you have ammunition, you can get food.
Re: (Score:3, Insightful)
It's 2014, not 1914.
If you want to fight your government - the government that spends more money on the military then everyone else in the top 5 military spending countries combined, you don't need guns. You need stealth fighters, tanks and ICBMs.
Good luck with your "honest people defending the country against the government" fantasy.
Re: people ruin everything (Score:4, Insightful)
Re: (Score:3)
That was a foreign power attacking people at home.
This would be the people rising up against their government.
Two different scenarios. The US government doesn't have to eradicate americans to win, it just needs to stay put exactly where it is.
Re: people ruin everything (Score:5, Informative)
Link [grc.com] because why in the world do people use URL shorteners?
Steve Gibson (Score:4, Insightful)
Because nobody on Slashdot would intentionally visit a link to grc.com. If you want us to visit the land of raw sockets and falling skies, you're going to have to mask the destination.
Re: Steve Gibson (Score:5, Funny)
If you ever tried listening to one of his podcasts you could make some informed comments. I dare you to go listen to the two recent ones on certificate revocation protocols and not come away better informed. But an informed commenter on Slashdot? My goodness that would be like the bad old days.
Re: Steve Gibson (Score:4, Funny)
Yep. THey are right up thjere with Lucy's podcasts on how to kick a football.
Re:Steve Gibson (Score:5, Interesting)
Steve has made some mistakes in the past and over-hyped some things, but all in the all, the man means well and is genuinely interested in the welfare of computer users. If you write him off just because he's made a few poor judgments in the past, well, that's your loss. He does have generally useful information and it's presented in a non-nerdy fashion so any bonehead can make sense of it. Usually.
Re: (Score:3)
You are so gonna get Dementia [slashdot.org]
Re: (Score:3)
I would rather get dementia than tell lies and live like it is OK with whats going on in this country.
If 'dementia' means what I think it means, you can actually do both.
Re: people ruin everything (Score:5, Insightful)
Your arrogance is your assumption that you have anything to say worth recording, let alone even listening to you. What makes your personal life so relevant?
So because my private life is utterly uninteresting, you suggest that I shouldn't care about giving up my human rights?
The right to privacy is a human right...
One might as well ask, why you should care about fair trails or torture, if you're not a criminal then why should you care? After all why should anybody want to torture a confession out of you?
This is not about being personally targeted or affected, it's about basic human rights.
Re: people ruin everything (Score:5, Informative)
My point wasn't that privacy is not important. My point is that YOU are not important...and I'm right. You're not.
Which is entirely beside the point.
You are irrelevant to The Man until you become a "problem" and all this data gathering is for instant dossiers on people who become a "problem." To nail the head that sticks up.
Privacy is a human right because without it people are unable to effect change - they remain powerless. There is nobody on the planet without a skeleton in the closet, and exposing that skeleton is what this is all really about. It's national-level Borking, to remove any kind of power from people who would oppose a police-state.
That's why.
You, sir, are a short-sighted douchebag and, through your apathy, an enemy to everyone on this planet.
Ta Ta.
--
BMO
Re: people ruin everything (Score:5, Insightful)
Not only that, but the trolling poster also made the assumption that you're not important, which is bullshit for the simple reason that we're ALL important to the people who love and care about us. We're important to someone - I'm important to my wife for example, and soon I'll be important to my newborn. Just because I'm not a politician or celebrity and hence known to thousands/millions of people doesn't mean I'm not important. It's all about spheres of influence - some are larger than others, but they still all matter.
If the trolling poster honestly believes with such passion that you aren't important, it stands to reason they probably don't feel they are important either. If they can't find at least one person in their life who considers them important in some way... then I find that truly sad for the AC.
Re: people ruin everything (Score:4, Interesting)
Re:people ruin everything (Score:5, Insightful)
Re:people ruin everything (Score:4, Informative)
Governments are made up of people. People are always the problem.
Re: (Score:2)
Back door != Keys
The TC devs hold no keys, but could conceivably build a back door into future versions. Or perhaps there already is one, or a weakness overlooked. Its also possible that the NSA has known about the TC devs for some time, has possibly been leaning on one or more of them and this has only recently become evident to the entire team.
Re: (Score:3)
The signing keys you dolt.
Re:Nonsence (Score:4, Insightful)
Mod parent up. Grandparent AC is a moron. It's the signing keys, not some nonexistant master decrypt key.
If the thugs have the signing keys, they could have a couple of months from now themselves brought out a new "improved" (but completely compromised) 7.3 masquerading as an improved, updated, security patched TrueCrypt.
Re: (Score:2)
Yeah, absurdly non-true today. OTOH, Hoover did prefer Mormons in his inner circle, and the FBI agents I had occasion to meet in the 60s & 70s definitely came across as uptight and straitlaced Mormon types. Fun Fact: in the 60s, FBI agents helpfully drove AMC/Rambler sedans as undercover cars and used sturdy but crappy Beseler Topcon 35 mm cameras.