61–70 of 414 posts
The advice for Linux is "Search available installation packages for words encryption and crypt, install any of the packages found and follow its documentation." So... just any of them, then? Sure, ok.
https://wiki.archlinux.org/index.php/Disk_encryption#Compari... This might help.
Anyone know who the main committers/project leads are so we could reach out for comment/clarification?
Well - this comes as a pretty big surprise. Is this real? Is there a known vulnerability that catalyzed this? Money from Microsoft? Threats? I'm not buying into conspiracy theories, but it does seem pretty out of place.
The binaries are properly GPG-signed with the same key as the previous binaries, check for yourself. [They] either compromised their private key too or the actual developer(s) did this. Be it voluntarily or by force of secret three-character agencies / a massive pay check.
8 hours ago on the IndieGoGo TrueCrypt Audit page [1] > p.s. We hope to have some big announcements this week, so stay tuned. [1] https://www.indiegogo.com/projects/the-truecrypt-audit#activ...
Although Kenn White, who wrote that message, has no idea what's going on [1] > .@FiloSottile @matthew_d_green no idea. It's doing a 301 perm to a static pg @ SF, now blocked. Possibly compromised. pic.twitter.com/g5tSFUuXzu [1] https://twitter.com/kennwhite/status/471740840478797824
.@Costly no idea. The announcement was about a
new Open Crypto Audit Project initiative, not TC.
No mention of why it's supposed to be not secure - it's an open source project so it would be easy to point to a specific vulnerability. All of this shortly after passing audit. There are detailed steps towards switching to supposedly secure closed-source solutions by companies known to be working closely with the NSA.
Also, since when do open source projects suddenly decide they are not as good enough as a closed-source alternative and then stop the project? Are we in danger of seeing a similar message on the homepage of LibreOffice and OpenOffice, declaring that you should switch to Microsoft Office?
I can't even begin to imagine a valid scenario in which something like this would be put up by the developers, with no pressure other than some fatal security flaw about which they just really don't want to talk.
Earlier quoted context omitted.
truecrypt.org does a redirect to this sourceforge page, so perhaps it is the DNS that got hijacked, and not truecrypt website itself. I don't remember TC ever being hosted on SF, so I think this is a bad redirect...
On the other hand, SourceForge lists the project as having been created in 2004: http://sourceforge.net/projects/truecrypt/
In order of likelihood: * Defaced site, timed to screw up a big announcement * Rogue content maintainer * Phase II of audit turned up something rather bad (edit: NO - see tptacek below) edit: Variations on "developer forced to do this" (cf simmerian's comment): * Developer was big brother all along and they are shutting it down * Security vuln about to be disclosed, dev scrambles to inform (albeit poorly) * Legally o…