Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TrueCrypt suggesting migration to BitLocker?

truecrypt.sourceforge.net

Post reply on HN
Print view View original

201–210 of 414 posts

Re: TrueCrypt suggesting migration to BitLocker?

#201

Post by Sephr »

Alupis wrote: post #196
Sephr wrote: post #144

Interestingly enough, they also changed the TrueCrypt license. -TrueCrypt License Version 3.0 +TrueCrypt License Version 3.1 This lead me to think about the legal implications of changing a software license using stolen signing keys, when signing keys are all that you have to verify that the software is official (such is the case with TrueCrypt and its anonymous authors). If the license is changed, and the package is…

If, and only if, this is a legitament change done by a majority copyright holder(s) and/or project owner.

Of course, but when all you have to verify that a change is by the copyright holder/project owner is a signature, the whole situation becomes very murky.

The only authenticity test that I can think of is to actively distribute a fork of TrueCrypt using the new license and wait to get sued. If you get sued by the copyright holder (who would have to come out of anonymity to sue), then you can be sure that the new license was unauthorized. Not the safest way to test authenticity, but it should work.

Re: TrueCrypt suggesting migration to BitLocker?

#203

Post by mandalar12 »

ultramancool wrote: post #199
Adaptive wrote: post #59

In order of likelihood: * Defaced site, timed to screw up a big announcement * Rogue content maintainer * Phase II of audit turned up something rather bad (edit: NO - see tptacek below) edit: Variations on "developer forced to do this" (cf simmerian's comment): * Developer was big brother all along and they are shutting it down * Security vuln about to be disclosed, dev scrambles to inform (albeit poorly) * Legally o…

After examining all the facts, I think it's most likely they just didn't want to develop it anymore: * PGP matches * Authenticode matches * SourceForge data was modified * DNS records were modified And to top it off, let's put ourselves in the theoretical attacker's shoes, the binaries when run make no unexpected connection attempts or write to any unexpected places and don't appear to contain any unexpected imports,…

I guess the new license only applies to the release it is distributed with and this latest version removed encryption features so I doubt it will make the truecrypt project more compatible with FOSS licenses.

Re: TrueCrypt suggesting migration to BitLocker?

#204

Post by tomku »

4bpp wrote: post #170
Adaptive wrote: post #59

In order of likelihood: * Defaced site, timed to screw up a big announcement * Rogue content maintainer * Phase II of audit turned up something rather bad (edit: NO - see tptacek below) edit: Variations on "developer forced to do this" (cf simmerian's comment): * Developer was big brother all along and they are shutting it down * Security vuln about to be disclosed, dev scrambles to inform (albeit poorly) * Legally o…

The element that does not square with any theories that suggest benevolent intent behind the change is the recommendation that users switch to Bitlocker. Surely, a Truecrypt developer who got served a gagging order to build in a backdoor would realise that a big and compliant target such as Microsoft would have been subject to the same measure long ago, and likewise that if a pre-existing vulnerability on a sufficien…

As crazy as it sounds, I think you're right and it's just the developer(s) quitting (rage-quitting?) the project. Nothing else makes sense.

The Bitlocker thing seems strange until you realize that it probably really IS the best alternative for most users. The users who are paranoid enough to not trust Bitlocker can probably look out for their own security, so it makes sense to give instructions for the rest.

None of the explanations people have came up with regarding intelligence agencies and conspiracies really hold water. If the devs were compromised, I doubt they would be given the freedom to post something like they did today. If they were under some kind of NSL or gag order, this would almost certainly violate it.

Re: TrueCrypt suggesting migration to BitLocker?

#205

Post by quasque »

SAI_Peregrinus wrote: post #195
Zancarius wrote: post #187

Earlier quoted context omitted.

If you're developing a free product and you're going to throw in the towel anyway, why not just open up the sources with a liberal license and/or hand the project over to someone else who's willing to carry the torch.

It's already open-source.

As far as I know, its license is incompatible with other open source licenses due to an advertising clause (all derivative works have to state "based on Truecrypt" somewhere in the documentation or via use of the software). The old four clause BSD license had a similar issue.

Re: TrueCrypt suggesting migration to BitLocker?

#206

Post by ultramancool »

mandalar12 wrote: post #203
ultramancool wrote: post #199

Earlier quoted context omitted.

After examining all the facts, I think it's most likely they just didn't want to develop it anymore: * PGP matches * Authenticode matches * SourceForge data was modified * DNS records were modified And to top it off, let's put ourselves in the theoretical attacker's shoes, the binaries when run make no unexpected connection attempts or write to any unexpected places and don't appear to contain any unexpected imports,…

I guess the new license only applies to the release it is distributed with and this latest version removed encryption features so I doubt it will make the truecrypt project more compatible with FOSS licenses.

True, but they likely intended it for all releases and I highly doubt the dev(s) are going to burn their anonymity to go after you even if they didn't.

Though I suppose that's not the best legal rationale, now is it?

Re: TrueCrypt suggesting migration to BitLocker?

#207

Post by makmanalp »

pearjuice wrote: post #123
makmanalp wrote: post #110

Earlier quoted context omitted.

Time to call in the underhanded C contest ( http://underhanded.xcott.com/ ) participants on a special bugfinding challenge :)

Not needed. Just quickly scroll through the diff (better version here: https://gist.github.com/anonymous/e5791d5703325b9cf6d1 ) and you will immediately see that all that was done is disable/remove a majority of the functionality. AbortProcess ("INSECURE_APP"); Print ("WARNING: Using TrueCrypt is not secure"); They added exceptions/rose errors/printed warnings everywhere where you could possibly encrypt and all of it…

The whole point of the underhanded c contest is that the code looks extremely benign, and you wouldn't know that it's doing something evil by staring at it for a short time. Example: http://underhanded.xcott.com/?page_id=22

Anyway, it was a joke.

edit: But I'm not touching that binary with a 10 foot pole, thank you. There isn't even any guarantee yet that that source compiles into the given binary.

Re: TrueCrypt suggesting migration to BitLocker?

#208

Post by toyg »

Interestingly, an Infoworld review of the recent TrueCrypt audit [1] says: "One major issue was how compiling TrueCrypt from source required the use of an older Windows build environment that's noticeably out of date [...] using a shockingly old version of Microsoft Visual C++ released in 1993."

Align this with what the TC website says now: "development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP."

Could it be that the original developer is somehow unable to update the build process to work on newer OSes, or unwilling to do so? Maybe they don't trust any VC++ released after 1993, and that version is probably not going to work on Windows 7 or 8.

[1] http://www.infoworld.com/t/encryption/sloppy-secure-open-sou...

Re: TrueCrypt suggesting migration to BitLocker?

#209

Post by elmindreda »

bspar wrote: post #185
Alupis wrote: post #132

Earlier quoted context omitted.

Project on SF is still available if you have a direct link: http://sourceforge.net/projects/truecrypt/files/TrueCrypt/ http://sourceforge.net/projects/truecrypt/?source=navbar http://sourceforge.net/p/truecrypt/activity/?page=0&limit=10... Odd, 6 hours ago someone updated the TruCrypt-key.asc files, then 3 hours later posted all the new binaries. Also odd is whoever posted the new binaries completely yanked all the p…

Looks like it's the same key as before (F0D6B1E0)

On a day like this, compare the entire key.

Re: TrueCrypt suggesting migration to BitLocker?

#210

Post by Alupis »

toyg wrote: post #208

Interestingly, an Infoworld review of the recent TrueCrypt audit [1] says: "One major issue was how compiling TrueCrypt from source required the use of an older Windows build environment that's noticeably out of date [...] using a shockingly old version of Microsoft Visual C++ released in 1993." Align this with what the TC website says now: "development of TrueCrypt was ended in 5/2014 after Microsoft terminated supp…

I would be absolutely shocked if there was some reason any VC++ lib would not install on any modern Windows OS.

Microsoft has many faults, but backwards compatibility is not one of them.

I doubt this would be the reason. (Also, TrueCrypt runs on OSX and Linux too, so a build environment dependent on Windows-only seems odd).

Post reply on HN