Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TrueCrypt suggesting migration to BitLocker?

truecrypt.sourceforge.net

Post reply on HN
Print view View original

221–230 of 414 posts

Re: TrueCrypt suggesting migration to BitLocker?

#221

Post by CHY872 »

Zancarius wrote: post #180
CHY872 wrote: post #161

Earlier quoted context omitted.

The motivation would be so that if you had a TrueCrypt archive lying around on a drive that you find in 5 years time, it would be possible to decrypt it - but they don't want to allow encryption because they won't be continuing development, and so fixing future bugs will not be possible.

If that's the motivation then in 5 years' time, who's to say the new version will work as well (assuming that it also won't be updated)? That doesn't make any sense.

They're saying that one should not continue to use orphaned software (when it's so security critical). So they're stopping the distribution of the encryption part of it, and continuing to distribute the part of the software that decrypts the code. This means that if (in five years) you find an archive that you can't open without TrueCrypt (and you uninstalled it etc) you'll still be easily able to find a signed version that will decrypt it for you.

At the same time, the developer clearly doesn't want people to be encrypting new archives with it, so have removed that functionality.

Removing the software in total would have lead to many mirror sites springing up, most with unproved providence (and a great opportunity for exploits). This method allows an official version to still exist (unmaintained, but still compatible with the current archives), whilst severely restricting new usages (by strongly warning against it and requiring using the dubious mirrors to obtain the software).

Re: TrueCrypt suggesting migration to BitLocker?

#222

Post by Moral_ »

A very interesting comment from netsec: http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_dev...

This is very strange. I have another theory since I don't believe in coincidences. We don't know the real author of TrueCrypt. I think someone found his identity (cough NSA) and made him an offer like lavabit.com received. This time probably with security classification so he can't talk about that. HOWEVER, if we take a look on diff of his code, we can see two interesting things:

    messages about TrueCrypt not being secure
    and the second thing he changed everywhere U.S. text to United States
Do you think that somoene who is closing a project would pay attention to doing such thing? I don't think so. I think that he tried to point a real reason of closing his project by that. I won't be surprised when truecrypt fork appears in TOR network soon...

Re: TrueCrypt suggesting migration to BitLocker?

#223

Post by bspar »

elmindreda wrote: post #209
bspar wrote: post #185

Earlier quoted context omitted.

Looks like it's the same key as before (F0D6B1E0)

On a day like this, compare the entire key.

It's the same. Original key: http://pgp.mit.edu/pks/lookup?op=get&search=0xE3BA73CAF0D6B1...

And the new key can be found on the SF site.

Re: TrueCrypt suggesting migration to BitLocker?

#225

Post by monokrome »

ColinDabritz wrote: post #215
tghw wrote: post #191

Earlier quoted context omitted.

What if this is an attempt to smoke out the TrueCrypt devs? While this move seems odd, the new binaries are properly signed and the domains have been updated accordingly. If this was another project, like Rails, the maintainer could come out and say they were hacked and the last good version was X. Otherwise, the project would likely die off. But since we know so little about the TrueCrypt maintainers, there's little…

Wouldn't they just have to published a signed message stating that the change was not theirs and the key is compromised? Or better yet, revoke the key? If two groups with opposing messages control the key, it's pretty clear that the key is compromised in some manner.

No, because the suggested "hackers" have published a signed message.

Re: TrueCrypt suggesting migration to BitLocker?

#226

Post by cjg_ »

Moral_ wrote: post #222

A very interesting comment from netsec: http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_dev... This is very strange. I have another theory since I don't believe in coincidences. We don't know the real author of TrueCrypt. I think someone found his identity (cough NSA) and made him an offer like lavabit.com received. This time probably with security classification so he can't talk about that. HOWEVER, if we t…

There was a lot of unrelated changes, this release was most likely just cut off their development branch.

Re: TrueCrypt suggesting migration to BitLocker?

#227

Post by throwaway8889 »

LeoPanthera wrote: post #157
verytrivial wrote: post #143

Earlier quoted context omitted.

Anyone have key fingerprints for pub keys used for the 7.1a vs 7.2 signing? Preferably pub key from a while ago I guess.

There's a "TrueCrypt Foundation" key on the keyservers from 2004, the ID is E3BA73CAF0D6B1E0.

The time stamp on key servers can not be trusted. Anyone can spoof keys in anyone elses name, with any timestamp they want.

The only way to verify is if you have the previous key stored somewhere, or can find a trustpath to it.

Re: TrueCrypt suggesting migration to BitLocker?

#228

Post by A_Non_eMouse »

prg318 wrote: post #79
harshreality wrote: post #55

Earlier quoted context omitted.

If this is a hack, then the truecrypt.org site (or dns) and sourceforge site are both compromised, suggesting a dev got hacked who would have had access to both, and perhaps the TC signing key as well (not everyone practices good signing key hygiene, like keeping it offline, even for important software projects). Even if it's a legit announcement, I wouldn't run that 7.2 binary. Anyone running truecrypt already has t…

SourceForge recently forced their users to change their passwords [1] because of an attack on their infrastructure [2]. Pure speculation but I'm not sure if that had anything to do with this? [1] http://sourceforge.net/blog/sourceforge-net-global-password-... [2] http://sourceforge.net/blog/sourceforge-net-attack/

Those two SourceForge blog posts are from January 2011, a year before the release of TrueCrypt 7.1a. The recent forced change was due to infrastructure changes.

https://sourceforge.net/blog/forced-password-change/

Re: TrueCrypt suggesting migration to BitLocker?

#229

Post by grlhgr420 »

dkokelley wrote: post #219

Is it possible that this is the result of a "dead man's switch" (DMS) set by the developer(s)? Perhaps a (continually updated) process was set up so that TrueCrypt would shut itself down if the developer were unable to prove he or she was still actively maintaining the software. I can see a couple of scenarios where this would be wise: A) The developer passes away, leaving nobody else to maintain TrueCrypt. Zero-day…

the page specifically mentions that it's ending support in may because ms is dropping xp support, though

Re: TrueCrypt suggesting migration to BitLocker?

#230

Post by Canada »

Alupis wrote: post #115
zorked wrote: post #89

Earlier quoted context omitted.

There's a new binary that recommends moving to BitLocker during install, and the signature matches. Edit: with a new, compromised key.

Is source still available? Can we check the commit tree for anything suspicious lately? Can someone compile it and check the hash against the 7.2 binary being offered?

It's not that simple. It won't match anyway. Signatures, compiler versions, SDK versions, etc.
Post reply on HN