251–260 of 414 posts
Earlier quoted context omitted.
Wouldn't they just have to published a signed message stating that the change was not theirs and the key is compromised? Or better yet, revoke the key? If two groups with opposing messages control the key, it's pretty clear that the key is compromised in some manner.
No, because the suggested "hackers" have published a signed message.
Interestingly enough, they also changed the TrueCrypt license. -TrueCrypt License Version 3.0 +TrueCrypt License Version 3.1 This lead me to think about the legal implications of changing a software license using stolen signing keys, when signing keys are all that you have to verify that the software is official (such is the case with TrueCrypt and its anonymous authors). If the license is changed, and the package is…
Interestingly, an Infoworld review of the recent TrueCrypt audit [1] says: "One major issue was how compiling TrueCrypt from source required the use of an older Windows build environment that's noticeably out of date [...] using a shockingly old version of Microsoft Visual C++ released in 1993." Align this with what the TC website says now: "development of TrueCrypt was ended in 5/2014 after Microsoft terminated supp…
Maybe it is time for LibreTruecrypt ;) like LibreSSL !
Interestingly, an Infoworld review of the recent TrueCrypt audit [1] says: "One major issue was how compiling TrueCrypt from source required the use of an older Windows build environment that's noticeably out of date [...] using a shockingly old version of Microsoft Visual C++ released in 1993." Align this with what the TC website says now: "development of TrueCrypt was ended in 5/2014 after Microsoft terminated supp…
I would be absolutely shocked if there was some reason any VC++ lib would not install on any modern Windows OS. Microsoft has many faults, but backwards compatibility is not one of them. I doubt this would be the reason. (Also, TrueCrypt runs on OSX and Linux too, so a build environment dependent on Windows-only seems odd).
Suspicion this could be related to the NBC News Snowden interview to be aired tonight?
Why have they only talk about how to secure a partition in Windows. Would the developers, or persons who took over the project, not care about other operating systems?! Of course, by 'they', I mean the fake development team that the hijacker of the site wanted to portray... no way this is real
Interestingly, an Infoworld review of the recent TrueCrypt audit [1] says: "One major issue was how compiling TrueCrypt from source required the use of an older Windows build environment that's noticeably out of date [...] using a shockingly old version of Microsoft Visual C++ released in 1993." Align this with what the TC website says now: "development of TrueCrypt was ended in 5/2014 after Microsoft terminated supp…
VC++ 1.52 is required to build the boot loader. You can still download it from MSDN. I can see why they would have an "if it ain't broke, don't fix it" attitude there.
There are several things MS has released that don't install on newer systems very well. There are some where the installer depends on an old version of Internet Explorer being installed and which fail miserably on newer versions.
Earlier quoted context omitted.
It could be that they've simply lost interest in developing it. It's quite the ongoing responsibility, and they may well be tired of working on it - a decade is a long time in anyone's life. If this is true, then perhaps such listlessness was also catalysed by the ongoing audit. Maybe seeing such a mass of crowdfunding income towards a project to pick Truecrypt apart, in contrast to the scant donations to its develop…
If you're developing a free product and you're going to throw in the towel anyway, why not just open up the sources with a liberal license and/or hand the project over to someone else who's willing to carry the torch.
https://code.google.com/p/cryptsetup/wiki/Cryptsetup160
So at least Linux users should be covered.
In order of likelihood: * Defaced site, timed to screw up a big announcement * Rogue content maintainer * Phase II of audit turned up something rather bad (edit: NO - see tptacek below) edit: Variations on "developer forced to do this" (cf simmerian's comment): * Developer was big brother all along and they are shutting it down * Security vuln about to be disclosed, dev scrambles to inform (albeit poorly) * Legally o…