Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TrueCrypt suggesting migration to BitLocker?

truecrypt.sourceforge.net

Post reply on HN
Print view View original

301–310 of 414 posts

Re: TrueCrypt suggesting migration to BitLocker?

#301

Post by ewindisch »

edwintorok wrote: post #140
oceanstone wrote: post #101

Perhaps it's time for a fork.

The TrueCrypt license is not OSI approved, so probably noone wants to touch it for the same reason noone wanted to touch OpenSSL for all those years ... unless you really really have to and have no alternatives.

With the authors anonymous and presumably intending to stay so, there is nobody to challenge copyright violations against their code. Furthermore, international copyright law can have a certain flakiness in execution depending on various circumstances.

Not that it makes it right, but the limitations of licensing are more ethical than practical.

Re: TrueCrypt suggesting migration to BitLocker?

#302

Post by infosecslave »

BoppreH wrote: post #295

- Signature is valid, so it's not a defacement. ( http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_dev... ) - The version there works and does not seem to have a trojan, so probably not a regular hacker. ( https://news.ycombinator.com/item?id=7813373 ) - Instructs to migrate to dubious alternatives, so it's not a legit security effort. - License change, precise instructions and decrypt-only version indicate i…

Bitlocker is a less dubious alternative than it seems, I'd rather use Bitlocker than a completely unmaintained crypto software from anonymous developers.

Also you have to consider the fact that Truecrypt project was started before FDE was popular, maybe their goal all this time was to popularize such encryption. With XPs demise that goal would have been achieved as every current Windows version comes with Bitlocker.

Re: TrueCrypt suggesting migration to BitLocker?

#303

Post by Zancarius »

quasque wrote: post #193
Zancarius wrote: post #187

Earlier quoted context omitted.

If you're developing a free product and you're going to throw in the towel anyway, why not just open up the sources with a liberal license and/or hand the project over to someone else who's willing to carry the torch.

It may be the same strong sense of ownership and control that precluded the liberalisation of Truecrypt's license during its lifetime in the past decade.

Your reply seems to be the most sensible out of the lot. (Side note: I presumed there'd be a couple other ones that suggested it's open source--never mind that prior to the removal of some of the license text it wasn't "free as in beer" open. To be fair, I had forgotten myself that TrueCrypt wasn't exactly open source.)

Perhaps ownership does run deep, even if you've never really released a product for money and it's always been free. Still, it's something I don't understand: If I had a tool that I released for free and finally gave up on it, I'd like to think I'd open it up under an exceptionally liberal license or just dump it in the public domain. That'd be especially true if it had a lot of users.

That's what makes me think that if this isn't some elaborate scheme it's likely the result of some sort of legal requirement or action (e.g. Lavabit) which would preclude the author(s) from doing anything else with the software. It's a shame they couldn't take a scorched earth-esque approach of dumping everything in the public domain, including notes on why this was happening, everyone else be damned, but I'd imagine their entire career might be in jeopardy at that point (and possibly their freedom).

Re: TrueCrypt suggesting migration to BitLocker?

#304

Post by isp »

dewiz wrote: post #243

Suppose that the author received a secret order from a secret court that required the author keep secret the secrecy of the secret order from the secret court. Furthermore, the author was secretly required to turn over his secret signing key to a secret third party. If you were the author, what would you do? Consider your options. One is that you could issue an update with a warning that the program is no longer secu…

Continuing the thought experiment. By stating the "reason" you're shutting down is that your project is "no longer necessary", then (i) your userbase will rapidly infer that the reason is odd (e.g., https://news.ycombinator.com/item?id=7813799 ), while (ii) you can plausibly defend closing down with a straight face, in court if required ("Our raison d'être no longer applies. So obviously this was the perfect time to shutdown the project for totally this reason and not any others.") Additionally, by changing the TrueCrypt License from 3.0 to 3.1 (removing the clause requiring advertising truecrypt.org), you tacitly support TrueCrypt forks while simultaneously de-emphasising the now-compromised truecrypt.org.

Re: TrueCrypt suggesting migration to BitLocker?

#305

Post by Shank »

BoppreH wrote: post #298
deciplex wrote: post #297

Earlier quoted context omitted.

>If I had to wager a crazy bet, I would go with newly developed Dead-Man's-Switch gone wrong. That's an interesting thought, although I don't think there's any way to verify that it's actually gone 'wrong', is there?

If it was operator error during the development of a Dead-Man's-Switch, the developer will probably come out in public explaining the situation and apologizing. And if this is a Dead-Man's-Switch gone right , why are they advocating the use of BitLocker and searching for random Linux packages? Edit: is "coming out in public" the correct term here? I have a feeling it only applies to closet-like scenarios.

If it was a hastily constructed DMS (such as in the event of imminent threat), the author may not have had time to research and test a comparable Linux alternative. If you knew that something bad could happen, you would work as fast as possible to set it up, rather than risk not being able to have anything working in time.

The reason why is quite simple: if a malicious third party were to raid or steal the private key, this kind of deterrent message should act as ample warning not to trust any further releases than what has already been released. If a government agent were to capture a developer and hold him or her hostage to attain the key (and thus release a backdoor), this type of DMS would immediately draw scrutiny to any actor attempting to release a new version that claims differently. If anything, the implicit statement is "continue using 7.1a and do not update beyond that in the event that something newer is offered." In light of the recent audit, it appears that 7.1a is secure -- and as a result, it can still be used for cryptography purposes (however subsequent releases may not).

Re: TrueCrypt suggesting migration to BitLocker?

#306

Post by bothuman »

BoppreH wrote: post #295

- Signature is valid, so it's not a defacement. ( http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_dev... ) - The version there works and does not seem to have a trojan, so probably not a regular hacker. ( https://news.ycombinator.com/item?id=7813373 ) - Instructs to migrate to dubious alternatives, so it's not a legit security effort. - License change, precise instructions and decrypt-only version indicate i…

>- The version there works and does not seem to have a trojan, so probably not a regular hacker.

Incorrect, all the guy did was compare diffs of the source. He did not compile the source to make sure the binaries matched.

Re: TrueCrypt suggesting migration to BitLocker?

#307

Post by roustabout »

ultramancool wrote: post #278
mandelbulb wrote: post #239

Earlier quoted context omitted.

>>After examining all the facts, I think it's most likely they just didn't want to develop it anymore: So they decided to end things with such an extremely juvenile behavior devaluating the years they have invested in this project even if not recently? Unless the responsible one fell into clinical depression it's a pretty strange reason.

They haven't updated it for years. I'd hardly call the behavior "juvenile" nor would i call it "devaluating". They've simply abandoned it and are offering alternatives.

They don't offer alternatives. Please take a moment to read the second page - the instructions for "other operating systems." The linux instructions make it damned obvious that someone is playing a game. The question is who and why.

If it's the actual TC crew, the explanations toward an NSL or a new vuln that an NSL or similar applies to seem to be about the only rationale - though even then, it seems to me it'd be possible to steer the code audit in the right direction.

Given the churn of new keys today, I'm more inclined to think that the comms of TC have been broken and the breach is being used to drive people away from the releases of the tool for which source is available.

Re: TrueCrypt suggesting migration to BitLocker?

#308

Post by BoppreH »

BoppreH wrote: post #295

- Signature is valid, so it's not a defacement. ( http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_dev... ) - The version there works and does not seem to have a trojan, so probably not a regular hacker. ( https://news.ycombinator.com/item?id=7813373 ) - Instructs to migrate to dubious alternatives, so it's not a legit security effort. - License change, precise instructions and decrypt-only version indicate i…

infosecslave said in a dead comment:

    [...] you have to consider the fact that Truecrypt project
    was started before FDE was popular, maybe their goal all 
    this time was to popularize such encryption. With XPs 
    demise that goal would have been achieved as every  
    current Windows version comes with Bitlocker.
Your comment is dead but makes a lot of sense, especially in light of the message on the website:

    The development of TrueCrypt was ended in 5/2014 after
    Microsoft terminated support of Windows XP.
I don't agree Bitlocker is a sensible alternative, but this piece does fit the puzzle.

Re: TrueCrypt suggesting migration to BitLocker?

#309

Post by bothuman »

TheLoneWolfling wrote: post #290
ars wrote: post #116

Earlier quoted context omitted.

> damning results They didn't seem that severe to me, they seemed pretty minor actually. Especially if your attack vector is solely a read attack rather than a read-write attack. Which one got you worried?

> EncFS is probably safe as long as the adversary only gets one copy of the ciphertext and nothing more. EncFS is not safe if the adversary has the opportunity to see two or more snapshots of the ciphertext at different times. EncFS attempts to protect files from malicious modification, but there are serious problems with this feature. Which, seeing as my current major use case is to lock down Dropbox, kind of render…

EncFS is horrible.

However you should not use XTS with Dropbox http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/

Re: TrueCrypt suggesting migration to BitLocker?

#310

Post by novaleaf »

BoppreH wrote: post #298
deciplex wrote: post #297

Earlier quoted context omitted.

>If I had to wager a crazy bet, I would go with newly developed Dead-Man's-Switch gone wrong. That's an interesting thought, although I don't think there's any way to verify that it's actually gone 'wrong', is there?

If it was operator error during the development of a Dead-Man's-Switch, the developer will probably come out in public explaining the situation and apologizing. And if this is a Dead-Man's-Switch gone right , why are they advocating the use of BitLocker and searching for random Linux packages? Edit: is "coming out in public" the correct term here? I have a feeling it only applies to closet-like scenarios.

I don't think it's important what alternative they are suggesting.

The important point is that the developers (?) are advocating that users stop using their product.

Forest through the trees, if you will.

Post reply on HN