Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TrueCrypt suggesting migration to BitLocker?

truecrypt.sourceforge.net

Post reply on HN
Print view View original

331–340 of 414 posts

Re: TrueCrypt suggesting migration to BitLocker?

#331

Post by smellf »

wielebny wrote: post #319
BoppreH wrote: post #313

Earlier quoted context omitted.

Are you sure? He does say "binaries when run make no unexpected...". And matching binaries is not a trivial task because of OS, compiler and SDK versions. The last time someone did this for Truecrypt it made the news: https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binarie...

Binaries could have code that will activate in future.

If you have a copy of the source that you've vetted, and you can compile it in such a way that the resulting binary is a bit-for-bit match of the developer released binary, then you know that either there is no future-activation code or you missed it in your review or your compiler was itself compiled maliciously with the intent of inserting malicious code into that exact version of truecrypt every time it was compiled. Or there is no future activation code.

Re: TrueCrypt suggesting migration to BitLocker?

#332

Post by panarky »

verytrivial wrote: post #143
CodeMage wrote: post #138

Earlier quoted context omitted.

Same key as the previous binaries? I doubt it, given that the keys were replaced mere 3 hours before the new binaries were published: http://sourceforge.net/p/truecrypt/activity/?page=0&limit=10...

Anyone have key fingerprints for pub keys used for the 7.1a vs 7.2 signing? Preferably pub key from a while ago I guess.

I have 7.1a binaries, source, sigs and pub key from September 2013.

  pub   1024D/F0D6B1E0 2004-06-06
        Key fingerprint = C5F4 BAC4 A7B2 2DB8 B8F8  5538 E3BA 73CA F0D6 B1E0
  uid                  TrueCrypt Foundation 
  sub   4077g/6B136ECF 2004-06-06
My version from September is identical to the pub key at http://sourceforge.net/projects/truecrypt/files/TrueCrypt/Ot... .

Re: TrueCrypt suggesting migration to BitLocker?

#333

Post by FootballMuse »

BoppreH wrote: post #308
BoppreH wrote: post #295

- Signature is valid, so it's not a defacement. ( http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_dev... ) - The version there works and does not seem to have a trojan, so probably not a regular hacker. ( https://news.ycombinator.com/item?id=7813373 ) - Instructs to migrate to dubious alternatives, so it's not a legit security effort. - License change, precise instructions and decrypt-only version indicate i…

infosecslave said in a dead comment: [...] you have to consider the fact that Truecrypt project was started before FDE was popular, maybe their goal all this time was to popularize such encryption. With XPs demise that goal would have been achieved as every current Windows version comes with Bitlocker. Your comment is dead but makes a lot of sense, especially in light of the message on the website: The development of…

Server 2003 is still a supported version of windows for another year.

Re: TrueCrypt suggesting migration to BitLocker?

#334

Post by voltagex_ »

panarky wrote: post #332
verytrivial wrote: post #143

Earlier quoted context omitted.

Anyone have key fingerprints for pub keys used for the 7.1a vs 7.2 signing? Preferably pub key from a while ago I guess.

I have 7.1a binaries, source, sigs and pub key from September 2013. pub 1024D/F0D6B1E0 2004-06-06 Key fingerprint = C5F4 BAC4 A7B2 2DB8 B8F8 5538 E3BA 73CA F0D6 B1E0 uid TrueCrypt Foundation sub 4077g/6B136ECF 2004-06-06 My version from September is identical to the pub key at http://sourceforge.net/projects/truecrypt/files/TrueCrypt/Ot... .

Could you post the SHA1s of those? I'm failing to use GPG properly.

Re: TrueCrypt suggesting migration to BitLocker?

#335

Post by tacotime »

laurent123456 wrote: post #149
Sephr wrote: post #144

Interestingly enough, they also changed the TrueCrypt license. -TrueCrypt License Version 3.0 +TrueCrypt License Version 3.1 This lead me to think about the legal implications of changing a software license using stolen signing keys, when signing keys are all that you have to verify that the software is official (such is the case with TrueCrypt and its anonymous authors). If the license is changed, and the package is…

Interesting, especially since the author(s) are anonymous and not working off public repositories, it will be very hard, if not impossible, for them to prove that they did not release this software.

If two groups with opposing messages control the key, it's pretty clear that the key is compromised in some manner.

Re: TrueCrypt suggesting migration to BitLocker?

#337

Post by exarch »

BoppreH wrote: post #298
deciplex wrote: post #297

Earlier quoted context omitted.

>If I had to wager a crazy bet, I would go with newly developed Dead-Man's-Switch gone wrong. That's an interesting thought, although I don't think there's any way to verify that it's actually gone 'wrong', is there?

If it was operator error during the development of a Dead-Man's-Switch, the developer will probably come out in public explaining the situation and apologizing. And if this is a Dead-Man's-Switch gone right , why are they advocating the use of BitLocker and searching for random Linux packages? Edit: is "coming out in public" the correct term here? I have a feeling it only applies to closet-like scenarios.

>And if this is a Dead-Man's-Switch gone right, why are they advocating the use of BitLocker and searching for random Linux packages?

One possibility is that they did it this way specifically because it's legally compliant with some order they got, but suspicious enough to raise alarm in the tech community and telegraph that something has gone deeply, deeply wrong.

This could be a warrant canary.

Re: TrueCrypt suggesting migration to BitLocker?

#338

Post by spacehome »

isp wrote: post #304
dewiz wrote: post #243

Suppose that the author received a secret order from a secret court that required the author keep secret the secrecy of the secret order from the secret court. Furthermore, the author was secretly required to turn over his secret signing key to a secret third party. If you were the author, what would you do? Consider your options. One is that you could issue an update with a warning that the program is no longer secu…

Continuing the thought experiment. By stating the "reason" you're shutting down is that your project is "no longer necessary", then (i) your userbase will rapidly infer that the reason is odd (e.g., https://news.ycombinator.com/item?id=7813799 ), while (ii) you can plausibly defend closing down with a straight face, in court if required ("Our raison d'être no longer applies. So obviously this was the perfect time to…

This is without a doubt the most parsimonious explanation for all available evidence.

Re: TrueCrypt suggesting migration to BitLocker?

#339

Post by tacotime »

cjg_ wrote: post #226
Moral_ wrote: post #222

A very interesting comment from netsec: http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_dev... This is very strange. I have another theory since I don't believe in coincidences. We don't know the real author of TrueCrypt. I think someone found his identity (cough NSA) and made him an offer like lavabit.com received. This time probably with security classification so he can't talk about that. HOWEVER, if we t…

There was a lot of unrelated changes, this release was most likely just cut off their development branch.

The point is that a search and replace from "U.S." to "United States" is an unusual change. I have not seen evidence of this firsthand yet so I am just taking Moral_ on his word but if that is the case and there are a number of occurrences then it is certainly an interesting thing for the author to think to change.

Re: TrueCrypt suggesting migration to BitLocker?

#340

Post by byuu »

ACow_Adonis wrote: post #24

I remember TrueCrypt from several years ago when I was looking into various options for encryption. Haven't used encryption for a while, but if this is true, is there now an encryption software/service that doesn't involve being authored by a large corporation in the country that gave us the NSA, and which allows things like hidden volumes/partitions, algorithm choices, and use with various portable devices?

FreeBSD has GEOM/geli, which is a block-level (sub-filesystem) encryption method written by Paweł Jakub Dawidek (a Pole). It allows your choice of several data integrity verification algorithms, several encryption algorithms, and the usage of zero or more key files and/or a passphrase. And you can use it on external devices if you like. Also supports hardware acceleration via AES/NI with recent Intel CPUs.

Since it's block-level, you can use any filesystem you like. Since it's BSD, you might as well use ZFS (but don't use data integrity verification if you do, since ZFS has that built in.)

Downside is that you have to use FreeBSD to get it. Upside is that you get to use FreeBSD =)

Post reply on HN