Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

True Goodbye: ‘Using TrueCrypt Is Not Secure’

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 249 posts

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#11

Post by theboss »

Nursie wrote: post #9
theboss wrote: post #7

Earlier quoted context omitted.

There are pros and cons to both closed source and open source. Open source is nice because the community can audit the code and see for themselves, but closed-source is nice because a company generally has the resources to maintain and build software correctly. Both of these are hypothetical, however. We've seen tons of vulnerabilities from both. IMHO Open Source works a lot better on paper but once projects get very…

>>closed-source is nice because a company generally has the resources to maintain and build software correctly. These two things are orthogonal, IMHO.

My post is "on paper". In reality, projects are squeezed for nickels and dimes.

My point is that while open-source should be better, right now it seems that everything is equally not good enough.

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#12

Post by hamburglar »

panarky wrote: post #2

"[Matthew] Green last year helped spearhead dual crowdfunding efforts to raise money for a full-scale, professional security audit of the software." "'I think the TrueCrypt team did this,' Green said in a phone interview. 'They decided to quit and this is their signature way of doing it.'" "I’m a little worried that the fact we were doing an audit of the crypto might have made them decide to call it quits.”

If the audit made them call it quits, then having them cough up the source and abandon the project for someone else to pick up is the perfect outcome.

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#13

Post by mehrdada »

zaroth wrote: post #10

Why isn't BitLocker open source? If the new CEO wants to show he's serious about user privacy, I think opening up BitLocker and letting everyone look inside would be a great start. One of the reasons I like iPhone is the idea that the security system and drive encryption is not hopelessly broken. It would be great to have the same level of confidence in BitLocker.

> One of the reasons I like iPhone is the idea that the security system and drive encryption is not hopelessly broken.

Where can you get the source of that?

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#15

Post by runn1ng »

zaroth wrote: post #10

Why isn't BitLocker open source? If the new CEO wants to show he's serious about user privacy, I think opening up BitLocker and letting everyone look inside would be a great start. One of the reasons I like iPhone is the idea that the security system and drive encryption is not hopelessly broken. It would be great to have the same level of confidence in BitLocker.

iPhone security system is open-source?

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#16

Post by blueskin_ »

This seems highly suspicious, especially the recommendation of BitLocker, a product we have little to no evidence does what it says and after PRISM, have no reason to trust[2]; not to mention it being limited to a (very small subset of) Windows platforms vs. TrueCrypt's cross-platform functionality. If this was legit[1], it'd probably be directing people to one of the other TrueCrypt-like programs.

[1]The new version posted is almost certainly compromised; don't download it, or at the very least, run it in a VM on non-networked hardware you can reimage after finishing using.

[2]Edit: Forgot this before, but BitLocker is definitely completely broken as it sends your recovery key to MS anyway ( https://twitter.com/TheBlogPirate/status/471759810644283392/... ).

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#18

Post by mhogomchungu »

TrueCrypt encrypted volume format is well known and there are tools out there that can create TrueCrypt volumes and open them.

There is tcplay[1]. This project can create and open TrueCrypt volumes.

There is cryptsetup[2].This is a linux native solution for block device encryption and supports opening of TrueCrypt volumes.

The above two projects and command line based and there is a third project called zuluCrypt[3] that gives a GUI front end to the two projects.

I am not aware of any alternative solutions in windows or OSX that does support TrueCrypt encrypted format but adding support for it should not be that hard.

This maybe the end of line for TrueCrypt as a project,but its encrypted volume format may still be used as a "universal cross platform encrypted volume format".

Somebody should file a bug report in projects that deal with block device encryption in windows and OSX and ask them to support this format as i think the format should live on as its the only one that is widely used and supported.

[1] https://github.com/bwalex/tc-play

[2] https://code.google.com/p/cryptsetup/

[3] https://code.google.com/p/zulucrypt/

Post reply on HN