True Goodbye: ‘Using TrueCrypt Is Not Secure’ • Hacker News Board

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#41

Post by MichaelGG » Thu, May 29, 2014, 9:14 AM UTC

blueskin_ wrote: post #16

This seems highly suspicious, especially the recommendation of BitLocker, a product we have little to no evidence does what it says and after PRISM, have no reason to trust[2]; not to mention it being limited to a (very small subset of) Windows platforms vs. TrueCrypt's cross-platform functionality. If this was legit[1], it'd probably be directing people to one of the other TrueCrypt-like programs. [1]The new version…

A screenshot that says "We have the recovery key", but zero indication of how they got it? The previous slide could not possibly be something related to dumping RAM, could it?

Or perhaps an optional Microsoft-account feature to back up your encryption keys. Something that most normal users would want, just like they want it on Apple devices? Because a lot of common users aren't going to want FDE if it means "oh and lose your key and say goodbye to your data".

As far as I know, there's only been speculation on what PRISM is. Nothing that suggests it couldn't be a frontend to CALEA or warrant-based systems.

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#42

Post by MichaelGG » Thu, May 29, 2014, 9:16 AM UTC

danparsonson wrote: post #27

grrowl wrote: post #21

Earlier quoted context omitted.

I don't believe BitLocker can be considered secure. Cross-post (mine) from the previous thread: > Not "backdoors" but it seems Microsoft stores the BitLocker decryption key, based on this leaked slide (just found on twitter): https://twitter.com/TheBlogPirate/status/471759810644283392/... > edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microsof…

> Not "backdoors" but it seems Microsoft stores the BitLocker decryption key, based on this leaked slide (just found on twitter): https://twitter.com/TheBlogPirate/status/471759810644283392/... . That looks dubious to me - if you were creating a slide, would you use 90-degree-rotated text? > edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microso…

Maybe Microsoft asks or somehow prompts the user to back up their encryption keys? I mean, a user-focused OS certainly wouldn't include such a feature, right?

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#43

Post by narag » Thu, May 29, 2014, 9:18 AM UTC

ambrop7 wrote: post #6

So what's the (Windows compatible and open source) software to transition systems to?

Even if there isn't one, I guess you can run Linux in a VM, mount encrypted volumes from it and export the unit.

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#44

Post by makomk » Thu, May 29, 2014, 9:22 AM UTC

andyjohnson0 wrote: post #38

danparsonson wrote: post #27

Earlier quoted context omitted.

> Not "backdoors" but it seems Microsoft stores the BitLocker decryption key, based on this leaked slide (just found on twitter): https://twitter.com/TheBlogPirate/status/471759810644283392/... . That looks dubious to me - if you were creating a slide, would you use 90-degree-rotated text? > edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microso…

Using a Microsoft account for login is not mandatory on Windows 8.

It's not mandatory to use a Microsoft account for login, but they've been hiding the option not to in increasingly obscure locations in the installer. At one point, the easiest way to do it was apparently to just unplug your internet connection!

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#45

Post by darklajid » Thu, May 29, 2014, 9:26 AM UTC

pling wrote: post #22

Well this is good for me. I currently use a TrueCyrypt encrypted exFAT volume for backups. My motivation is now to move this to an open source system (probably dm-crypt). This and RDP is the only reason I'm hanging onto windows and that's purely out of apathy. The suggestion of using BitLocker is a bit insulting (this might just be comedy value from TC though). Every other bit of software I use is portable or in a Li…

RDP: Is there anything freerdp cannot do that you need from day to day? I'm working with Windows, but run Linux without any issues so far.

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#46

Post by andrewfong » Thu, May 29, 2014, 9:31 AM UTC

danparsonson wrote: post #27

grrowl wrote: post #21

Earlier quoted context omitted.

I don't believe BitLocker can be considered secure. Cross-post (mine) from the previous thread: > Not "backdoors" but it seems Microsoft stores the BitLocker decryption key, based on this leaked slide (just found on twitter): https://twitter.com/TheBlogPirate/status/471759810644283392/... > edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microsof…

> Not "backdoors" but it seems Microsoft stores the BitLocker decryption key, based on this leaked slide (just found on twitter): https://twitter.com/TheBlogPirate/status/471759810644283392/... . That looks dubious to me - if you were creating a slide, would you use 90-degree-rotated text? > edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microso…

Previous poster's confirmation is misleading -- it does not appear to be mandatory. I just went through the process on my Windows 8 machine, and you can choose to save to the recovery key to a file or print it out in lieu of storing it with your Microsoft Account (http://imgur.com/J0zk6I5).

Two caveats:

(1) It's possible Microsoft could choose to store the keys online regardless of what the user picks, but it's certainly not their official stance.

(2) Microsoft does automatically store keys online if you're using "Device Encryption" in Windows 8.1 (http://arstechnica.com/information-technology/2013/10/window...). This uses Bitlocker code but is distinct from using Bitlocker itself though -- i.e. if you do a vanilla Bitlocker encryption, your system should not send the keys to MS without a user (or admin) explicitly telling it to.

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#47

Post by sekasi » Thu, May 29, 2014, 9:31 AM UTC

Is this a warrant canary?

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#48

Post by wazoox » Thu, May 29, 2014, 9:32 AM UTC

pling wrote: post #22

Well this is good for me. I currently use a TrueCyrypt encrypted exFAT volume for backups. My motivation is now to move this to an open source system (probably dm-crypt). This and RDP is the only reason I'm hanging onto windows and that's purely out of apathy. The suggestion of using BitLocker is a bit insulting (this might just be comedy value from TC though). Every other bit of software I use is portable or in a Li…

There's an RDP client under Linux, and you can use nx as a server, it's nearly as efficient as RDP.

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#49

Post by pling » Thu, May 29, 2014, 9:37 AM UTC

darklajid wrote: post #45

pling wrote: post #22

Well this is good for me. I currently use a TrueCyrypt encrypted exFAT volume for backups. My motivation is now to move this to an open source system (probably dm-crypt). This and RDP is the only reason I'm hanging onto windows and that's purely out of apathy. The suggestion of using BitLocker is a bit insulting (this might just be comedy value from TC though). Every other bit of software I use is portable or in a Li…

RDP: Is there anything freerdp cannot do that you need from day to day? I'm working with Windows, but run Linux without any issues so far.

We have an RDP gateway which is an awful pile of shit to deal with as it uses HTTPS initiated MSRPC as the transport layer. FreeRDP doesn't work properly with that yet as there are all sorts of odd configuration and encryption things that are almost impossible to line up properly when your ops team don't actually know what they're doing or how to find out stuff for you.

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#50

Post by pling » Thu, May 29, 2014, 9:39 AM UTC

wazoox wrote: post #48

pling wrote: post #22

Well this is good for me. I currently use a TrueCyrypt encrypted exFAT volume for backups. My motivation is now to move this to an open source system (probably dm-crypt). This and RDP is the only reason I'm hanging onto windows and that's purely out of apathy. The suggestion of using BitLocker is a bit insulting (this might just be comedy value from TC though). Every other bit of software I use is portable or in a Li…

There's an RDP client under Linux, and you can use nx as a server, it's nearly as efficient as RDP.

I'm connecting to a Windows machine from my Linux host rather than the other way round. I can connect to the Linux machine quite happily with SSH as everything I do on them is on the terminal anyway (apart from a few things which I don't want to do remotely anyway).