Time for OpenTrueCrypt AKA LibreTrueCrypt? Theo, we're ready and we're waiting! ;)
TrueCrypt suggesting migration to BitLocker?
371–380 of 414 posts
Re: TrueCrypt suggesting migration to BitLocker?
#372I've always found it sketchy how the maintainers remove old versions. Now seems like a good time to: git clone https://github.com/DrWhax/truecrypt-archive.git
Can somebody confirm that these archives are valid?
Re: TrueCrypt suggesting migration to BitLocker?
#373Earlier quoted context omitted.
We don't know much about the TC developers, do we? It's also possible that they're just really cavalier about this stuff, and that this is their response to the TC audit process ("stop bothering us about it and use something that's maintained").
Certainly possible, although this from the audit web page doesn't sound like that would be a big problem: "Wed, Oct 24, 2013: We have made contact with the TrueCrypt development team. They have stated a commitment to a thorough, independent security audit and cryptanalysis of the code."
Since TC developers were unknown for a long time. Perhaps the audit effort, or someone involved with it, intentionally or not, somehow opened some clue that allowed some 3-letters agency go after the developers and they receive those weird proposals like Lavabit ??
Re: TrueCrypt suggesting migration to BitLocker?
#374Earlier quoted context omitted.
They haven't updated it for years. I'd hardly call the behavior "juvenile" nor would i call it "devaluating". They've simply abandoned it and are offering alternatives.
They don't offer alternatives. Please take a moment to read the second page - the instructions for "other operating systems." The linux instructions make it damned obvious that someone is playing a game. The question is who and why. If it's the actual TC crew, the explanations toward an NSL or a new vuln that an NSL or similar applies to seem to be about the only rationale - though even then, it seems to me it'd be p…
They're offering an encryption product, not a service, an NSL would seem pointless unless they want to slap one at everyone who implements cryptography. and there's plenty of better ways for 3 letter agencies to obtain FDE keys. The Linux instructions just make it clear that your options and process vary per distro, if they're ditching the project I doubt they felt like writing piles more docs to describe every possible combination of loop-aes, dm-crypt, ecryptfs, encfs, luks, etc.
Re: TrueCrypt suggesting migration to BitLocker?
#375Earlier quoted context omitted.
They haven't updated it for years. I'd hardly call the behavior "juvenile" nor would i call it "devaluating". They've simply abandoned it and are offering alternatives.
I think suggesting BitLocker as a viable alternative to their work is "devaluing" their work. Who would trust BitLocker not to be vastly more compromised that TrueCrypt? (Devaluating? sic? Or is that actually a word?)
You're right - few would trust it more. However, it is the closest viable alternative to TrueCrypt on the windows platform today.
Re: TrueCrypt suggesting migration to BitLocker?
#376Back and forth speculation is great and all, but does anyone know of a solid alternative to TrueCrypt? Perferably open-source but at the very least not a potential government lap-dog like Microsoft?
tcplay - https://github.com/bwalex/tc-play - is truecrypt compatible but based on dm-crypt, afaik it's only compatible with Linux/BSD although for privacy-conscious individuals, few other operating systems make sense to run. Wild guess here but you might want to recreate any containers using tcplay and copy files over, rather than continuing to use possibly compromised truecrypt containers. For full-disk encryption L…
Given that we know nothing about the security of TrueCrypt at this point, can we really say that tcplay is safe? I am especially reluctant to use TrueCrypt to access tcplay containers using the TC gui. Thoughts?
Re: TrueCrypt suggesting migration to BitLocker?
#377Earlier quoted context omitted.
The element that does not square with any theories that suggest benevolent intent behind the change is the recommendation that users switch to Bitlocker. Surely, a Truecrypt developer who got served a gagging order to build in a backdoor would realise that a big and compliant target such as Microsoft would have been subject to the same measure long ago, and likewise that if a pre-existing vulnerability on a sufficien…
As crazy as it sounds, I think you're right and it's just the developer(s) quitting (rage-quitting?) the project. Nothing else makes sense. The Bitlocker thing seems strange until you realize that it probably really IS the best alternative for most users. The users who are paranoid enough to not trust Bitlocker can probably look out for their own security, so it makes sense to give instructions for the rest. None of…
> The Bitlocker thing seems strange until you realize that it probably really IS the best alternative for most users. The users who are paranoid enough to not trust Bitlocker can probably look out for their own security, so it makes sense to give instructions for the rest.
It seems odd to me that security specialists would recommend a flawed tool to 'the masses'. It just doesn't fit with what I usually read from people in this line of work.
Re: TrueCrypt suggesting migration to BitLocker?
#378Interestingly, an Infoworld review of the recent TrueCrypt audit [1] says: "One major issue was how compiling TrueCrypt from source required the use of an older Windows build environment that's noticeably out of date [...] using a shockingly old version of Microsoft Visual C++ released in 1993." Align this with what the TC website says now: "development of TrueCrypt was ended in 5/2014 after Microsoft terminated supp…
Yesterday my Windows XP virtual machine killed itself after a Software Update related to Malware Protection Center.
I will try to reinstall it today, and have VS 2008 running inside.
Re: TrueCrypt suggesting migration to BitLocker?
#379Re: TrueCrypt suggesting migration to BitLocker?
#380Earlier quoted context omitted.
My order of likelihood is #1. This is a canary. https://en.wikipedia.org/wiki/Warrant_canary
Do agencies like the NSA/FBI/etc have the power to make a company publicly lie against their will?
If you are ordered not to communicate something, you are ordered not to communicate it. Doing a "I'm not not telling you something, ha ha" might work on the playground, but not in real life.