Would it be feasible to use encrypted docker containers as a cross-platform encrypted container solution?
True Goodbye: ‘Using TrueCrypt Is Not Secure’
151–160 of 249 posts
Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’
#152Earlier quoted context omitted.
I just don't quite understand the panic about microsoft not supporting XP anymore. It's not like that was a surprise announcement or even that the deadline was just met. It was April 8th....and TrueCrypt just now shut down in panic? ...Because XP support stopped??? WTF is going on? It's not even like support means anything, other than that they will no longer improve or fix it, i.e., there's still time to migrate awa…
>But that also seems odd since I am not quite sure that if TrueCrypt people were who we all want to believe they were, would suggest using bitLocker. bitLocker??? Alone that suggestion smells like rotten fish just by its association with MS and the US government. That's the canary. Not only is bitlocker backdoored, and most TrueCrypt users would know that, but they also say it is available on all windows versions, wh…
Isn't a canary something that is 'removed', not 'added'? As in, the canary warns by being absent.
Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’
#153Earlier quoted context omitted.
Your use of "demand" is misleading. Your own words at the time say "drafted sweeping legislation." Did that legislation pass? Anyone can "draft legislation." I can draft legislation right now. That doesn't make it U.S. law. Getting it passed is the hard part. Phone companies are required to enable wiretaps. But that happened through the public legislative process, and the legislation even lets the phone company bill…
We are talking about a government that has, in the recent past, sent nastygrams to people telling them that not only did they have to comply with the orders in the letter, but that it would be a crime to consult a lawyer about the letter. So you, a non-lawyer developer, get one of these letters. You are pretty damn sure it is a bluff (didn't that clause in NSLs get shot down? Pretty sure I heard something about that.…
This is pretty much why I said "If you want to hang a conspiracy theory on this news[1], find some hook besides Lavabit."
Linking an abuse like you describe to Lavabit only harms developers, who if they were to receive such an illegal demand might remember "wait, Lavabit was required to install back doors, right? I guess I have to, as well!"
Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’
#154Earlier quoted context omitted.
>1. 7.2 just disabled things. It didn't introduce a vulnerability. I had a look at the diff; I have neither the time nor crypto-specific skill to do an audit, but there are plenty of code changes that aren't warnings in there. >2. Warrant canary makes no sense. There is nothing for a warrant to grab. No, but they could have theoretically been asked to introduce a backdoor from a Lavabit-style order. >3. Forking is le…
been asked to introduce a backdoor from a Lavabit-style order This makes no sense. Lavabit was compelled to turn over evidence it told the government it had, which is straightforward law. There is nothing "Lavabit-style" about "distribute a back door or else." You would need explicit legislation to allow that. If the developer's cat was kidnapped to force him to put in a backdoor, there is nothing "Lavabit-style" abo…
> "There is nothing "Lavabit-style" about "distribute a back door or else." You would need explicit legislation to allow that."
http://en.wikipedia.org/wiki/Bullrun_(decryption_program)
No legislastion authorizes that program, among many others. I think what the parent was referring to as "Lavabit-style" was the "compromise your users or face legal action" move. Turning over customer data or introducing a backdoor are both means to the same end, as far as the NSA is concerned.
Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’
#155Earlier quoted context omitted.
It's more likely that they were angry that the audit got a lot of funds and they didn't. In OSS often the people who do the original work get nothing and all the money goes to pundits, packagers, and consultants.
If that were true, and they were so sure of the quality of their code then they'd keep going, wait for the all clear and say: "Look, we've been doing this for 10 years, our system is now independently audited, will you please support us..." I suspect that would have brought in a few dollars in the current climate.
They are humans, not all of which are objectivists. In fact Matthew Green himself has mentioned the possibility of insulting the developers:
http://blog.cryptographyengineering.com/2013/10/lets-audit-t...
Aren't you worried you'll insult the Truecrypt developers?
I sure hope not, since we're all after the same thing.
Remember, our goal isn't to find some mythical back door
in Truecrypt, but rather, to wipe away any doubt people
have about the security of this tool.
But perhaps this will tick people off. And if you're one
of the developers and you find that you're ticked, I'll
tell you exactly how to get back at us. Up your game.
Beat us to the punch and make us all look like fools.
We'll thank you for it.
I wonder what would happen if all original workers united and did the same as the Truecrypt people...
Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’
#156Are there any decent alternatives to TrueCrypt for Windows that aren't Bitlocker? http://superuser.com/questions/760091/windows-encrypted-virt...
For non-full disk I just make AES encrypted files using 7zip. Considering just about everyone has 7zip installed its actually less of a pain in the ass that you'd think. The only downside I see is that 7zip seems to be almost abandonware at this point. The installer linked at the top of their page is almost 4 years old and there's a recent beta but they haven't moved a beta to stable in a very long time.
Is there a good way to mount an encrypted 7z archive as a filesystem, for interactive usage?
That was the advantage of TrueCrypt, IMO. Not for FDE (I'm not a huge fan of FDE anyway), but because it created an interactive partition rather than forcing you to decrypt an entire archive to storage, work on it, and then re-encrypt the whole thing and cleanse the storage device you decrypted to.
It seems like putting something together that does that (which is really decrypt-to-RAM) wouldn't be that hard, but there are like a million file encryption tools but very few ones that allow for interactivity.
Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’
#157Earlier quoted context omitted.
Would this be a Lavabit-like situation? The governement asking for a backdoor and the developers are refusing it. Suddenly (while there is an audit), they quit everything, change the assemblies and the website, so users can get to another product... It seems weird that after 10 years of hard-work, they suddenly quit without further explanation.
If so, I would at least like to think they would have likely pointed people towards something which gives at least comparable security, rather than a backdoored product.
that's the point: by recommending BitLocker, they are communicating a message to us that they are under duress.
Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’
#158Earlier quoted context omitted.
been asked to introduce a backdoor from a Lavabit-style order This makes no sense. Lavabit was compelled to turn over evidence it told the government it had, which is straightforward law. There is nothing "Lavabit-style" about "distribute a back door or else." You would need explicit legislation to allow that. If the developer's cat was kidnapped to force him to put in a backdoor, there is nothing "Lavabit-style" abo…
> "There is nothing "Lavabit-style" about "distribute a back door or else." You would need explicit legislation to allow that." http://en.wikipedia.org/wiki/Bullrun_(decryption_program) No legislastion authorizes that program, among many others. I think what the parent was referring to as "Lavabit-style" was the "compromise your users or face legal action" move. Turning over customer data or introducing a backdoor ar…
> No legislastion authorizes that program, among many others.
No legislation forbids it either. If the NSA is legally able to search/seize a given piece of information why would you think they should not be allowed to forensically analyze it?
Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’
#159Earlier quoted context omitted.
This is a pretty confusing case, hard to make much of it, LavaBit 2 is of course a possibility. But while we're making these theories, I wanna sound my wild theory: Considering that: (1) TrueCrypt authors go to great to keep their identities hidden, and (2) it turns out TrueCrypt is not free/open software -- TrueCrypt is actually a project by some spooky 3-letter agency. But anyway, thoughts on alternatives? CiskCryp…
I really don't think we need to be running to TrueCrypt alternatives quite yet. If Phase II of the audit comes back showing TrueCrypt as insecure, then it's time to start worrying about that, but given that everyone was happy to keep using TrueCrypt up until 1 day ago even though it hasn't been updated in over 2 years, I don't think there's any big rush to switch to something else even if ongoing development stops.
"given that everyone was happy to keep using TrueCrypt up until 1 day ago"
The same was true for OpenSSL a few weeks ago.
One of the most plausible theories is that the TrueCrypt developers found a gaping security hole (ala OpenSSL) and realised that releasing a fix for it would reveal the bug and compromise every TrueCrypt partition in existence, so they chose to kill the project rather than risk the safety of all of that currently encrypted data.
If that scenario is true, there's a big rush to switch to something else before the bug is discovered by other researchers.
Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’
#160This seems highly suspicious, especially the recommendation of BitLocker, a product we have little to no evidence does what it says and after PRISM, have no reason to trust[2]; not to mention it being limited to a (very small subset of) Windows platforms vs. TrueCrypt's cross-platform functionality. If this was legit[1], it'd probably be directing people to one of the other TrueCrypt-like programs. [1]The new version…
> after PRISM
People seem to keep forgetting this (I'm sure it's simply unintentional), but PRISM was and still is nothing much more than an automated warrant/NSL compliance system.
You're basically saying that Microsoft is complicit in divulging information in response to specific requests made under specific legislative authorities, which was standard hat since even before Smith v. Maryland.