TrueCrypt suggesting migration to BitLocker?

Post by Adaptive » Wed, May 28, 2014, 8:30 PM UTC

simmerian wrote: post #107

Adaptive wrote: post #59

In order of likelihood: * Defaced site, timed to screw up a big announcement * Rogue content maintainer * Phase II of audit turned up something rather bad (edit: NO - see tptacek below) edit: Variations on "developer forced to do this" (cf simmerian's comment): * Developer was big brother all along and they are shutting it down * Security vuln about to be disclosed, dev scrambles to inform (albeit poorly) * Legally o…

* That's a lot of wasted effort for a defacement with seemingly no motive except some (uncredited) lulz. * Possible, but once again I see no motive that would produce this brand of outburst. * And it's unfixable? That would be a world first. I think it's much more plausible this is some powerful entity forcing a hand. We know by now there's plenty of motive and candidates to fit that shoe.

Post by pearjuice » Wed, May 28, 2014, 8:31 PM UTC

makmanalp wrote: post #110

sp332 wrote: post #99

Earlier quoted context omitted.

Here's the source code diff https://www.alchemistowl.org/arrigo/truecrypt-7.1a-7.2.diff....

Time to call in the underhanded C contest ( http://underhanded.xcott.com/ ) participants on a special bugfinding challenge :)

    AbortProcess ("INSECURE_APP");
    Print ("WARNING: Using TrueCrypt is not secure");

Post by CodeMage » Wed, May 28, 2014, 8:33 PM UTC

zorked wrote: post #89

Adaptive wrote: post #84

Earlier quoted context omitted.

Seems to point towards compromised SF account.

There's a new binary that recommends moving to BitLocker during install, and the signature matches. Edit: with a new, compromised key.

Post by kzrdude » Wed, May 28, 2014, 8:35 PM UTC

kmfrk wrote: post #88

david_shaw wrote: post #10

Well - this comes as a pretty big surprise. Is this real? Is there a known vulnerability that catalyzed this? Money from Microsoft? Threats? I'm not buying into conspiracy theories, but it does seem pretty out of place.

Matthew Green (@matthew_d_green) was involved in the audit. Follow him for what's what.

Post by philtar » Wed, May 28, 2014, 8:40 PM UTC

owlmanatt wrote: post #118

Alupis wrote: post #81

Earlier quoted context omitted.

That would not result in a message of "True Crypt Is Not Secure!!!!" in bold red. Seems to be geared towards frightening people. I concur -- likely an elaborate website deface.

That's not what the message says, though. > WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues That is a perfectly reasonable thing to say if you are abandoning security software. Any issues discovered will not be fixed, so you should stop relying on this software for security.