Back and forth speculation is great and all, but does anyone know of a solid alternative to TrueCrypt? Perferably open-source but at the very least not a potential government lap-dog like Microsoft?
one thing's for sure - bitlocker isn't it.
TrueCrypt suggesting migration to BitLocker?
181–190 of 414 posts
Re: TrueCrypt suggesting migration to BitLocker?
#182I'll leave others more knowledgeable in such things to comment on the legitimacy of this, but one practical thing I'll note: the assertion on the site that Windows Vista/7/8 has support for encrypted disks is only half true. Quoting from Wikipedia [1] "BitLocker is available in the Enterprise and Ultimate editions of Windows Vista and Windows 7. It is also available in the Pro and Enterprise editions of Windows 8."
Since a lot of domestic users will be using Home or Home Premium versions of Windows, and as one of those users who uses Truecrypt for full disk encryption, this does not leave us with as easy a migration path as this site now suggests.
[1] https://en.wikipedia.org/wiki/BitLocker_Drive_Encryption
Re: TrueCrypt suggesting migration to BitLocker?
#183[deleted]
The first time around you curled "www.trucrypt.org" (note the missing "e") and it went to a domain parking service (findingresult.com).
The second time you went to the real "www.truecrypt.org", which is the real domain that now redirects to SF.
Re: TrueCrypt suggesting migration to BitLocker?
#184[deleted]
Are you sure about the domain www.trucrypt.org ? there's a typo there, no?
Re: TrueCrypt suggesting migration to BitLocker?
#185Earlier quoted context omitted.
There's a new binary that recommends moving to BitLocker during install, and the signature matches. Edit: with a new, compromised key.
Project on SF is still available if you have a direct link: http://sourceforge.net/projects/truecrypt/files/TrueCrypt/ http://sourceforge.net/projects/truecrypt/?source=navbar http://sourceforge.net/p/truecrypt/activity/?page=0&limit=10... Odd, 6 hours ago someone updated the TruCrypt-key.asc files, then 3 hours later posted all the new binaries. Also odd is whoever posted the new binaries completely yanked all the p…
Looks like it's the same key as before (F0D6B1E0)
Re: TrueCrypt suggesting migration to BitLocker?
#186In order of likelihood: * Defaced site, timed to screw up a big announcement * Rogue content maintainer * Phase II of audit turned up something rather bad (edit: NO - see tptacek below) edit: Variations on "developer forced to do this" (cf simmerian's comment): * Developer was big brother all along and they are shutting it down * Security vuln about to be disclosed, dev scrambles to inform (albeit poorly) * Legally o…
It could be that they've simply lost interest in developing it. It's quite the ongoing responsibility, and they may well be tired of working on it - a decade is a long time in anyone's life.
If this is true, then perhaps such listlessness was also catalysed by the ongoing audit. Maybe seeing such a mass of crowdfunding income towards a project to pick Truecrypt apart, in contrast to the scant donations to its development, disheartened the authors towards further work?
Abandoning it in this rather dramatic way ensures that Truecrypt's users are warned against using unsupported software where any bugs will remain unfixed. This is especially important when such bugs revealed in the future (and maybe ones already known) have the possibility of being deleterious for security.
Re: TrueCrypt suggesting migration to BitLocker?
#187In order of likelihood: * Defaced site, timed to screw up a big announcement * Rogue content maintainer * Phase II of audit turned up something rather bad (edit: NO - see tptacek below) edit: Variations on "developer forced to do this" (cf simmerian's comment): * Developer was big brother all along and they are shutting it down * Security vuln about to be disclosed, dev scrambles to inform (albeit poorly) * Legally o…
It could be that they've simply lost interest in developing it. It's quite the ongoing responsibility, and they may well be tired of working on it - a decade is a long time in anyone's life. If this is true, then perhaps such listlessness was also catalysed by the ongoing audit. Maybe seeing such a mass of crowdfunding income towards a project to pick Truecrypt apart, in contrast to the scant donations to its develop…
If you're developing a free product and you're going to throw in the towel anyway, why not just open up the sources with a liberal license and/or hand the project over to someone else who's willing to carry the torch.
Re: TrueCrypt suggesting migration to BitLocker?
#188In order of likelihood: * Defaced site, timed to screw up a big announcement * Rogue content maintainer * Phase II of audit turned up something rather bad (edit: NO - see tptacek below) edit: Variations on "developer forced to do this" (cf simmerian's comment): * Developer was big brother all along and they are shutting it down * Security vuln about to be disclosed, dev scrambles to inform (albeit poorly) * Legally o…
The element that does not square with any theories that suggest benevolent intent behind the change is the recommendation that users switch to Bitlocker. Surely, a Truecrypt developer who got served a gagging order to build in a backdoor would realise that a big and compliant target such as Microsoft would have been subject to the same measure long ago, and likewise that if a pre-existing vulnerability on a sufficien…
[deleted]
Re: TrueCrypt suggesting migration to BitLocker?
#189Earlier quoted context omitted.
People who create security software are always targeted by governments, and a lesser extent hackers. Truecrypt devs who remain anonymous can produce software in a much safer environment. Just like Satoshi. Code can speak for itself.
> Code can speak for itself. The constant open source mantra of "code speaks for itself" strikes again.. except that none of the competent eyeballs have looked at truecrypt up until very recently (phase 1 audit ended in April 2014 which is ten years after the first truecrypt release). A lot of good did it do with OpenSSL too. But surely, code written by anonymous, untrustworthy developers that hasn't been looked at m…
> As for "being targeted by government" that's called conspiracy theories.
This is already happening and not a conspiracy theory any more:
[0] http://nakedsecurity.sophos.com/2012/06/08/interest-in-crypt...
[1] http://www.cnet.com/news/researcher-detained-at-u-s-border-q...
Re: TrueCrypt suggesting migration to BitLocker?
#190So... the best course is likely a bit of patience. However, is there any way to establish some trustworthy mirrors of 7.1a for those who need it while this is still in the course of blowing over? (I'm just bringing up some new machines, myself -- I'll have to hunt a bit for local copies from the last time I downloaded (legitimate copies of) the 7.1a version.) -- P.S. For two recognizable names/sites (to me, at least)…
Just checked - i have 7.1a source + windows installer. Securely encrypted on a truecrypt volume. So I baked them up a few times.
In a few days there will be some information and possibly a fork.