241–250 of 414 posts
Earlier quoted context omitted.
There's a "TrueCrypt Foundation" key on the keyservers from 2004, the ID is E3BA73CAF0D6B1E0.
The time stamp on key servers can not be trusted. Anyone can spoof keys in anyone elses name, with any timestamp they want. The only way to verify is if you have the previous key stored somewhere, or can find a trustpath to it.
E3BA73CAF0D6B1E0 C5F4 BAC4 A7B2 2DB8 B8F8 5538 E3BA 73CA F0D6 B1E0
Checks out.
Earlier quoted context omitted.
As far as I know, its license is incompatible with other open source licenses due to an advertising clause (all derivative works have to state "based on Truecrypt" somewhere in the documentation or via use of the software). The old four clause BSD license had a similar issue.
One of the changes in the newly-uploaded version is indeed a change in the license.
However it's unclear if this change is only for Truecrypt 7.2 or can be applied retrospectively to previous versions. As the authors have deleted sizeable portions of the encryption code in this final version, such ambiguity could be problematic.
Providing some details from SourceForge: 1. We have had no contact with the TrueCrypt project team (and thus no complaints). 2. We see no indicator of account compromise; current usage is consistent with past usage. 3. Our recent SourceForge forced password change was triggered by infrastructure improvements not a compromise. FMI see http://sourceforge.net/blog/forced-password-change/ Thank you, The SourceForge Team…
2. We see no indicator of account compromise; current usage is consistent with past usage. I'm calling BS. This site was disabled repeatedly for exceeding bandwidth today. I find it hard to believe traffic is as usual.
[kinda disappointed that, despite arriving so late to this thread, no-one seems to have said this.]
If this is true it's time to fork I guess. Though I remember TC having a weird license. Anyone knows to what extent TC would be forkable?
One thing I have noticed is that the version they have on this site is 7.2, and if I remember this correctly, it was 7.1a that was on the truecrypt.org (checked a few days ago...) So they've put up a new version and telling us it's for migration only?
Earlier quoted context omitted.
Same key as the previous binaries? I doubt it, given that the keys were replaced mere 3 hours before the new binaries were published: http://sourceforge.net/p/truecrypt/activity/?page=0&limit=10...
Anyone have key fingerprints for pub keys used for the 7.1a vs 7.2 signing? Preferably pub key from a while ago I guess.
Earlier quoted context omitted.
Wouldn't they just have to published a signed message stating that the change was not theirs and the key is compromised? Or better yet, revoke the key? If two groups with opposing messages control the key, it's pretty clear that the key is compromised in some manner.
No, because the suggested "hackers" have published a signed message.
Earlier quoted context omitted.
What if this is an attempt to smoke out the TrueCrypt devs? While this move seems odd, the new binaries are properly signed and the domains have been updated accordingly. If this was another project, like Rails, the maintainer could come out and say they were hacked and the last good version was X. Otherwise, the project would likely die off. But since we know so little about the TrueCrypt maintainers, there's little…
Wouldn't they just have to published a signed message stating that the change was not theirs and the key is compromised? Or better yet, revoke the key? If two groups with opposing messages control the key, it's pretty clear that the key is compromised in some manner.