Live data from Hacker News

Relaunched TrueCrypt site with original content and documentation

truecrypt71a.com

31–40 of 54 posts

Re: Relaunched TrueCrypt site with original content and documentation

#31
post #18

Earlier quoted context omitted.

Under Linux, what is the advantage of TrueCrypt/zuluCrypt over plain old LUKS? (which is automatically set up on any modern Linux Distro installation)

LUKS is an on-disk format where as TrueCrypt is both an on-disk format and an application.zuluCrypt is only an application that supports multiple on-disk formats so your question is not easy to answer since it mixes up different things. LUKS advantages over TrueCrypt is that it can support up to 8 different passwords and each password security can be fine tuned by a changeable pbkdf2 iteration count that is set per p…

"TrueCrypt [...] is that it can support two volumes(outer one and hidden one)"

afaik you can have as many hidden volumes you like on Truecrypt provided you have enough space.

Re: Relaunched TrueCrypt site with original content and documentation

#32
post #28

If I was concerned about my data, I wouldn't touch TrueCrypt with a 10 foot pole. More specifically I wouldn't touch Windows. Developers don't abruptly shut down projects. If there are problems with the code, they release statements and patches. If they lose interest in the project, they call it orphaned and ask for maintainers. If it's a mix of the two, they at least say so. But what happened with TrueCrypt was trul…

If they discovered an issue in Windows, and it led to gag orders, why would they tell people to move to BitLocker (a Microsoft product)?

This is obviously all conjecture, but my argument is that they made their actions as bizarre as possible because it's the only way to get out a distress call. They abruptly push a release that removes all the core functionality. They abruptly say that there will be no future releases. They wanted everyone to plainly see that this isn't them just giving up on the project because they've lost interest.

Suggesting people use Bitlocker is completely against everything they stand for. Here are some quotes off the FAQ on OP's rehosted website:

> > Will TrueCrypt be open-source and free forever?

> Yes, it will. We will never create a commercial version of TrueCrypt, as we believe in open-source and free security software.

> > Why is TrueCrypt open-source? What are the advantages?

> As the source code for TrueCrypt is publicly available, independent researchers can verify that the source code does not contain any security flaw or secret ‘backdoor’. If the source code were not available, reviewers would need to reverse-engineer the executable files. However, analyzing and understanding such reverse-engineered code is so difficult that it is practically impossible to do (especially when the code is as large as the TrueCrypt code).

> Remark: A similar problem also affects cryptographic hardware (for example, a self-encrypting storage device). It is very difficult to reverse-engineer it to verify that it does not contain any security flaw or secret ‘backdoor’.

These same people who condemned closed-source crypto in their FAQ are now suggesting using a closed-source encryption suite? It is completely absurd, and that's the point.

Re: Relaunched TrueCrypt site with original content and documentation

#33

Earlier quoted context omitted.

LUKS is an on-disk format where as TrueCrypt is both an on-disk format and an application.zuluCrypt is only an application that supports multiple on-disk formats so your question is not easy to answer since it mixes up different things. LUKS advantages over TrueCrypt is that it can support up to 8 different passwords and each password security can be fine tuned by a changeable pbkdf2 iteration count that is set per p…

"TrueCrypt [...] is that it can support two volumes(outer one and hidden one)" afaik you can have as many hidden volumes you like on Truecrypt provided you have enough space.

TrueCrypt's on-disk format specification is here[1] and it specifies only one hidden volume.

Look for documentation of header backups and you will see it speaks of only two headers,the header for the outer volume and the header for the hidden volume.

[1] https://www.truecrypt71a.com/documentation/technical-details...

Re: Relaunched TrueCrypt site with original content and documentation

#34
post #28

Earlier quoted context omitted.

If they discovered an issue in Windows, and it led to gag orders, why would they tell people to move to BitLocker (a Microsoft product)?

This is obviously all conjecture, but my argument is that they made their actions as bizarre as possible because it's the only way to get out a distress call. They abruptly push a release that removes all the core functionality. They abruptly say that there will be no future releases. They wanted everyone to plainly see that this isn't them just giving up on the project because they've lost interest. Suggesting peopl…

I think a more likely scenario might be that control of the project was seized, and the final release and statements were not from the developers, or they were issued by the developers under duress. It seems more like an agency wanted to shut it down because it worked too well.

Re: Relaunched TrueCrypt site with original content and documentation

#35
post #28

If I was concerned about my data, I wouldn't touch TrueCrypt with a 10 foot pole. More specifically I wouldn't touch Windows. Developers don't abruptly shut down projects. If there are problems with the code, they release statements and patches. If they lose interest in the project, they call it orphaned and ask for maintainers. If it's a mix of the two, they at least say so. But what happened with TrueCrypt was trul…

If they discovered an issue in Windows, and it led to gag orders, why would they tell people to move to BitLocker (a Microsoft product)?

I suspect that by recommending encryption software that is highly unreliable like Bitlocker (by virtue of being closed source and developed by Microsoft who we know cannot be trusted) they sent up a huge red flag to their user base.

Nobody would expect the TrueCrypt devs to recommend something like this, so it is immediately suspect and all anyone really needs to asusme something isn't right (like a gag order).

Re: Relaunched TrueCrypt site with original content and documentation

#36
post #21
post #18

Earlier quoted context omitted.

Under Linux, what is the advantage of TrueCrypt/zuluCrypt over plain old LUKS? (which is automatically set up on any modern Linux Distro installation)

Plausible deniability? With LUKS everyone can see your volume is encrypted; to avoid that you'd have to use plain dm-crypt/cryptsetup, randomize your drives (time consuming) and manage keys yourself (too much work).

Anyone can be pretty sure that your drive is encrypted rather than full of entropy, anyway.

Re: Relaunched TrueCrypt site with original content and documentation

#37
post #16
post #4

Earlier quoted context omitted.

They're your most realistic option right now. They are actively developing it and added things like newer algorithms (e.g. SHA2). There's CipherSched but that is basically a completely new program/rewrite which is very far from done. However, I don't agree with VeraCrypts choices. They've changed several things that make mounting slow (0,5s -> 10s), which is annoying, especially if you mistype the password. Providing…

Why would someone want to use Veracrypt but not have the increased security? Why not just use Truecrypt?

because people like actively development software. Sublime text is a good example of this.

Re: Relaunched TrueCrypt site with original content and documentation

#38
post #34

Earlier quoted context omitted.

This is obviously all conjecture, but my argument is that they made their actions as bizarre as possible because it's the only way to get out a distress call. They abruptly push a release that removes all the core functionality. They abruptly say that there will be no future releases. They wanted everyone to plainly see that this isn't them just giving up on the project because they've lost interest. Suggesting peopl…

I think a more likely scenario might be that control of the project was seized, and the final release and statements were not from the developers, or they were issued by the developers under duress. It seems more like an agency wanted to shut it down because it worked too well.

I refuse to believe we live in that unfree of a society. I know that we have FISA courts and so forth, but that's still a tier below preventing someone from continuing to publish their computer code. All the 90's cases surrounding cryptography as armaments cemented the notion that it's protected under the first amendment.

Re: Relaunched TrueCrypt site with original content and documentation

#39
post #37
post #16

Earlier quoted context omitted.

Why would someone want to use Veracrypt but not have the increased security? Why not just use Truecrypt?

because people like actively development software. Sublime text is a good example of this.

What new features is veracrypt adding that aren't security related?

Re: Relaunched TrueCrypt site with original content and documentation

#40
post #39
post #37

Earlier quoted context omitted.

because people like actively development software. Sublime text is a good example of this.

What new features is veracrypt adding that aren't security related?

I have no idea. People aren't always rational when it comes to their wants.
Post reply on HN