TrueCrypt suggesting migration to BitLocker? • Hacker News Board

Re: TrueCrypt suggesting migration to BitLocker?

#321

Post by tacotime » Thu, May 29, 2014, 4:28 AM UTC

Cairn wrote: post #316

BoppreH wrote: post #295

- Signature is valid, so it's not a defacement. ( http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_dev... ) - The version there works and does not seem to have a trojan, so probably not a regular hacker. ( https://news.ycombinator.com/item?id=7813373 ) - Instructs to migrate to dubious alternatives, so it's not a legit security effort. - License change, precise instructions and decrypt-only version indicate i…

If I were to wager a non-crazy, Occam's Razor-compatible bet, I'd say the author had a bad day, saw one too many digs at the quality of their decade-long work, got pissy, and decided to call it quits. I love popcorn-munching news as much as anyone, but this probably isn't it.

Then why pour so much work into re-authoring and re-releasing the program for all os's? And why offer such a canned bullshit explanation like the end of the availability of windows xp? All to show the trolls how much they miss truecrypt now that it's gone? I don't think so... anyone can find an old cloned repo/bin. I don't think it's impossible but it doesn't sit right with me that someone who could write/manage a program as objectively beneficial to society as truecrypt could also write such horrid bullshit that stands against every principal of FOSS. That being said, I've witnessed lives torn apart by depression first hand and it can be easy to idealize a person you've never even met so who really knows.

Re: TrueCrypt suggesting migration to BitLocker?

#322

Post by MichaelGG » Thu, May 29, 2014, 4:29 AM UTC

enscr wrote: post #320

If I take this message at face value and decide to switch to BitLocker, can someone answer this. Dropbox + Truecrypt take full advantage of block sync & block encryption i.e. if a tiny piece of data is modified inside an encrypted container, only the relevant blocks are synced on update. Dropbox does not need to sync the entire container each time. This is a very useful feature. I know Google Drive & OneDrive aren't…

Bitlocker is block based, too. It uses a diffuser keyed off the sector to serve in lieu of an IV. So block-based sync software should work just as well on it.

Re: TrueCrypt suggesting migration to BitLocker?

#323

Post by [deleted] » Thu, May 29, 2014, 4:30 AM UTC

wielebny wrote: post #319

BoppreH wrote: post #313

Earlier quoted context omitted.

Are you sure? He does say "binaries when run make no unexpected...". And matching binaries is not a trivial task because of OS, compiler and SDK versions. The last time someone did this for Truecrypt it made the news: https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binarie...

Binaries could have code that will activate in future.

[deleted]

Re: TrueCrypt suggesting migration to BitLocker?

#324

Post by l0stb0y » Thu, May 29, 2014, 4:34 AM UTC

TrueCrypt, like most other encryption software, has a back door. I'm fine with that. I encrypt to keep my data safe from stolen hardware not government or law enforcement. Obviously I have no proof but I've always believed that TrueCrypt, along with TOR, was developed by a US government agency to create a false sense of security in targets.

There is no electronic privacy, there never has been.

It's perfectly plausible that we're reaching a saturation point and society will start shying away from over-sharing online. A return to offline cash purchasing and face-to-face conversations would be a positive change in my eyes.

Re: TrueCrypt suggesting migration to BitLocker?

#325

Post by MichaelGG » Thu, May 29, 2014, 4:40 AM UTC

roadnottaken wrote: post #296

rian wrote: post #269

If you're looking for actively developed cross platform free software alternative: http://www.getsafe.org/

Can anyone else comment on the viability of this option? It seems pretty nice, from the website, but I'd like to hear more about it's reputation in the security community.

GetSafe was discussed a few times on HN. A potentially interesting thread: https://news.ycombinator.com/item?id=7588497

It is not full disk encryption, so not a direct alternative for a product like TrueCrypt. I believe it uses a RAM disk for the files so you're limited in size, too - something like that.

Personally I'm not a big fan of using WebDAV to expose the encrypted file system - it seems like a large liability. But I'm not a real security expert at all, just saying it sounds complicated to get right (caching could keep a unencrypted copy) and exposes an even larger attack surface.

Re: TrueCrypt suggesting migration to BitLocker?

#326

Post by npsimons » Thu, May 29, 2014, 4:43 AM UTC

vertis wrote: post #315

BoppreH wrote: post #312

Earlier quoted context omitted.

Why have dozens of steps and seventeen screenshots detailing how to migrate a Windows partition and only a joke line for the Linux version? And why Bitlocker? Then there was the license change, new version with different features... This imbalance of effort strikes me as incredibly odd if the author was merely rushed.

Linux users can be trusted to work things out for themselves?

I'll wager most Linux users don't even use TrueCrypt, since we've had FDE in the form of LUKS/DMcrypt since forever, and could not give a damn about being able to read those partitions from other OSes (as if! Since when do Windows and OSX support Linux filesystems? it's always been the other way around).

Re: TrueCrypt suggesting migration to BitLocker?

#327

Post by cr4zy1 » Thu, May 29, 2014, 4:48 AM UTC

I just hope that light will be shed on this sometime soon so the speculation will stop. If you guys have looked at the audits you can see that if there are any ones that can cause harm you need administrator level access, and by that point why try to break into truecrypt by screwing with volume headers when you could just install a bloody ASM keylogger and call it a day.

I honestly think that the government is behind this fiasco, nobody just ups and leaves a massive project used by millions without leaving a valid note.

Re: TrueCrypt suggesting migration to BitLocker?

#328

Post by alextgordon » Thu, May 29, 2014, 4:49 AM UTC

lelandriordan wrote: post #264

alextgordon wrote: post #131

Earlier quoted context omitted.

...or that BitLocker isn't.

I know everyone likes to bash MS around here but is there any actual proof of Bitlocker's insecurity that is more recent than 2008? If you look at wikipedia it seems like the only known real vulnerability requires someone with physical access to boot via USB into another OS within a few minutes of turning the computer off. When is this a real risk for anyone? I am not a security expert but unless you are doing things…

Put it this way. There's no proof that BitLocker is any more effective than rot13.

Re: TrueCrypt suggesting migration to BitLocker?

#329

Post by tacotime » Thu, May 29, 2014, 4:49 AM UTC

Zancarius wrote: post #303

quasque wrote: post #193

Earlier quoted context omitted.

It may be the same strong sense of ownership and control that precluded the liberalisation of Truecrypt's license during its lifetime in the past decade.

Your reply seems to be the most sensible out of the lot. (Side note: I presumed there'd be a couple other ones that suggested it's open source--never mind that prior to the removal of some of the license text it wasn't "free as in beer" open. To be fair, I had forgotten myself that TrueCrypt wasn't exactly open source.) Perhaps ownership does run deep, even if you've never really released a product for money and it's…

The one thing I have to add. Maybe by taking this route, the author(s) hope to inspire others to see the obvious need for a project like truecryp more dramatically. It's not like old bin/source repos aren't available in 100 different locations across the net; if you need the program you can get it. But this action does send a strong message and it's that there is no adequate existing cross-platform solution to this problem outside of trusting your os or using (not so plausibly deniable) file archives. I'd like to think that the author(s) are trying to highlight the necessity while secretly cheering on the next generation of trucrypt.

Re: TrueCrypt suggesting migration to BitLocker?

#330

Post by usefulcat » Thu, May 29, 2014, 4:51 AM UTC

BoppreH wrote: post #308

BoppreH wrote: post #295

- Signature is valid, so it's not a defacement. ( http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_dev... ) - The version there works and does not seem to have a trojan, so probably not a regular hacker. ( https://news.ycombinator.com/item?id=7813373 ) - Instructs to migrate to dubious alternatives, so it's not a legit security effort. - License change, precise instructions and decrypt-only version indicate i…

infosecslave said in a dead comment: [...] you have to consider the fact that Truecrypt project was started before FDE was popular, maybe their goal all this time was to popularize such encryption. With XPs demise that goal would have been achieved as every current Windows version comes with Bitlocker. Your comment is dead but makes a lot of sense, especially in light of the message on the website: The development of…

"..as every current Windows version comes with Bitlocker."

It's only available in Ultimate and Enterprise Vista/Win7 and Pro/Enterprise versions of Win8. Lots of machines ship(ped) with only Win7 Home Premium or vanilla Win8.