341–350 of 414 posts
Earlier quoted context omitted.
My order of likelihood is #1. This is a canary. https://en.wikipedia.org/wiki/Warrant_canary
Do agencies like the NSA/FBI/etc have the power to make a company publicly lie against their will?
Interestingly enough, they also changed the TrueCrypt license. -TrueCrypt License Version 3.0 +TrueCrypt License Version 3.1 This lead me to think about the legal implications of changing a software license using stolen signing keys, when signing keys are all that you have to verify that the software is official (such is the case with TrueCrypt and its anonymous authors). If the license is changed, and the package is…
hurrah, they removed the obnoxious advertising clause.
Suppose that the author received a secret order from a secret court that required the author keep secret the secrecy of the secret order from the secret court. Furthermore, the author was secretly required to turn over his secret signing key to a secret third party. If you were the author, what would you do? Consider your options. One is that you could issue an update with a warning that the program is no longer secu…
Earlier quoted context omitted.
Binaries could have code that will activate in future.
If you have a copy of the source that you've vetted, and you can compile it in such a way that the resulting binary is a bit-for-bit match of the developer released binary, then you know that either there is no future-activation code or you missed it in your review or your compiler was itself compiled maliciously with the intent of inserting malicious code into that exact version of truecrypt every time it was compil…
- Signature is valid, so it's not a defacement. ( http://www.reddit.com/r/netsec/comments/26pz9b/truecrypt_dev... ) - The version there works and does not seem to have a trojan, so probably not a regular hacker. ( https://news.ycombinator.com/item?id=7813373 ) - Instructs to migrate to dubious alternatives, so it's not a legit security effort. - License change, precise instructions and decrypt-only version indicate i…
infosecslave said in a dead comment: [...] you have to consider the fact that Truecrypt project was started before FDE was popular, maybe their goal all this time was to popularize such encryption. With XPs demise that goal would have been achieved as every current Windows version comes with Bitlocker. Your comment is dead but makes a lot of sense, especially in light of the message on the website: The development of…
Earlier quoted context omitted.
The binaries are properly GPG-signed with the same key as the previous binaries, check for yourself. [They] either compromised their private key too or the actual developer(s) did this. Be it voluntarily or by force of secret three-character agencies / a massive pay check.
If this is a hack, then the truecrypt.org site (or dns) and sourceforge site are both compromised, suggesting a dev got hacked who would have had access to both, and perhaps the TC signing key as well (not everyone practices good signing key hygiene, like keeping it offline, even for important software projects). Even if it's a legit announcement, I wouldn't run that 7.2 binary. Anyone running truecrypt already has t…
I frequently reformat my boot volumes—but I've had a .tc file laying around on an external HD since forever, with my websites' X.509 private keys and such inside.
I'm probably going to do exactly as this announcement says: download the export-only binary, create a loop-mounted LUKS volume, and migrate everything over.
Earlier quoted context omitted.
Maybe something like the Lavabit scenario where they rather close the shop than sell their users out. On the other hand, proposing Bitlocker as an alternative would be rather suspect in that case.
IF THIS IS THE CASE and that's an IF then it seriously brings into suspect backdoors in larger proprietary software. Because really if they're going after trucrypt then they have to already have gone after the big players. I'm not going to jump the gun just yet but after snowden it's not out of the question.
edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microsoft.com/en-AU/windows-8/bitlocker-recov...
In order of likelihood: * Defaced site, timed to screw up a big announcement * Rogue content maintainer * Phase II of audit turned up something rather bad (edit: NO - see tptacek below) edit: Variations on "developer forced to do this" (cf simmerian's comment): * Developer was big brother all along and they are shutting it down * Security vuln about to be disclosed, dev scrambles to inform (albeit poorly) * Legally o…
It could be that they've simply lost interest in developing it. It's quite the ongoing responsibility, and they may well be tired of working on it - a decade is a long time in anyone's life. If this is true, then perhaps such listlessness was also catalysed by the ongoing audit. Maybe seeing such a mass of crowdfunding income towards a project to pick Truecrypt apart, in contrast to the scant donations to its develop…
It was developed in almost total secrecy, with binaries and code being tossed over the wall once in a while, provided under a non-OSI license.
I built it from source a few times, but Truecrypt was used by a lot of people, far beyond the developer community, people who totally lacked the technical skill needed to compile it. SO it's a safe bet the majority just used those binaries. And those binaries actually changed without warning more than once, independent of the version changing. That alone bred suspicion and fueled the demand for an audit.
The behavior of the developers (and their total lack of a public presence, regardless of the reason) may have also discouraged donations. Same with the behavior of the forum moderators, whoever they were.
Earlier quoted context omitted.
If it was operator error during the development of a Dead-Man's-Switch, the developer will probably come out in public explaining the situation and apologizing. And if this is a Dead-Man's-Switch gone right , why are they advocating the use of BitLocker and searching for random Linux packages? Edit: is "coming out in public" the correct term here? I have a feeling it only applies to closet-like scenarios.
If it was a hastily constructed DMS (such as in the event of imminent threat), the author may not have had time to research and test a comparable Linux alternative. If you knew that something bad could happen, you would work as fast as possible to set it up, rather than risk not being able to have anything working in time. The reason why is quite simple: if a malicious third party were to raid or steal the private ke…
Let's assume that this is a faulty DMS that was slapped together due to imminent threat by state actors. If these state actors were sufficiently powerful, couldn't they instead press ahead anyway with obtaining the developer's private keys, account data, etc., while publicly parading either the real developer (or an actor) in front of the spotlight briefly enough to claim that this was all a mistake? Next, release another series of new versions (with backdoors) that are fully controlled by the state actor under the guise that they're perfectly okay.
Of course, this would itself be easily defeated by either examining the history of the individual who claims to be the developer (if applicable) and through some scrutiny of the new binaries, although I'd imagine the latter would be anticipated by the actors behind the charade.
The closest thing in my mind that this resembles is a warrant canary as someone else pointed out earlier today. I suppose that in effect the DMS and canary achieve roughly the same goal so perhaps I'm just splitting hairs at this point. I also don't see either of these scenarios working perfectly except to warn people who are themselves already somewhat paranoid.