My opinion, the fact that some security researcher was going to be getting more money than the actual developer ever made off the project must have been infuriating. I think that's good enough reason to burn the project to the ground.
TrueCrypt must not die
91–100 of 103 posts
Re: TrueCrypt must not die
#92I don't believe the TrueCrypt license allows this kind of redistribution, does it? Then again, with anonymous developers and unknown jurisdiction, it may be moot.
It says derived programs shouldn't be called "TrueCrypt" and shouldn't be ascribed to the original publishers, which honestly seem like pretty mild requirements. https://github.com/warewolf/truecrypt/blob/33c0b8457051796fa...
The Truecrypt licenses also say that it cannot be sold, which makes it non-free and non open source. The OSI even said, "it is not at all appropriate for [TrueCrypt] to describe itself as 'open source.'"
http://www.infoworld.com/d/open-source-software/truecrypt-or...
Re: TrueCrypt must not die
#93Honestly, I was hoping this drama would result in the implementation of hidden containers for other crypto solutions (dm-crypt, etc). Hopefully that may still happen.
The FAQ for cryptsetup states: https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQue... This means that if you have a large set of random-looking data, they can already lock you up. Hidden containers (encryption hidden within encryption), as possible with Truecrypt, do not help either. They will just assume the hidden container is there and unless you hand over the key, you will stay locked up. Don't have a hi…
Hidden containers perhaps won't be enough to protect you from being locked up, but that is not always their purpose. One purpose of hidden containers is to make the presence of information hidden from the attacker. They may lock you up, but they will never really know if you had encrypted information or not. That means you win something.
Re: TrueCrypt must not die
#94Re: TrueCrypt must not die
#95Honestly, I was hoping this drama would result in the implementation of hidden containers for other crypto solutions (dm-crypt, etc). Hopefully that may still happen.
The FAQ for cryptsetup states: https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQue... This means that if you have a large set of random-looking data, they can already lock you up. Hidden containers (encryption hidden within encryption), as possible with Truecrypt, do not help either. They will just assume the hidden container is there and unless you hand over the key, you will stay locked up. Don't have a hi…
I think that's a very narrow view.
It assumes there are only two possibilities, either you live in a "free country" where you can refuse to hand over the key, or you live in a totalitarian state where the police will decide to beat you if they suspect you have crypto software, and will keep doing so no matter what you say.
There is a lot of middle ground there. For example in the UK, I believe you are legally required to provide the decryption password. But I don't think the police there would be likely to beat you if they think you may have a hidden container. They could argue that they believe you do, and you would respond with "prove it!", and I doubt it would go any further (unless they had some evidence that you specifically were using hidden containers).
There is value in hidden containers in some circumstances. It's disappointing to see the cryptsetup maintainers take this position.
Re: TrueCrypt must not die
#96Earlier quoted context omitted.
That's a fine attitude for normal code, but crypto is a whole different ball game. Linux security was significantly reduced at one point because somebody changed int i to int i=0 , something most developers would thing is a positive. Side channel attacks are extremely easy to create and extremely hard to find. And, unfortunately, the "many eyes" thing doesn't work here because it requires experienced, knowledgable ey…
> Linux security was significantly reduced at one point because somebody changed int i to int i=0 Could you please elaborate on this one?
It's been a while. I should have restricted it to Debian: http://jblevins.org/log/ssh-vulnkey
Re: TrueCrypt must not die
#97Earlier quoted context omitted.
I have much doubt about that since BitLocker is certainly not good enough: https://twitter.com/stevebarnhart/status/472195239005147136 And why not just writing that you no longer feel motivated to continue the further development of your software? It is very common after all …
The developer(s?) who made TrueCrypt did it for their own reasons. They didn't necessarily do it because they wanted to "stop teh NSA." A lot of people who wanted to "stop teh NSA" started using TrueCrypt, and so they assumed that their goals lined up with TrueCrypt's. But maybe they didn't. Maybe the developer using TrueCrypt was perfectly happy with "defend against anyone short of the NSA, especially since the NSA…
At what point did you answer that simple question of - well why didn't they just say they are not motivated to continue the project any longer, but instead say Truecrypt is not secure.
Re: TrueCrypt must not die
#98My opinion, the fact that some security researcher was going to be getting more money than the actual developer ever made off the project must have been infuriating. I think that's good enough reason to burn the project to the ground.
or not start it at all
Re: TrueCrypt must not die
#99Earlier quoted context omitted.
The developer(s?) who made TrueCrypt did it for their own reasons. They didn't necessarily do it because they wanted to "stop teh NSA." A lot of people who wanted to "stop teh NSA" started using TrueCrypt, and so they assumed that their goals lined up with TrueCrypt's. But maybe they didn't. Maybe the developer using TrueCrypt was perfectly happy with "defend against anyone short of the NSA, especially since the NSA…
At what point did you answer that simple question of - well why didn't they just say they are not motivated to continue the project any longer, but instead say Truecrypt is not secure.
I'm not sure you can apply Occam's Razor here. You will only break your blades as you search for a simple answer.
Maybe he was pissed.
Maybe he really didn't want to support it any more, and would feel really bad if people's stuff got compromised on his watch, so he wanted everyone to stop using his stuff as hard as possible.
Re: TrueCrypt must not die
#100if the developers of Truecrypt are anonymous and the license doesn't allow something like this, would this allow us to find out who the developers are if they sue?
If they sued, yes, they would have to reveal themselves. One of the developers got dox'd recently, which may have something to do with shutting the project down. (https://translate.google.com/translate?sl=ru&tl=en&js=y&prev...)