TrueCrypt gone...

[StrangeLife]

TrueCrypt gone... or maybe not.

I generally don't trust commercial proprietary software for my privacy needs.

It's not that I suspect the large vendors of nefarious practices - they have their good names and reputations to protect - but thanks to Snowden we now know that they can be (and often are) compelled by a government to facilitate access to users private information... and at the same time be legally forbidden to disclose that they have done so. Some have fought back - Lavabit being a prominent example - but if you want to do business as a commercial enterprise you cannot fight the government. Resistance is futile. You can protest, you can be difficult, you can hire every lawyer in the phone book but eventually you'll lose.

Logically it is highly likely that there are back-doors in any closed source security product.


The solution is Open Source of course. If everybody can see what the code looks like it's damned hard to put a back-door in without getting noticed. Even if you aren't able to analyze code, you can be sure that thousands of code-geeks are doing it on a constant basis. The product I have always relied on in this regards is TrueCrypt. Powerful, Open Source, free, available on any platform, long history of reliability and security, approved by Bruce Schneier himself, no affiliation with any commercial vendor - the perfect encryption solution. Except...

ITS GONE!

The 28th of May the website changed to some lame explanation (they blame it on MS not supporting XP and "security issues" bla bla bla) and apparently nobody knows what the fuck happened. TrueCrypt has long been a thorn in the side of government agencies - was it shut down in the same way as Lavabit? Did the mysterious developers choose to pull the plug rather than cooperate with the state? In any event this is a major blow to privacy. And I don't really have any idea as to which trustworthy alternative product we can use.

But if any of you guys are TrueCrypt users too, now you know....

http://images.lazygamer.net/2013/03/this-sucks.jpg

 

[unregistered]

 

[StrangeLife]

- Update.


Seems like another developer group is picking up TrueCrypt.

It is interesting that the site is now located in Switzerland. That reinforces my suspicion that the whole thing is the result of a failed governmental intervention in the US. Well, what is there to say, except....

SUCK IT NSA

 

[unregistered]

 

[StrangeLife]

Right on! Will they support earlier versions of TrucCrypt or will one have to upgrade?

For now version 7.1a should be safe enough to use. Even Steve Gibson can't find anything wrong with it, and I trust him. Chances are that the developers got presented with a National Security Letter and chose to pull the plug rather than go on with the state looking over their shoulders.

But don't get version 7.2 from the official site - it's crippled and will only de-crypt.

 

[unregistered]

 

[islandman]

There are already "alternatives" coming out of devs in Russia. One such torrent has over 12K seeders....

There's a sucker born every minute.

 

[StrangeLife]

There are already "alternatives" coming out of devs in Russia. One such torrent has over 12K seeders....

There's a sucker born every minute.

Yeah a lot of critters are coming out of the woodwork attempting to use the situation to their advantage. I wish the TrueCrypt people had orchestrated their departure a little different. There is no indication that version 7.1a is compromised in any way - it has been out since 2012 and just passed an independent security review with flying colors. It has stood the test against against legal threats on several occasions to the point where we can be fairly certain that if you pick a good passphrase none of the three-letter agencies can get at your data (but they can of course still put you in jail until you hand it over voluntarily).

So we should definitely stick with 7.1a for now.

Steve Gibson's theory is, that the developers simply got fed up with the project. It's 10 years old so if they started when they were in their twenties, they're in their thirties now and probably have careers, families and so on. With Windows 8 MS is moving to GBT partitioning which TrueCrypt doesn't support and it would probably require a fair bit of work to adapt it. I guess that makes sense.

But I still like the conspiracy theory that they have been compelled by the NSA better

 

[islandman]

Yeah a lot of critters are coming out of the woodwork attempting to use the situation to their advantage. I wish the TrueCrypt people had orchestrated their departure a little different. There is no indication that version 7.1a is compromised in any way - it has been out since 2012 and just passed an independent security review with flying colors. It has stood the test against against legal threats on several occasions to the point where we can be fairly certain that if you pick a good passphrase none of the three-letter agencies can get at your data (but they can of course still put you in jail until you hand it over voluntarily).

So we should definitely stick with 7.1a for now.

Steve Gibson's theory is, that the developers simply got fed up with the project. It's 10 years old so if they started when they were in their twenties, they're in their thirties now and probably have careers, families and so on. With Windows 8 MS is moving to GBT partitioning which TrueCrypt doesn't support and it would probably require a fair bit of work to adapt it. I guess that makes sense.

But I still like the conspiracy theory that they have been compelled by the NSA better

The truth is likely a mixture of the two.

Seems as though good open-source is getting harder and harder to find. It's a shame, though I understand the desire to get paid for your work.

 

[StrangeLife]

...,though I understand the desire to get paid for your work.

If this is indeed part of the motivation, it's because they don't take proper advantage of the community.

I would totally throw a few bucks their way if they went on Indiegogo, Kickstarter or Patreon to raise funds for a Windows 8 version and so would a lot of others, I bet. I mean, Will Wheaton just raised over a million bucks for season 3 of Table Top and the guys auditioning TrueCrypt had $46,000 in the bag in no-time, which was twice the number they asked for. I dare hardly speculate how much a campaign for a version 8 of TrueCrypt would generate, but I would be surprised if the amount didn't reach 7 digits pretty fast.

The caveat is of course that they would need to come out of their anonymity in order to do it...


http://0-media-cdn.foolz.us/ffuuka/board/vp/image/1381/91/1381917999340.jpg

 

[about_average]

Not sure how the NSA would get on the developer's case since, reportedly, the coders themselves were completely anonymous.
There are a lot of threads on various forums about a number of different theories.

Anyway, here are a few: http://www.linuxlinks.com/article/2011040308270275/DiskEncryption.html

 

[islandman]

Not sure how the NSA would get on the developer's case since, reportedly, the coders themselves were completely anonymous.
There are a lot of threads on various forums about a number of different theories.

Anyway, here are a few: http://www.linuxlinks.com/article/2011040308270275/DiskEncryption.html

Is there anything as being completely anonymous these days, and particularly from the NSA?

Whatever the reason, we're the poorer for it.

 

[about_average]

Is there anything as being completely anonymous these days, and particularly from the NSA?

I'm guessing if anyone knew/knows how to be, the truecrypt authors would be among them.

 

[StrangeLife]

I'm guessing if anyone knew/knows how to be, the truecrypt authors would be among them.

Good point.

Though if you want to split hairs, TrueCrypt isnt really about anonymity but about privacy. Like...

"You know who I am and you know that I have something you want, but you can't get at it cause it's encrypted. Nah nah nah."

 

[about_average]

Though if you want to split hairs, TrueCrypt isnt really about anonymity but about privacy.

True, but anonymity can certainly be viewed as an outcome of a very strong desire for privacy.

 

[about_average]

]t is interesting that the site is now located in Switzerland.

Looks like companies serious about privacy are looking to Switzerland. Silent Circle is soon to be based there as well.

 

[StrangeLife]

Looks like companies serious about privacy are looking to Switzerland. Silent Circle is soon to be based there as well.

You are right - it is a sad development, but essentially you can't run a security or privacy business out of the US today, unless you are prepared to shut everything down or go to prison if the authorities get their sight on you. This part of the domestic IT industry is effectively dead today. Products like Bitlocker and PGP Disk are a joke.

So I guess it makes perfect sense to locate the operation in Europe...

 

[about_average]

People have learned from Zimmermann's experience. Toe the line or else.

 

[StrangeLife]

People have learned from Zimmermann's experience. Toe the line or else.

Phil is one of the heroes for sure and he has given the surveillance proponents a lot of grief through the years. But I have to admit that I'm skeptical regarding Silent Circle. The idea is great and on the surface they are doing a lot to assuage fears and concerns by keeping their code open source and having the Silent Network servers located in Canada. But they are marketing their services heavily to the government and military. Getting a contract with them can be highly lucrative but usually comes with certain... obligations.

In this day and age we simply cannot trust a for-profit company when it comes to privacy.