MyBB Community Forums

Lots of drama today about TrueCrypt.org redirecting to a rushed-quality SourceForge page encouraging the use of alternatives such as Microsoft's BitLocker or the encryption options built into OS X, and for Linux:

Quote:If you have files encrypted by TrueCrypt on Linux:

Use any integrated support for encryption. Search available installation packages for words encryption and crypt, install any of the packages found and follow its documentation.

First of all.... those Linux directions!

A new release (7.2) was subsequently put out, signed with what appears to be the actual TrueCrypt signing key. All past versions were wiped, and 7.2 dropped all encryption functionality, now only aborting with the error that TrueCrypt "is not secure as it may contain unfixed security issues." You're only able to decrypt volumes for migration to other solutions at the moment.

Some theorize that this may be a sign of an NSL (National Security Letter), or in other words, a subpoena, with a confidentiality clause (allowed by the wonderful PATRIOT Act) that would suppress the service (TrueCrypt) from notifying users of the ongoing dispute. Others think that it may be defacing by the NSA or other organization in order to encourage people to use BitLocker or other closed-source, probably-backdoored solutions. Then there are some who believe it was a dispute among the developers. And finally, you have a small population who believe a legitimate security issue was found.

My greatest issue with the thought of this being legitimate are that the development was allegedly ended because of Windows XP EOL. This makes absolutely no sense, since TC is cross-platform, and that's its main selling point. TrueCrypt writeups on the site before were very detailed, technical, and complete, whereas the new documents seem very rushed, almost intentionally.

My personal opinion is that it is a NSL with a confidentiality clause, and that the feds want the project dead. Seems like the changes may have been intentional by the devs, and flawed to sound the alarms in the community, but within legal provisions. The changes and the description of NSLs seem to align too much with this, and TrueCrypt is known well for being very difficult to crack.

Think I'm about to convert my casual computing to Linux and only video editing and necessary things on OS X.

Opinions?


Links:
https://news.ycombinator.com/item?id=7812133 (Hacker News)
http://lifehacker.com/truecrypts-web-sit...1582879439 (Lifehacker)
http://www.reddit.com/r/netsec/comments/...ed_052814/ ( /r/netsec )
http://arstechnica.com/security/2014/05/...tly-warns/ (Ars Technica)

Interesting. Thanks for the heads up. Going to have to do some reading to catch up.

It's possible the developers simply don't want to continue support of the platform, and instead of leaving users with a software that will never be updated they're pushing people to move away from the platform. The NSA is already apparently getting pretty good at cracking encryption, I don't think they'd need the NSL

(2014-05-29, 10:22 AM)Tom K. Wrote: [ -> ]It's possible the developers simply don't want to continue support of the platform, and instead of leaving users with a software that will never be updated they're pushing people to move away from the platform. The NSA is already apparently getting pretty good at cracking encryption, I don't think they'd need the NSL

But do you really think they would encourage the use of BitLocker, or for Linux, the ridiculously unspecific directions? That's the primary reason I think there's more to this story than what's at face value.

I guess it depends. As a developer, if I was abandoning my project I'd tell people to move over to similar projects. I wouldn't just stop developing and leave the potential for my customers to be exposed to future security flaws. :/

Looks like the developers just ended the project, at least that's what's said in many places. But why would they close and recommend (backdoored?) BitLocker all of a sudden? That's highly unprofessional and fishy, I would never expect that from creators of a widely used security tool.

(2014-05-31, 03:24 PM)Destroy666 Wrote: [ -> ]Looks like the developers just ended the project, at least that's what's said in many places. But why would they close and recommend (backdoored?) BitLocker all of a sudden? That's highly unprofessional and fishy, I would never expect that from creators of a widely used security tool.

They are "supposedly" backdoored. If the NSA wants your porn collection bad enough they'll get hold of it. In the UK its not even an issue, it's illegal here to withhold encryption keys from the authorities. You are REQUIRED by law to disclose them