Author Topic: Truecrypt is dead (Read 7438 times)

osi · « **on:** Wed, 28 May 2014, 21:21:58 »

Check their source forge page for more info.

It was good while it lasted at least!

SpAmRaY · « **Reply #1 on:** Wed, 28 May 2014, 21:25:23 »

for those who don't want to look it up

Quote

WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues

This page exists only to help migrate existing data encrypted by TrueCrypt.

The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP. Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images. Such integrated support is also available on other platforms (click here for more information). You should migrate any data encrypted by TrueCrypt to encrypted disks or virtual disk images supported on your platform.

http://truecrypt.sourceforge.net/

-the intererwebs seem to think this could be a hoax or hack however....

osi · « **Reply #2 on:** Wed, 28 May 2014, 21:28:24 »

Thank you sir for the extra info!

Techno Trousers · « **Reply #3 on:** Wed, 28 May 2014, 22:45:22 »

I'm dubious about this, but if it turns out to be true, it's a dark day indeed for the security of the little guy. I can't even remember how many people I've recommended TrueCrypt to.

osi · « **Reply #4 on:** Wed, 28 May 2014, 22:58:47 »

Quote from: Techno Trousers on Wed, 28 May 2014, 22:45:22

I'm dubious about this, but if it turns out to be true, it's a dark day indeed for the security of the little guy. I can't even remember how many people I've recommended TrueCrypt to.

Indeed. Truecrypt was the goto for open source encryption.

Time to checkout some other technologies

katushkin · « **Reply #5 on:** Thu, 29 May 2014, 04:18:07 »

Goddamit. Looks like I'm going to have to encrypt my ~~porn~~ important files some other way.

osi · « **Reply #6 on:** Thu, 29 May 2014, 06:53:10 »

This morning the truecrypt page is as it was last night. Will do some more reading today but it seems as if it IS true.

I wonder if the truecrypt audit turned up anything in terms of weakness in the implementation and that's why they shut it down??

jdcarpe · « **Reply #7 on:** Thu, 29 May 2014, 09:57:19 »

In my opinion, this is a signal. It's almost certainly a result of the NSA issuing a shutdown order to the TrueCrypt team. They first issue a statement that the software is insecure, to deter people from using the previous, secure version. Then they recommend BitLocker, which most likely has an NSA backdoor built in, so as to be easily broken by Big Brother. Why would Windows XP EOL make strong crypto insecure all of a sudden? It wouldn't.

esoomenona · « **Reply #8 on:** Thu, 29 May 2014, 09:59:52 »

A statement? Like destroying their lives bit by bit until they finally cave and lie to the people?

hjkl_over_wasd · « **Reply #9 on:** Thu, 29 May 2014, 10:01:10 »

I agree with jdcarpe.

The last report from the security audit, showed that the software was very promising, but further tests had to be made in order to be completely certain of the implemented security standards.

osi · « **Reply #10 on:** Thu, 29 May 2014, 10:24:33 »

It also bothers me that the newly found vulnerability is not described yet. A possible explanation would be to allow a grace period to allow users to migrate existing encrypted data to other means.

The EOL of XP statement is really odd. JD like you said, this shouldn't be a factor here. My guess is it is simply ANY (not a good reason) reason just to announce the discontinuation of the product. Who knows what type of gag order the Truecrypt team may have applied against them.

The all of a sudden nature of this reminds me of the lavabit shutdown. Software can't be physically destroyed so the abruptness to move users away from Truecrypt may have been the best way for that team to get the message out to STOP USING THE PRODUCT!

Trust no one...

blackbox · « **Reply #11 on:** Thu, 29 May 2014, 10:37:56 »

If this turns out to be true, its very sad. I just read this article:
http://boingboing.net/2014/05/29/mysterious-announcement-from-t.html

Kayla · « **Reply #12 on:** Thu, 29 May 2014, 10:55:15 »

Bitlocker? nope nope nope nope nope

The whole thing is way too fishy for me.

D01 · « **Reply #13 on:** Thu, 29 May 2014, 11:05:03 »

Bummer.

TheSoulhunter · « **Reply #14 on:** Thu, 29 May 2014, 11:50:30 »

Quote from: jdcarpe on Thu, 29 May 2014, 09:57:19

In my opinion, this is a signal. It's almost certainly a result of the NSA issuing a shutdown order to the TrueCrypt team. They first issue a statement that the software is insecure, to deter people from using the previous, secure version. Then they recommend BitLocker, which most likely has an NSA backdoor built in, so as to be easily broken by Big Brother. Why would Windows XP EOL make strong crypto insecure all of a sudden? It wouldn't.

+1

SpAmRaY · « **Reply #15 on:** Thu, 29 May 2014, 11:59:39 »

What if the NSA was really behind truecrypt all along?

blackbox · « **Reply #16 on:** Thu, 29 May 2014, 12:18:09 »

Quote from: SpAmRaY on Thu, 29 May 2014, 11:59:39

What if the NSA was really behind truecrypt all along?

And now it is trying to migrate it to the newest product bitlocker?

SpAmRaY · « **Reply #17 on:** Thu, 29 May 2014, 12:24:48 »

Quote from: blackbox on Thu, 29 May 2014, 12:18:09

Quote from: SpAmRaY on Thu, 29 May 2014, 11:59:39
What if the NSA was really behind truecrypt all along?
And now it is trying to migrate it to the newest product bitlocker?

Just a smokescreen so people don't realize what's been going on this entire time.

blackbox · « **Reply #18 on:** Thu, 29 May 2014, 12:27:09 »

Quote from: SpAmRaY on Thu, 29 May 2014, 12:24:48

Quote from: blackbox on Thu, 29 May 2014, 12:18:09
Quote from: SpAmRaY on Thu, 29 May 2014, 11:59:39
What if the NSA was really behind truecrypt all along?
And now it is trying to migrate it to the newest product bitlocker?

Just a smokescreen so people don't realize what's been going on this entire time.

Of course, why didnt I realize that?

jdcarpe · « **Reply #19 on:** Thu, 29 May 2014, 12:31:31 »

That's the beauty of open source encryption versus closed source. With open source, independent reviewers can audit the software to look for vulnerabilities. With closed source, a backdoor could be hidden easily, with no way of users knowing or being able to discover it, until it is too late.

osi · « **Reply #20 on:** Thu, 29 May 2014, 12:38:45 »

Quote from: SpAmRaY on Thu, 29 May 2014, 11:59:39

What if the NSA was really behind truecrypt all along?

Eeek, I hope not!

Conspiracy theory : While NIST was deciding on a standard for AES, they happened upon a bug in either the twofish or serpent implementations. This information got swept under the rug and the public was told they simply weren't qualified to be used as a standard. NSA happily looked under the rug and grabbed the details that were hidden from view.

</theory>

Yes, I know the review was fully public ☺

IvanIvanovich · « **Reply #21 on:** Thu, 29 May 2014, 12:42:06 »

I also suspect the NSA is behind it's shutdown... but the nice thing about opensource is after further code audits, and any needed fixes forks will appear shortly and NSA can play cat and mouse with those releasing them.

jdcarpe · « **Reply #22 on:** Thu, 29 May 2014, 13:21:15 »

Information is power, people. Don't let government bullies take your power. Make them respect the people they are supposed to serve.

James35 · « **Reply #23 on:** Thu, 29 May 2014, 14:03:34 »

I agree. TrueCrypt's open source has been examined by so many people for so long, there has never been any security holes found. I suspect pressure from the outside has made them close down the site.

Kayla · « **Reply #24 on:** Thu, 29 May 2014, 15:19:27 »

Quote from: jdcarpe on Thu, 29 May 2014, 13:21:15

Information is power, people. Don't let government bullies take your power. Make them respect the people they are supposed to serve.

Easier said than done.

Coreda · « **Reply #25 on:** Thu, 29 May 2014, 15:33:38 »

From everything I've been keeping up with it's obvious they were contacted by the government and forced to make changes, so they decided to make it obvious to everyone. Still pretty shocking, and as the license is strict it makes things more difficult for forking, apparently.

As for the audits I'm glad they'll continue (of the previous 7.1a version) according to Matthew Green, who confirmed it. After all they still have the money people raised for it.

tbc · « **Reply #26 on:** Thu, 29 May 2014, 15:51:33 »

Quote from: IvanIvanovich on Thu, 29 May 2014, 12:42:06

I also suspect the NSA is behind it's shutdown... but the nice thing about opensource is after further code audits, and any needed fixes forks will appear shortly and NSA can play cat and mouse with those releasing them.

sorta. OSS doesn't work quite as well with security provider applications.

there really aren't that many people qualified to do an audit and to implement the code changes necessary. especially as standards get updated.

the prime rule of software programming is to never write your own security, you're just not good enough to do it right. you're going to do it wrong, and then your false confidence will screw everyone over.

Techno Trousers · « **Reply #27 on:** Thu, 29 May 2014, 16:29:30 »

I don't really understand the conspiracy theory that the NSA was forcing them to put in a backdoor. Under what authority could something like that happen? We don't even know if the authors are within U.S. jurisdiction.

Of the conspiracy theories I've seen, my favorite is that TrueCrypt has been stolen from the original authors by some nefarious spook agency, and they are trying to convince some person or persons to unencrypt their stuff, ostensibly to convert it to a "safer" encryption solution.

I think this appeals to me since there's no evidence of any backdoors or weaknesses so far. I'm hoping I can safely keep using v. 6x until a good open source alternative for Windows is available. Hopefully they will continue with the in-depth code audit this summer as planned, so we'll know for sure one way or the other.

jdcarpe · « **Reply #28 on:** Thu, 29 May 2014, 16:33:33 »

Quote from: Techno Trousers on Thu, 29 May 2014, 16:29:30

I don't really understand the conspiracy theory that the NSA was forcing them to put in a backdoor. Under what authority could something like that happen? We don't even know if the authors are within U.S. jurisdiction.

Of the conspiracy theories I've seen, my favorite is that TrueCrypt has been stolen from the original authors by some nefarious spook agency, and they are trying to convince some person or persons to unencrypt their stuff, ostensibly to convert it to a "safer" encryption solution.

I think this appeals to me since there's no evidence of any backdoors or weaknesses so far. I'm hoping I can safely keep using v. 6x until a good open source alternative for Windows is available. Hopefully they will continue with the in-depth code audit this summer as planned, so we'll know for sure one way or the other.

No one is saying that TrueCrypt had a backdoor. Quite the contrary - I believe TrueCrypt was secure. Which is why the NSA forced the TrueCrypt team to shut the project down. The NSA likely has backdoors into closed source encryption technologies, such as Microsoft's BitLocker.

James35 · « **Reply #29 on:** Thu, 29 May 2014, 16:41:27 »

Exactly. There is no back door. The source was open for examination by anyone.

Kayla · « **Reply #30 on:** Thu, 29 May 2014, 16:49:02 »

TrueCrypt has been contacted by authorities countless times before and has refused to work with them and kept their methods a secret. If it was NSA from the start then this stunt wouldnt be necessary. There is a story we're missing here and I have a feeling it will turn up eventually. We just have to sit tight and let the internet detectives detect.

jwaz · « **Reply #31 on:** Thu, 29 May 2014, 16:55:30 »

Quote

We are considering several scenarios, including potentially supporting a fork under appropriate free license, w/ a fully reproducible build.

Quote

We are continuing forward with formal cryptanalysis of TrueCrypt 7.1 as committed, and hope to deliver a final audit report in a few months.

Quote

We will be making an announcement later today on the TrueCrypt audit and our work ahead.

via https://twitter.com/OpenCryptoAudit

Techno Trousers · « **Reply #32 on:** Thu, 29 May 2014, 16:59:57 »

Thanks jwaz, I just came here to post that. Great news, because they would certainly have revealed if they'd found a serious bug found in TrueCrypt that they'd already reported and the TrueCrypt team threw in the towel on the project rather than fix it (one of the conspiracy theories out there). I'm going to continue to use it until it's been proven to be compromised.

James35 · « **Reply #33 on:** Thu, 29 May 2014, 17:01:43 »

I would bet money that it hasn't been compromised.

davkol · « **Reply #34 on:** Thu, 29 May 2014, 17:20:20 »

TC isn't open source, it's "source available". Anyway, the source is still on Github: https://github.com/DrWhax/truecrypt-archive

The weird part is that the site is blocked at Archive.org. Three-letter organization indeed.

At least we still have EncFS.

madhias · « **Reply #35 on:** Fri, 30 May 2014, 04:32:08 »

That's new: http://truecrypt.ch/

Also some interesting read about the name, creators, etc (russian translation):
https://translate.google.com/translate?hl=en&sl=ru&tl=en&u=http%3A%2F%2Fnews.softodrom.ru%2Fap%2Fb19702.shtml

osi · « **Reply #36 on:** Fri, 30 May 2014, 07:13:28 »

Quote from: madhias on Fri, 30 May 2014, 04:32:08

That's new: http://truecrypt.ch/

Also some interesting read about the name, creators, etc (russian translation):
https://translate.google.com/translate?hl=en&sl=ru&tl=en&u=http%3A%2F%2Fnews.softodrom.ru%2Fap%2Fb19702.shtml

This is interesting and I see it is based out of Switzerland. But can we really trust this application now considering the past week? My body want's to trust it as I've been using truecrypt for some years now but my mind is still confused.

: patiently waits for the 2nd phase of public audit to finish:

Techno Trousers · « **Reply #37 on:** Fri, 30 May 2014, 08:21:09 »

I think it would be prudent to wait until the OpenCryptoAudit group talks about their future plans. Personally, I'd be more likely to trust a new project started by or spun off from them. I'm sure we will be seeing a lot of new forks popping up in the coming weeks, and the problem with cryptography implentations is that they are about the most difficult software to get right.

katushkin · « **Reply #38 on:** Sat, 31 May 2014, 03:53:50 »

Can't trust the Swiss.

Well you can, but you will never know who else they are working with...

Eszett · « **Reply #39 on:** Sat, 31 May 2014, 04:27:10 »

Let's think about it. The developers of the most secure encryption software on earth warn about their own software, and recommend the software of their competitor, which is known to come with a backdoor to the NSA. And you take this serious? Kiddin'? It stinks to high heaven. Use TrueCrypt 7.1a or DiskCryptor.

Anyway, you know that the warning is bull, when it comes
-- with red letters and block writing.
-- without specific reasons.
-- without the author's name.
-- with a surreptitious advertising

roaduck · « **Reply #40 on:** Mon, 02 June 2014, 22:52:40 »

noisyturtle · « **Reply #41 on:** Tue, 03 June 2014, 02:31:03 »

Let us all don out tinfoil hats and dance around our bunkers shouting at cans of beans!

angelic_sedition · « **Reply #42 on:** Wed, 04 June 2014, 13:13:52 »

There's tcplay. I'm still using truecrypt for now.

News:

Author Topic: Truecrypt is dead (Read 7438 times)