29 ms·

He Always Had a Dark Side

1304 points by pwnna 11y ago

rythmshifter 11y ago
holy shit.
- jpstory 11y ago
  more like holy fuck. This is so huge. It's huger than huge. This will surely rock the crypto scene for years to come.
  - tlrobinson 11y ago
    It's interesting for sure, but what's so earth-shattering about it?
  - krylon 11y ago
    How so? It's an interesting story, for sure, highly interesting, but how does this affect the crypto scene? (Honest question! I am not exactly an expert in cryptography or the sociotope around it.)
- deleted 11y ago
  [deleted]
- deleted 11y ago
  [deleted]
bithush 11y ago
Wow, that was quite the read. If all is true then hats off to the reporter. That was some seriously impressive reporting.
- devy 11y ago
  It reads like a good script for Hollywood blockbuster!
deleted 11y ago
[deleted]
djloche 11y ago
>>"He was particularly protective of Le Roux’s birth mother, making me promise not to reveal her name. “Sad and interesting story,” he said. “His real mom’s mom is married to a U.S. Senator.” When I asked him who the Senator was, he said, “That I can’t say, mate. That’ll get me shot.”" This is probably a bigger story.
- ocdtrekkie 11y ago
  This doesn't seem like it'd be incredibly hard to prove if true. Senator's wives are a pretty limited group of people to look into for a connection.
  - ikeboy 11y ago
    But adoption records are probably hard to get.
    - maxerickson 11y ago
      The mother's name is redacted from the birth certificate shown in the story. It's the link from that name to a Senator that is missing.
  - maxerickson 11y ago
    It'd be the daughter having the child in another country in the early 1970s. I guess there is a good chance that there is no paper trail and a very small number of people that know any details and are still alive (because it happened 40 years ago, not because of anything nefarious).
    - jessaustin 11y ago
      If one were actually interested, maybe one could just look at all Senator's wives' daughters who traveled internationally in that timeframe?
      - maxerickson 11y ago
Nickoladze 11y ago
So he dropped TrueCrypt and told everybody it was insecure when he was picked up by the feds, fearing that they would try and force him to open a security hole? Wow.
- pwnna 11y ago
  This may be true. If you look at the timeline of his arrest and when TrueCrypt ceased development, they are around the same time. Matthew Green also tweeted about this correlation on twitter: https://twitter.com/matthew_d_green/status/714813676671336448 https://twitter.com/matthew_d_green/status/71481367667133644...
- kps 11y ago
  Or that someone else involved with TrueCrypt feared he would.
- Mahn 11y ago
  The article is unclear as for whether he was still involved with TrueCrypt by the time they got him though. It sounds like he had quite a lot going on to even care for TrueCrypt at that point.
  - jessaustin 11y ago
    Sure, but he can't assume that his captors are rational. They might very well blackbag him to some undisclosed dungeon and work him over until he convinces them that he doesn't have commit access. (Which duration might exceed his remaining lifespan, in such conditions.)
ageofwant 11y ago
The narrative is quite, eh.. tentative. Nevertheless a entertaining read, start at the beginning here: https://mastermind.atavist.com/an-arrogant-way-of-killing https://mastermind.atavist.com/an-arrogant-way-of-killing
RyanZAG 11y ago
> Lulu told me that when Le Roux was 15 or 16, in the late 1980s, the local police raided the family home and arrested Paul for selling pornography online. This seems a bit odd to me, having lived in South Africa at that time. There's almost no way a guy at home would have had that kind of access in Apartheid South Africa to the internet back then. There was access, but it was through big companies or academia and on a very controlled level. Here's a quick rundown of internet access in South Africa during that time period from Wikipedia. From experience, it is accurate. > The first South African IP address was granted to Rhodes University in 1988.[1] On 12 November 1991, the first IP connection was made between Rhodes' computing centre and the home of Randy Bush in Portland, Oregon.[2] By November 1991, South African universities were connected through UNINET to the Internet. Commercial Internet access for businesses and private use began in June 1992[3] with the registration of the first .co.za subdomain. You might bring up stuff like BBS, but that was not around in South Africa until after 1990 also. You could technically have imported hardware and connected to a BBS in USA, but the costs involved and control of the only Telecoms operator allowed in Apartheid South Africa (Telkom) would have been unaffordable. Especially for Krugersdorp. I doubt you'd get some kind of USA led local police raid for pornography in Apartheid South Africa either. The whole thing would need some serious evidence.
- alricb 11y ago
  "On-Line" might mean on a Bulletin Board System, some of which did do pornography.
  - deleted 11y ago
    [deleted]
- mchaver 11y ago
  I also thought it was interesting to learn that South Africa did not introduce television until 1976 (assuming this article is correct). https://en.wikipedia.org/wiki/Television_in_South_Africa https://en.wikipedia.org/wiki/Television_in_South_Africa
  - 11y ago
nmc 11y ago
Can we please have a little less narrative and a little more information sources? Has anyone confirmed any affirmation in the article?
- deleted 11y ago
  [deleted]
- djsumdog 11y ago
  This is what I'm wondering. Is this simply going to turn into another Satosh hunt?
  - ikeboy 11y ago
    Paul LeRoux is probably Satoshi. Consider: his latest known posting is from Mar 2014. http://p2pfoundation.ning.com/forum/topics/bitcoin-open-source?commentId=2003008%3AComment%3A52186 http://p2pfoundation.ning.com/forum/topics/bitcoin-open-sour..., two months before Truecrypt shut down. (/sarcasm)
    - ikeboy 11y ago
      I did a bit of more research, and found http://cypherpunks.venona.com/date/1997/02/msg01715.html http://cypherpunks.venona.com/date/1997/02/msg01715.html citing Le Roux on digital cash. (It's not him, by the way, found an active twitter account for that person. Just having some fun creating a conspiracy theory.)
j1vms 11y ago
Could someone post a one or two paragraph TL;DR for people in here who don't have the time right now to read the entire piece? You can reasonably assume we do already a) know what tcrypt is, and b) know about the discontinuation annoucement almost two years ago. May the upvotes then be with you.
- beeboop 11y ago
  Really the only "big" information presented is that Paul Le Roux, a man arrested recently by the DEA, is very very likely the same person who was the early leader of TrueCrypt. It discuses his background a lot - he was an extremely intelligent child and teenager, who started shady business practices as early as 16 when he was arrested for selling porn. He was rather poor and led a shaky life in his early twenties, and had a fairly strong anti-authoritarian belief, which is what led to his interest and development of TrueCrypt (and its predecessor projects that laid the foundation for TC). He eventually started his pharmaceutical business and made hundreds of millions of dollars. According to sources, he became gradually "darker" as he got more money, including allegations he had people killed. And then recently he was arrested by the DEA. The article got most of its information by a supposed relative - the reporter is convinced it's legitimate because of how much they know about Paul and their access to documents a non-family member is unlikely to have. The other interesting new information is that his biological mother (edit: grandmother) is the wife of a US senator, but there's nothing to really collaborate that other than the word of the anonymous soruce. There is no new information about the discontinuation of TC in this article. The article says that Paul disappeared from the crypto community (at least, under his own name) at about the time he started his pharma company (2004), but implied that he had worked on TC for the decade leading up to 2004. The anonymous source also said he "switched" to the pill selling, perhaps suggesting he left the TC project around that time in 2004. If I had to guess, whoever was funding the TC developers stopped funding them. And the developers decided to move on with their lives, having worked on it for 15+ years, and possibly largely only doing so because they got paid. The "TrueCrypt is not secure" message was probably to imply that a lack of updates wasn't because they were confident they weren't needed, but rather because it was no longer maintained.
  - 11y ago
beeboop 11y ago
>He was, in other words, a troll: the kind of person you might find on Reddit I think it's funny that reddit is the go-to example of an internet shithole, instead of something like 4chan.
- SadWebDeveloper 11y ago
  4chan is a shithole without a visible record... reddit on the other hand not only has a record it has meritocratic system aka karma that promotes harassment and internet trolling "just for the lulz and karma"
- gedrap 11y ago
  It's probably just that more people have heard of reddit and can easier relate to rather than 4chan. Although it's probably unfair - I am using reddit for a few years and they have tons of amazing communities and le reddit army (swatters, Boston bombers, etc) are amazingly easy to miss unless you're looking for them.
- clentaminator 11y ago
  I think it's funny that both of those sites seems to get represented by a more vocal and publicly visible subset of their users, and in 4chan's case by a slightly unfair-seeming set of associations between anyone using the term "Anonymous" (despite the fact that Anonymous is simply a name that one can take up without it implying any real link to a group), the one board out of many that is apparently implicated in anything "Anonymous" does, and the site as a whole.
- Dylan16807 11y ago
  Simply being obnoxious is not being a very good troll.
deleted 11y ago
[deleted]
jron 11y ago
"Shortly after TrueCrypt version 1.0 was released in February 2004, the TrueCrypt Team reported receiving emails from Wilfried Hafner, manager of SecurStar, claiming that Paul Le Roux had stolen the source code of E4M from SecurStar as an employee. According to the TrueCrypt Team, the emails stated that Le Roux illegally distributed E4M, and authored an illegal license permitting anyone to base derivative work on E4M and distribute it freely, which Hefner alleges Le Roux did not have any right to do, claiming that all versions of E4M always belonged only to SecurStar. For a time, this led the TrueCrypt Team to stop developing and distributing TrueCrypt" - https://en.wikipedia.org/wiki/E4M https://en.wikipedia.org/wiki/E4M
rxleroux 11y ago
Interesting article.
- Laaw 11y ago
  On the off chance your account is real, what percentage of truth would you assign to the article?
  - celticninja 11y ago
    the account is only 2 hours old so I doubt it is real.
    - beeboop 11y ago
      Also considering he's probably in jail, I doubt he has internet access.
deleted 11y ago
[deleted]
tlrobinson 11y ago
By "arms dealer" do they mean "kind of sketchy online pharmacy entrepreneur"? Because I didn't see anything about weapons in this article. Perhaps that's still to come in part 2, but as of right now the title is extremely linkbaity. EDIT: title has been unlinkbaitified (previously "Truecrypt was written by a international arms dealer") EDIT2: title has been reverted to the linkbaity version (previously changed to the original title "He Always Had a Dark Side")
- Nickoladze 11y ago
  His name seems to be quite well known at this point, lots of stories about him cooperating with US feds in 2014-2015. http://www.nytimes.com/2014/12/21/world/asia/in-real-life-rambo-ends-up-as-a-soldier-of-misfortune-behind-bars.html http://www.nytimes.com/2014/12/21/world/asia/in-real-life-ra... http://www.nytimes.com/2015/02/02/nyregion/us-reveals-criminal-bosss-role-in-capturing-a-mercenary.html http://www.nytimes.com/2015/02/02/nyregion/us-reveals-crimin...
  - pakled_engineer 11y ago
    He's pretty much a Bond villain from those articles, like the UN claiming he funded militias in Somalia to harvest hallucinogenic plants and shipping arms to Liberia. Probably would've made the same amount of money charging for TC premium support instead of building a pancontinental empire of mercenaries and arms trafficking.
    - nickpsecurity 11y ago
      Lord of War taught us such people won't enter such businesses because the "margins are too small." I'd also guess it's not as exciting and brings in less attention from the ladies.
    - bithush 11y ago
      I think you underestimate how much can be made from arms trafficking!
pwnna 11y ago
Looking at the article again I realize the headline here may be incorrect. It is not proven that Le Roux wrote TrueCrypt, but he definitely built the foundation for it. > Hafner and his SecurStar colleagues suspected that Le Roux was part of the TrueCrypt collective but couldn’t prove it. Indeed, even today the question of who launched the software remains unanswered. “The origin of TrueCrypt has always been very mysterious,” says Matthew Green, a computer-science professor at the Johns Hopkins Information Security Institute and an expert on TrueCrypt who led a security audit of the software in 2014. “It was written by anonymous folks; it could have been Paul Le Roux writing under an assumed name, or it could have been someone completely different.” Interesting read, regardless.
Negative1 11y ago
tl;dr: the article describes the origin of one of the 'masterminds' of the truecrypt collective (the group that programmed truecrypt). It describes how his upbringing led to his viewpoints on privacy, hints at a conspiracy to eliminate public cryptography and talks about something called a 'cryptoparty', which I'm still scratching my head about. The article also hints he may have been involved in the illegal drug and arms business. Entertaining but not meaty with the evidence.
- Kristine1975 11y ago
  >cryptoparty Possibly this: https://en.wikipedia.org/wiki/Cryptoparty https://en.wikipedia.org/wiki/Cryptoparty
- EliRivers 11y ago
  Back in my youth, I recall a "crytoparty" being a meatspace event in which people handed out and signed each others keys in order to create a web of verified trust.
  - __jal 11y ago
    Yes. It was a thing people did for a while to attempt to bootstrap PGP/GPG's web of trust, as you say, but also as a PR sort of thing. Crypto was even more black-arts then than now, and with some of the demonization due to the war with the Clinton administration over ITAR, you heard some of the same stuff you hear now about having something to hide, enabling terrorism, etc. (At the time, the "Four Horsemen of the Infopocalypse" - drug dealers, pornographers, terrorists and kidnappers - were the boogie men; it seems kidnapping is less scary these days, so that one gets left out.) Showing how it worked was good PR, as far as it went; I saw a lot of people get that little kid with a decoder ring look. It was mostly a cypherpunks thing, but I understand others sympathetic to the idea picked it up. There were quite a few in the Bay Area, ca. 1993-97-ish. Perhaps later. I recall one entertaining party where proof of identity via government issued paper was forbidden.
6stringmerc 11y ago
What a fantastic piece of journalism, I'm totally hooked. Love these long-form pieces when they have something really and truly meaty to work with. Very grateful for the chance to read it, thank you for posting it over here.
- allenz 11y ago
  You might like longform.org.
ryandrake 11y ago
Thank you. It's amazing how some authors use thousands of words to deliver such little information.
- BinaryIdiot 11y ago
  > It's amazing how some authors use thousands of words to deliver such little information. Well how else are you going to make it look like you really worked hard on something if you just give people exactly what they want right up front? /s Seriously this article is bloated as HELL. Edit: did anyone who downvoted me to hell even read the article? It's about 5% information, 95% useless bloat to fill the page. I mean damn...
  - mikeyouse 11y ago
    Fucking hell Welles, just tell us that was the sled's name!
    - Kristine1975 11y ago
      >just tell us that was the sled's name! It's literally the first word that's said in the movie. Of course at that point you have no idea that it's the sled's name ;-)
      - gjkood 11y ago
        Rosebud.... On a total segue from the topic of this post; two of the earliest memories of movie scenes that are etched into my brain are: a) The snow globe falling down and breaking from Citizen Kane and b) Slim Pickens riding the bomb in Dr. Strangelove I have no idea at what age I watched them but those two scenes seem to have captivated me and are forever with me.
      - nickpsecurity 11y ago
        That was one of the many brilliant things about it.
  - 11y ago
myrbergs_army 11y ago
Original author of the story here... Just to add that 1. yes, the reporting on Le Roux's childhood is more tentative based on a family source (well backed up by docs and images sent to me). But the fact that the same Le Roux created E4M which formed the basis of TrueCrypt is something I think I've established definitively, company and site registration trails show it very firmly (and PLR himself admits it in court, but that comes in a later part of my story). And 2. for the _very_ interested, TC is actually just a small part of Le Roux's story, of which we've released three of seven parts (weekly on Thursdays). I know, TL;DR, it's a lot.
- Cyph0n 11y ago
  Absolutely excellent reporting and writing. I'll start reading the other 2 parts now.
  - 12981238129 11y ago
    It's light years away from the New Yorker, in style, facts, and content. I would not be surprised if it's a false alarm, like the Satoshi "exposure".
- mirimir 11y ago
  Aren't you nervous about doxxing someone like that so thoroughly?
  - omginternets 11y ago
    Yeah, I'd like to know the answer to this as well. Do you think their might be repercussions for this? If not, why? If so, how has this affected you?
  - tptacek 11y ago
    Isn't "doxxing people" the actual job of a journalist?
    - clinta 11y ago
TallGuyShort 11y ago
Of course by some legal interpretations, distributing Truecrypt on the Internet would satisfy the very definition of international arms dealer.
- jtrtoo 11y ago
  Indeed. Google ITAR. I remember 90s web page protests.
johnloeber 11y ago
Not to be pedantic, but you wrote "cutting out the middleman." Doesn't patreon take a small cut? Aren't they a middleman? (Though undoubtedly one taking a much smaller share than previous ones.)
- jonknee 11y ago
  Visa would also be a middleman. Or even the post office if you only accepted mailed cash.
  - adrusi 11y ago
    There's also gratipay, which doesn't take a cut. Still the credit card's cut, but gratipay offers bitcoin payments, which, if they implement it right, would eliminate the middleman (unless you count miners as middlemen) when the financee cashes out using bitcoin. If they implemented it wrong, then coinbase is the middleman.
    - some1else 11y ago
      Nobody even noticed the middle-ma'am though.
    - afreak 11y ago
      > gratipay offers bitcoin payments, which, if they implement it right, would eliminate the middleman [...] when the financee cashes out using bitcoin And tell me, how does one cut out the middleman when they convert their Bitcoin earnings to US dollars or whatever currency they prefer?
      - lawpoop 11y ago
        Jesus Christ why don't you people just start mowing the guy's lawn for Christ's sake
        throweway 11y ago
        That can be taken more than one way
tomc1985 11y ago
What publication is this affiliated with (or: who is paying for this)? "The Atavist" seems like a platform for self-published journalism? The writing style is weird; this looks more like someone's smash job. Why does www.atavist.com go to a sales page? And where's the nutgraf?
- DanSmooth 11y ago
  It's part of their magazine - https://magazine.atavist.com https://magazine.atavist.com - based on their web app https://atavist.com/ https://atavist.com/
sieveoferos 11y ago
"Arch Villain or Arch Agent?" http://journal-neo.org/2015/06/12/paul-calder-le-roux-arch-villain-or-arch-agent/ http://journal-neo.org/2015/06/12/paul-calder-le-roux-arch-v...
- venomsnake 11y ago
  In the cloak and dagger world the difference is not that clear.
deleted 11y ago
[deleted]
TazeTSchnitzel 11y ago
> I can’t say how I’d figured out the connection between his anonymous email and the person I’d emailed previously. I can’t say what service we used to communicate, nor where Lulu lives, nor what he does. Curious, then, that the author chooses to gender them. If the author used 'they' or rewrote sentences to be gender-neutral, it'd be one less bit of entropy.
- spacehome 11y ago
  Not really. As much as it pains social justice warriors today, in English, the words 'he', 'his', and 'him' have a gender neutral usage. And in any case, saying that a computer science security researcher is male is way less than a bit of entropy.
  - TazeTSchnitzel 11y ago
    > As much as it pains social justice warriors today, in English, the words 'he', 'his', and 'him' have a gender neutral usage. 'He' is sometimes used in this fashion, but it is an uncommon use, and it's arguable that in some contexts the author actually means a man and has not considered the possibility of a woman. Certainly in this case, why would you assume that it is used in a gender-neutral sense? > And in any case, saying that a computer science security researcher is male is way less than a bit of entropy. Fair point.
    - Bootvis 11y ago
      It's just not true that it's an uncommon use, see [1] and [2]. So even with the profession left unspecified (which I believe it is, might have missed it) the entropy is less than 1 bit. [1]: http://www.wsj.com/articles/can-they-be-accepted-as-a-singular-pronoun-1428686651 http://www.wsj.com/articles/can-they-be-accepted-as-a-singul... [2]: https://en.wikipedia.org/wiki/Gender_neutrality_in_English#Pronouns https://en.wikipedia.org/wiki/Gender_neutrality_in_English#P...
    - jakub_h 11y ago
      > 'He' is sometimes used in this fashion, but it is an uncommon use Says someone unfamiliar with Indo-European languages in general?
ipsin 11y ago
If Le Roux was arrested in 2012, what was the mechanism of the May 2014 discontinuation of TrueCrypt? In other words, who actually did that?
- blywi 11y ago
  That could have been automatically triggered by some kind of dead man's switch.
  - gpm 11y ago
    The announcment contained information that you couldn't really set up in a dead man's switch payload years earlier > This page exists only to help migrate existing data encrypted by TrueCrypt. > > The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP. Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images. Such integrated support is also available on other platforms (click here for more information). You should migrate any data encrypted by TrueCrypt to encrypted disks or virtual disk images supported on your platform. http://truecrypt.sourceforge.net/ http://truecrypt.sourceforge.net/
    - blywi 11y ago
      Well, the end of support for Windows XP in 2014 was announced in 2008. Windows Vista and 7 were available, and the Windows 8 launch was at hand before the date of his arrest. But the text omits to mention Windows 8.1 which was announced by Microsoft in 2013, after the arrest but well before the Truecrypt announcement was published in 2014. This could be because Windows 8.1 was only considered a relatively minor upgrade to Windows 8 by the author, or because it's existence was unknown at the time when the text was written. This remains open to speculation, but it does not refute the possibility of a dead man's switch.
- rasz_pl 11y ago
  2014 is the time Le Roux is reported to be cooperating with US government, and TrueCrypt end of life "please migrate to BitLocker, its double extra safe, promise!" message fist nicely into that.
solotronics 11y ago
Original author please provide a Bitcoin address for donations. Myself and other BTC enthusiasts would like to donate.
- myrsbergs_army 11y ago
  1BaHhfe3KkP6jTBQR68vWaFbRGfDBhsEKb Thank you so much! Donations are always greatly appreciated!
  - aws_ls 11y ago
    CHEATER ALERT!! (Note this is myrsbergs_army rather than myrbergs_army)
ashitlerferad 11y ago
It seems to be cut off after "The only way out was to spill his secrets."?
- r721 11y ago
  >for the _very_ interested, TC is actually just a small part of Le Roux's story, of which we've released three of seven parts (weekly on Thursdays) https://news.ycombinator.com/item?id=11382503 https://news.ycombinator.com/item?id=11382503
arisAlexis 11y ago
Please make movie with Gerard Depardieu
- AceJohnny2 11y ago
  Cast a nutter to play a nuttier nut. Perfect.
jb613 11y ago
"Hafner told me that in the middle of the development work for DriveCrypt, he discovered that Le Roux was still working on E4M and had incorporated some of his work for SecurStar into his personal project. Hafner was furious. Because E4M was an open-source product, the source code that Hafner had personally funded, he claimed, could now be used by anyone to develop an encryption product of their own." I've seen this a few times now (employer doesn't want employee to take knowledge out).
myrbergsarmy 11y ago
Wow. Thank you for the support. Donations are always appreciated! 1C6ZUd2WdoptjeqG1bxDZwwutBfmuPQU2k
- dylanpyle 11y ago
  worth noting that this is not the same user as https://news.ycombinator.com/user?id=myrbergs_army https://news.ycombinator.com/user?id=myrbergs_army
- dang 11y ago
  We banned this account and detached this subthread from https://news.ycombinator.com/item?id=11383195 https://news.ycombinator.com/item?id=11383195.
zzleeper 11y ago
On a slightly related question, what are you guys using instead of Truecrypt for virtual encripted disks? I use a bit of confidential data for research, and keep the identifiers on a TC container, but since it is no longer maintained I wonder when will it stop working and if VeraCrypt/CipherShed are good or not. I don't access the data that often, so speed is not that big of a deal, but the ability to cover my back is always good (e.g. say "I used XYZ which was deemed as the best free alternative at the time")
- RandalSchwartz 11y ago
  VeraCrypt is being very actively developed, including fixing a number of bugs that were found in TrueCrypt. Watch my interview with the main developer here, including some analysis of the code showing that perhaps different people worked on it over different time periods: https://twit.tv/shows/floss-weekly/episodes/340 https://twit.tv/shows/floss-weekly/episodes/340
- dmix 11y ago
  grugq made a nice list of alternatives to Truecrypt [1]. I also personally use Tomb [2] containers and dmcrypt/luks [3] for full-disk encryption on both Linux and Android. [1] http://grugq.tumblr.com/post/60464139008/alternative-truecrypt-implementations http://grugq.tumblr.com/post/60464139008/alternative-truecry... [2] https://www.dyne.org/software/tomb/ https://www.dyne.org/software/tomb/ [3] Setting up Archlinux with dmcrypt/luks only takes a few extra minutes during install: https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_system https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_... and Android uses dmcrypt when encryption is enabled.
apricot 11y ago
Cryptography: not even once. -- The US government
steve19 11y ago
This is a good warning to anyone wanting to develop crypto tech anonymously. Eventually if the tech is popular it will be profitable for a well meaning journalist to investigate and reveal your identify and publish childhood photos of you.
genericacct 11y ago
Fantastic read, but... looping a video by reloading it off the server everytime it's finished? You should be giving bandwidth to the poor!
- austinhutch 11y ago
  I thought this was happening to me on another site, but it turned out I had developer tools on (disabling cache). Might be what you're seeing.
iends 11y ago
Can I just pay for access to all 7 articles now? Having to wait another month for the last 4 makes me sad.
- jcsnv 11y ago
  me too :(
henrikschroder 11y ago
> On a website for the party, Cincinnatus posted an “after-action report.” “I’m making a note here,” he summarized, “huge success.” It's hard to overstate my satisfaction!
dang 11y ago
The submitted title was "Truecrypt was written by a international arms dealer named Paul LeRoux". That broke the HN guidelines by cherry-picking a single detail from the article, and it's also misleading enough that we're getting emails complaining about it. Rather than litigate what the article does or doesn't show, we've simply reverted the title. It seems particularly bad to make the title say something that the article doesn't actually claim.
- currysausage 11y ago
  The old title was wrong, the new one is devoid of any meaning. I guess the TrueCrypt connection is what got most of us interested in the piece, so something along the lines of "Truecrypt predecessor was started by international drug dealer Paul LeRoux" might have been helpful.
  - dang 11y ago
    The article is still near the top of HN, and no one who looks at the thread will have much trouble figuring out what it's about. If the community agreed amongst itself, obviously we'd follow suit, but it doesn't, and people are going to complain no matter what we do.
- zorpner 11y ago
  It's a real shame that a bunch of people were tricked into reading an excellent piece of long-form journalism because someone singled out why it might interest them. The HN front page has a context, and the new title is completely incoherent there. Do better.
  - mintplant 11y ago
    The previous title was factually incorrect: it did not match the claims of the article. Even the OP admits it was a mistake. https://news.ycombinator.com/item?id=11382412 https://news.ycombinator.com/item?id=11382412 The new title may not be great (as it's copied from the article, where it exists in the context of a larger series), but it's at least an improvement over one that was simply wrong.
poofyleek 11y ago
First McAfee http://www.huffingtonpost.com/2012/11/19/john-mcafee-belize_n_2158292.html http://www.huffingtonpost.com/2012/11/19/john-mcafee-belize_.... Now Le Roux. What is up with the security software guys? Are they destined to be evil geniuses?
- dijit 11y ago
  the curse of government looking over your shoulder constantly, the mental wear of being harassed.If you're unhinged it's easier to paint you the villain, especially if you do end up doing some questionable things.
favoriteketchup 11y ago
So, the senator(s) were Heinz and Kerry?
favoriteketchup 11y ago
So Paul Le Roux's birth mother -- the one who's the wife of an unnamed U.S. Senator -- was she previously the wife of another Senator from a different state and political party?
rurban 11y ago
Janet C. Phelan also wrote about him June 2015: http://journal-neo.org/2015/06/12/paul-calder-le-roux-arch-villain-or-arch-agent/ http://journal-neo.org/2015/06/12/paul-calder-le-roux-arch-v...
radicalman 11y ago
Now this is journalism I'm willing to pay for
fpaboim 11y ago
Awesome story
muzivi 11y ago
Just wanted to say that it was not necessary to block out the last part on the birth certificate where it says A true copy of records kept at XXXXX. It's easy enough to find out where the records are. They can be found at Makombe building in Harare somewhere in the archives. Three copies of a birth certificate are made. One is kept at the local registry office, the other is stored at Mokombe Harare and the third is issued to the holder. If your story is true you can easily bribe someone at Makombe building to show you a the base copy. In this case it even seems there are two copies to be found in Harare because there is a stamp that says Causeway Building which means the birth was most likely registered in Harare during the hyperinflation period hence the odd $200 dollar fee instead of the stamps that were used in the very old days. The birth also does not have a red streak line which means although it is typed instead of hand written it is not computerized. It is even possible there is an even earlier copy of the record BDH/1421/72 means the original birth was recorded way back in the Original Rhodesian days somewhere in Bulayo (BDH).
fosco 11y ago
I suspect had this article had this title from the beginning it would've been down voted. Why was it changed from 'TrueCrypt'
bipingautam 11y ago
i did not like truecrypt very much just because we could not choose the encryption encapsulation in any order we could choose (like something to remember like password) like in ANY order blowfish-blowfish-sherpent-aes ...... etc in any length or combination. there were just hardcoded defaults to choose
bipingautam 11y ago
i did not like truecrypt very much just because we could not choose the encryption encapsulation in any order we could choose (like something to remember like password) like in ANY order blowfish-blowfish-sherpent-aes ...... etc in any length or combination. there were just hardcoded defaults to choose
katiabachko 11y ago
Folks might be interested that the new episode has been posted: http://atav.st/1UWp09h http://atav.st/1UWp09h It follows the arrival of a mysterious arms shipment, and Paul Le Roux's shift toward violence, with a cameo from an animal trainer who worked with the whale in Free Willy, and also, Le Roux's private militia in Somalia.
2ifrgtmypss 11y ago
very good. ty
katiabachko 11y ago
The author talks about the reporting on the ProPublica podcast: https://www.propublica.org/podcast/item/keeping-tabs-on-the-hacking-hero-who-became-a-criminal-kingpin https://www.propublica.org/podcast/item/keeping-tabs-on-the-...
DCPOS_Anthony 11y ago
What a fascinating tale.

1304 points by pwnna 11y ago

rythmshifter 11y ago

holy shit.

jpstory 11y ago
more like holy fuck. This is so huge. It's huger than huge. This will surely rock the crypto scene for years to come.
- tlrobinson 11y ago
  It's interesting for sure, but what's so earth-shattering about it?
- krylon 11y ago
  How so? It's an interesting story, for sure, highly interesting, but how does this affect the crypto scene? (Honest question! I am not exactly an expert in cryptography or the sociotope around it.)
deleted 11y ago
[deleted]
deleted 11y ago
[deleted]

bithush 11y ago

Wow, that was quite the read. If all is true then hats off to the reporter. That was some seriously impressive reporting.

devy 11y ago
It reads like a good script for Hollywood blockbuster!

deleted 11y ago

[deleted]

djloche 11y ago

>>"He was particularly protective of Le Roux’s birth mother, making me promise not to reveal her name. “Sad and interesting story,” he said. “His real mom’s mom is married to a U.S. Senator.” When I asked him who the Senator was, he said, “That I can’t say, mate. That’ll get me shot.”" This is probably a bigger story.

ocdtrekkie 11y ago
This doesn't seem like it'd be incredibly hard to prove if true. Senator's wives are a pretty limited group of people to look into for a connection.
- ikeboy 11y ago
  But adoption records are probably hard to get.
  - maxerickson 11y ago
    The mother's name is redacted from the birth certificate shown in the story. It's the link from that name to a Senator that is missing.
- maxerickson 11y ago
  It'd be the daughter having the child in another country in the early 1970s. I guess there is a good chance that there is no paper trail and a very small number of people that know any details and are still alive (because it happened 40 years ago, not because of anything nefarious).
  - jessaustin 11y ago
    If one were actually interested, maybe one could just look at all Senator's wives' daughters who traveled internationally in that timeframe?
    - maxerickson 11y ago

Nickoladze 11y ago

So he dropped TrueCrypt and told everybody it was insecure when he was picked up by the feds, fearing that they would try and force him to open a security hole? Wow.

pwnna 11y ago
This may be true. If you look at the timeline of his arrest and when TrueCrypt ceased development, they are around the same time. Matthew Green also tweeted about this correlation on twitter: https://twitter.com/matthew_d_green/status/714813676671336448 https://twitter.com/matthew_d_green/status/71481367667133644...
kps 11y ago
Or that someone else involved with TrueCrypt feared he would.
Mahn 11y ago
The article is unclear as for whether he was still involved with TrueCrypt by the time they got him though. It sounds like he had quite a lot going on to even care for TrueCrypt at that point.
- jessaustin 11y ago
  Sure, but he can't assume that his captors are rational. They might very well blackbag him to some undisclosed dungeon and work him over until he convinces them that he doesn't have commit access. (Which duration might exceed his remaining lifespan, in such conditions.)

ageofwant 11y ago

The narrative is quite, eh.. tentative. Nevertheless a entertaining read, start at the beginning here: https://mastermind.atavist.com/an-arrogant-way-of-killing https://mastermind.atavist.com/an-arrogant-way-of-killing

RyanZAG 11y ago

> Lulu told me that when Le Roux was 15 or 16, in the late 1980s, the local police raided the family home and arrested Paul for selling pornography online. This seems a bit odd to me, having lived in South Africa at that time. There's almost no way a guy at home would have had that kind of access in Apartheid South Africa to the internet back then. There was access, but it was through big companies or academia and on a very controlled level. Here's a quick rundown of internet access in South Africa during that time period from Wikipedia. From experience, it is accurate. > The first South African IP address was granted to Rhodes University in 1988.[1] On 12 November 1991, the first IP connection was made between Rhodes' computing centre and the home of Randy Bush in Portland, Oregon.[2] By November 1991, South African universities were connected through UNINET to the Internet. Commercial Internet access for businesses and private use began in June 1992[3] with the registration of the first .co.za subdomain. You might bring up stuff like BBS, but that was not around in South Africa until after 1990 also. You could technically have imported hardware and connected to a BBS in USA, but the costs involved and control of the only Telecoms operator allowed in Apartheid South Africa (Telkom) would have been unaffordable. Especially for Krugersdorp. I doubt you'd get some kind of USA led local police raid for pornography in Apartheid South Africa either. The whole thing would need some serious evidence.

alricb 11y ago
"On-Line" might mean on a Bulletin Board System, some of which did do pornography.
- deleted 11y ago
  [deleted]
mchaver 11y ago
I also thought it was interesting to learn that South Africa did not introduce television until 1976 (assuming this article is correct). https://en.wikipedia.org/wiki/Television_in_South_Africa https://en.wikipedia.org/wiki/Television_in_South_Africa
- 11y ago

nmc 11y ago

Can we please have a little less narrative and a little more information sources? Has anyone confirmed any affirmation in the article?

deleted 11y ago
[deleted]
djsumdog 11y ago
This is what I'm wondering. Is this simply going to turn into another Satosh hunt?
- ikeboy 11y ago
  Paul LeRoux is probably Satoshi. Consider: his latest known posting is from Mar 2014. http://p2pfoundation.ning.com/forum/topics/bitcoin-open-source?commentId=2003008%3AComment%3A52186 http://p2pfoundation.ning.com/forum/topics/bitcoin-open-sour..., two months before Truecrypt shut down. (/sarcasm)
  - ikeboy 11y ago
    I did a bit of more research, and found http://cypherpunks.venona.com/date/1997/02/msg01715.html http://cypherpunks.venona.com/date/1997/02/msg01715.html citing Le Roux on digital cash. (It's not him, by the way, found an active twitter account for that person. Just having some fun creating a conspiracy theory.)

j1vms 11y ago

Could someone post a one or two paragraph TL;DR for people in here who don't have the time right now to read the entire piece? You can reasonably assume we do already a) know what tcrypt is, and b) know about the discontinuation annoucement almost two years ago. May the upvotes then be with you.

beeboop 11y ago
Really the only "big" information presented is that Paul Le Roux, a man arrested recently by the DEA, is very very likely the same person who was the early leader of TrueCrypt. It discuses his background a lot - he was an extremely intelligent child and teenager, who started shady business practices as early as 16 when he was arrested for selling porn. He was rather poor and led a shaky life in his early twenties, and had a fairly strong anti-authoritarian belief, which is what led to his interest and development of TrueCrypt (and its predecessor projects that laid the foundation for TC). He eventually started his pharmaceutical business and made hundreds of millions of dollars. According to sources, he became gradually "darker" as he got more money, including allegations he had people killed. And then recently he was arrested by the DEA. The article got most of its information by a supposed relative - the reporter is convinced it's legitimate because of how much they know about Paul and their access to documents a non-family member is unlikely to have. The other interesting new information is that his biological mother (edit: grandmother) is the wife of a US senator, but there's nothing to really collaborate that other than the word of the anonymous soruce. There is no new information about the discontinuation of TC in this article. The article says that Paul disappeared from the crypto community (at least, under his own name) at about the time he started his pharma company (2004), but implied that he had worked on TC for the decade leading up to 2004. The anonymous source also said he "switched" to the pill selling, perhaps suggesting he left the TC project around that time in 2004. If I had to guess, whoever was funding the TC developers stopped funding them. And the developers decided to move on with their lives, having worked on it for 15+ years, and possibly largely only doing so because they got paid. The "TrueCrypt is not secure" message was probably to imply that a lack of updates wasn't because they were confident they weren't needed, but rather because it was no longer maintained.
- 11y ago

beeboop 11y ago

>He was, in other words, a troll: the kind of person you might find on Reddit I think it's funny that reddit is the go-to example of an internet shithole, instead of something like 4chan.

SadWebDeveloper 11y ago
4chan is a shithole without a visible record... reddit on the other hand not only has a record it has meritocratic system aka karma that promotes harassment and internet trolling "just for the lulz and karma"
gedrap 11y ago
It's probably just that more people have heard of reddit and can easier relate to rather than 4chan. Although it's probably unfair - I am using reddit for a few years and they have tons of amazing communities and le reddit army (swatters, Boston bombers, etc) are amazingly easy to miss unless you're looking for them.
clentaminator 11y ago
I think it's funny that both of those sites seems to get represented by a more vocal and publicly visible subset of their users, and in 4chan's case by a slightly unfair-seeming set of associations between anyone using the term "Anonymous" (despite the fact that Anonymous is simply a name that one can take up without it implying any real link to a group), the one board out of many that is apparently implicated in anything "Anonymous" does, and the site as a whole.
Dylan16807 11y ago
Simply being obnoxious is not being a very good troll.

deleted 11y ago

[deleted]

jron 11y ago

"Shortly after TrueCrypt version 1.0 was released in February 2004, the TrueCrypt Team reported receiving emails from Wilfried Hafner, manager of SecurStar, claiming that Paul Le Roux had stolen the source code of E4M from SecurStar as an employee. According to the TrueCrypt Team, the emails stated that Le Roux illegally distributed E4M, and authored an illegal license permitting anyone to base derivative work on E4M and distribute it freely, which Hefner alleges Le Roux did not have any right to do, claiming that all versions of E4M always belonged only to SecurStar. For a time, this led the TrueCrypt Team to stop developing and distributing TrueCrypt" - https://en.wikipedia.org/wiki/E4M https://en.wikipedia.org/wiki/E4M

rxleroux 11y ago

Interesting article.

Laaw 11y ago
On the off chance your account is real, what percentage of truth would you assign to the article?
- celticninja 11y ago
  the account is only 2 hours old so I doubt it is real.
  - beeboop 11y ago
    Also considering he's probably in jail, I doubt he has internet access.

deleted 11y ago

[deleted]

tlrobinson 11y ago

By "arms dealer" do they mean "kind of sketchy online pharmacy entrepreneur"? Because I didn't see anything about weapons in this article. Perhaps that's still to come in part 2, but as of right now the title is extremely linkbaity. EDIT: title has been unlinkbaitified (previously "Truecrypt was written by a international arms dealer") EDIT2: title has been reverted to the linkbaity version (previously changed to the original title "He Always Had a Dark Side")

Nickoladze 11y ago
His name seems to be quite well known at this point, lots of stories about him cooperating with US feds in 2014-2015. http://www.nytimes.com/2014/12/21/world/asia/in-real-life-rambo-ends-up-as-a-soldier-of-misfortune-behind-bars.html http://www.nytimes.com/2014/12/21/world/asia/in-real-life-ra... http://www.nytimes.com/2015/02/02/nyregion/us-reveals-criminal-bosss-role-in-capturing-a-mercenary.html http://www.nytimes.com/2015/02/02/nyregion/us-reveals-crimin...
- pakled_engineer 11y ago
  He's pretty much a Bond villain from those articles, like the UN claiming he funded militias in Somalia to harvest hallucinogenic plants and shipping arms to Liberia. Probably would've made the same amount of money charging for TC premium support instead of building a pancontinental empire of mercenaries and arms trafficking.
  - nickpsecurity 11y ago
    Lord of War taught us such people won't enter such businesses because the "margins are too small." I'd also guess it's not as exciting and brings in less attention from the ladies.
  - bithush 11y ago
    I think you underestimate how much can be made from arms trafficking!

pwnna 11y ago

Looking at the article again I realize the headline here may be incorrect. It is not proven that Le Roux wrote TrueCrypt, but he definitely built the foundation for it. > Hafner and his SecurStar colleagues suspected that Le Roux was part of the TrueCrypt collective but couldn’t prove it. Indeed, even today the question of who launched the software remains unanswered. “The origin of TrueCrypt has always been very mysterious,” says Matthew Green, a computer-science professor at the Johns Hopkins Information Security Institute and an expert on TrueCrypt who led a security audit of the software in 2014. “It was written by anonymous folks; it could have been Paul Le Roux writing under an assumed name, or it could have been someone completely different.” Interesting read, regardless.

Negative1 11y ago

tl;dr: the article describes the origin of one of the 'masterminds' of the truecrypt collective (the group that programmed truecrypt). It describes how his upbringing led to his viewpoints on privacy, hints at a conspiracy to eliminate public cryptography and talks about something called a 'cryptoparty', which I'm still scratching my head about. The article also hints he may have been involved in the illegal drug and arms business. Entertaining but not meaty with the evidence.

Kristine1975 11y ago
>cryptoparty Possibly this: https://en.wikipedia.org/wiki/Cryptoparty https://en.wikipedia.org/wiki/Cryptoparty
EliRivers 11y ago
Back in my youth, I recall a "crytoparty" being a meatspace event in which people handed out and signed each others keys in order to create a web of verified trust.
- __jal 11y ago
  Yes. It was a thing people did for a while to attempt to bootstrap PGP/GPG's web of trust, as you say, but also as a PR sort of thing. Crypto was even more black-arts then than now, and with some of the demonization due to the war with the Clinton administration over ITAR, you heard some of the same stuff you hear now about having something to hide, enabling terrorism, etc. (At the time, the "Four Horsemen of the Infopocalypse" - drug dealers, pornographers, terrorists and kidnappers - were the boogie men; it seems kidnapping is less scary these days, so that one gets left out.) Showing how it worked was good PR, as far as it went; I saw a lot of people get that little kid with a decoder ring look. It was mostly a cypherpunks thing, but I understand others sympathetic to the idea picked it up. There were quite a few in the Bay Area, ca. 1993-97-ish. Perhaps later. I recall one entertaining party where proof of identity via government issued paper was forbidden.

6stringmerc 11y ago

What a fantastic piece of journalism, I'm totally hooked. Love these long-form pieces when they have something really and truly meaty to work with. Very grateful for the chance to read it, thank you for posting it over here.

allenz 11y ago
You might like longform.org.

ryandrake 11y ago

Thank you. It's amazing how some authors use thousands of words to deliver such little information.

BinaryIdiot 11y ago
> It's amazing how some authors use thousands of words to deliver such little information. Well how else are you going to make it look like you really worked hard on something if you just give people exactly what they want right up front? /s Seriously this article is bloated as HELL. Edit: did anyone who downvoted me to hell even read the article? It's about 5% information, 95% useless bloat to fill the page. I mean damn...
- mikeyouse 11y ago
  Fucking hell Welles, just tell us that was the sled's name!
  - Kristine1975 11y ago
    >just tell us that was the sled's name! It's literally the first word that's said in the movie. Of course at that point you have no idea that it's the sled's name ;-)
    - gjkood 11y ago
      Rosebud.... On a total segue from the topic of this post; two of the earliest memories of movie scenes that are etched into my brain are: a) The snow globe falling down and breaking from Citizen Kane and b) Slim Pickens riding the bomb in Dr. Strangelove I have no idea at what age I watched them but those two scenes seem to have captivated me and are forever with me.
    - nickpsecurity 11y ago
      That was one of the many brilliant things about it.
- 11y ago

myrbergs_army 11y ago

Original author of the story here... Just to add that 1. yes, the reporting on Le Roux's childhood is more tentative based on a family source (well backed up by docs and images sent to me). But the fact that the same Le Roux created E4M which formed the basis of TrueCrypt is something I think I've established definitively, company and site registration trails show it very firmly (and PLR himself admits it in court, but that comes in a later part of my story). And 2. for the _very_ interested, TC is actually just a small part of Le Roux's story, of which we've released three of seven parts (weekly on Thursdays). I know, TL;DR, it's a lot.

Cyph0n 11y ago
Absolutely excellent reporting and writing. I'll start reading the other 2 parts now.
- 12981238129 11y ago
  It's light years away from the New Yorker, in style, facts, and content. I would not be surprised if it's a false alarm, like the Satoshi "exposure".
mirimir 11y ago
Aren't you nervous about doxxing someone like that so thoroughly?
- omginternets 11y ago
  Yeah, I'd like to know the answer to this as well. Do you think their might be repercussions for this? If not, why? If so, how has this affected you?
- tptacek 11y ago
  Isn't "doxxing people" the actual job of a journalist?
  - clinta 11y ago

TallGuyShort 11y ago

Of course by some legal interpretations, distributing Truecrypt on the Internet would satisfy the very definition of international arms dealer.

jtrtoo 11y ago
Indeed. Google ITAR. I remember 90s web page protests.

johnloeber 11y ago

Not to be pedantic, but you wrote "cutting out the middleman." Doesn't patreon take a small cut? Aren't they a middleman? (Though undoubtedly one taking a much smaller share than previous ones.)

jonknee 11y ago
Visa would also be a middleman. Or even the post office if you only accepted mailed cash.
- adrusi 11y ago
  There's also gratipay, which doesn't take a cut. Still the credit card's cut, but gratipay offers bitcoin payments, which, if they implement it right, would eliminate the middleman (unless you count miners as middlemen) when the financee cashes out using bitcoin. If they implemented it wrong, then coinbase is the middleman.
  - some1else 11y ago
    Nobody even noticed the middle-ma'am though.
  - afreak 11y ago
    > gratipay offers bitcoin payments, which, if they implement it right, would eliminate the middleman [...] when the financee cashes out using bitcoin And tell me, how does one cut out the middleman when they convert their Bitcoin earnings to US dollars or whatever currency they prefer?
    - lawpoop 11y ago
      Jesus Christ why don't you people just start mowing the guy's lawn for Christ's sake
      - throweway 11y ago
        That can be taken more than one way

tomc1985 11y ago

What publication is this affiliated with (or: who is paying for this)? "The Atavist" seems like a platform for self-published journalism? The writing style is weird; this looks more like someone's smash job. Why does www.atavist.com go to a sales page? And where's the nutgraf?

DanSmooth 11y ago
It's part of their magazine - https://magazine.atavist.com https://magazine.atavist.com - based on their web app https://atavist.com/ https://atavist.com/

sieveoferos 11y ago

"Arch Villain or Arch Agent?" http://journal-neo.org/2015/06/12/paul-calder-le-roux-arch-villain-or-arch-agent/ http://journal-neo.org/2015/06/12/paul-calder-le-roux-arch-v...

venomsnake 11y ago
In the cloak and dagger world the difference is not that clear.

deleted 11y ago

[deleted]

TazeTSchnitzel 11y ago

> I can’t say how I’d figured out the connection between his anonymous email and the person I’d emailed previously. I can’t say what service we used to communicate, nor where Lulu lives, nor what he does. Curious, then, that the author chooses to gender them. If the author used 'they' or rewrote sentences to be gender-neutral, it'd be one less bit of entropy.

spacehome 11y ago
Not really. As much as it pains social justice warriors today, in English, the words 'he', 'his', and 'him' have a gender neutral usage. And in any case, saying that a computer science security researcher is male is way less than a bit of entropy.
- TazeTSchnitzel 11y ago
  > As much as it pains social justice warriors today, in English, the words 'he', 'his', and 'him' have a gender neutral usage. 'He' is sometimes used in this fashion, but it is an uncommon use, and it's arguable that in some contexts the author actually means a man and has not considered the possibility of a woman. Certainly in this case, why would you assume that it is used in a gender-neutral sense? > And in any case, saying that a computer science security researcher is male is way less than a bit of entropy. Fair point.
  - Bootvis 11y ago
    It's just not true that it's an uncommon use, see [1] and [2]. So even with the profession left unspecified (which I believe it is, might have missed it) the entropy is less than 1 bit. [1]: http://www.wsj.com/articles/can-they-be-accepted-as-a-singular-pronoun-1428686651 http://www.wsj.com/articles/can-they-be-accepted-as-a-singul... [2]: https://en.wikipedia.org/wiki/Gender_neutrality_in_English#Pronouns https://en.wikipedia.org/wiki/Gender_neutrality_in_English#P...
  - jakub_h 11y ago
    > 'He' is sometimes used in this fashion, but it is an uncommon use Says someone unfamiliar with Indo-European languages in general?

ipsin 11y ago

If Le Roux was arrested in 2012, what was the mechanism of the May 2014 discontinuation of TrueCrypt? In other words, who actually did that?

blywi 11y ago
That could have been automatically triggered by some kind of dead man's switch.
- gpm 11y ago
  The announcment contained information that you couldn't really set up in a dead man's switch payload years earlier > This page exists only to help migrate existing data encrypted by TrueCrypt. > > The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP. Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images. Such integrated support is also available on other platforms (click here for more information). You should migrate any data encrypted by TrueCrypt to encrypted disks or virtual disk images supported on your platform. http://truecrypt.sourceforge.net/ http://truecrypt.sourceforge.net/
  - blywi 11y ago
    Well, the end of support for Windows XP in 2014 was announced in 2008. Windows Vista and 7 were available, and the Windows 8 launch was at hand before the date of his arrest. But the text omits to mention Windows 8.1 which was announced by Microsoft in 2013, after the arrest but well before the Truecrypt announcement was published in 2014. This could be because Windows 8.1 was only considered a relatively minor upgrade to Windows 8 by the author, or because it's existence was unknown at the time when the text was written. This remains open to speculation, but it does not refute the possibility of a dead man's switch.
rasz_pl 11y ago
2014 is the time Le Roux is reported to be cooperating with US government, and TrueCrypt end of life "please migrate to BitLocker, its double extra safe, promise!" message fist nicely into that.

solotronics 11y ago

Original author please provide a Bitcoin address for donations. Myself and other BTC enthusiasts would like to donate.

myrsbergs_army 11y ago
1BaHhfe3KkP6jTBQR68vWaFbRGfDBhsEKb Thank you so much! Donations are always greatly appreciated!
- aws_ls 11y ago
  CHEATER ALERT!! (Note this is myrsbergs_army rather than myrbergs_army)

ashitlerferad 11y ago

It seems to be cut off after "The only way out was to spill his secrets."?

r721 11y ago
>for the _very_ interested, TC is actually just a small part of Le Roux's story, of which we've released three of seven parts (weekly on Thursdays) https://news.ycombinator.com/item?id=11382503 https://news.ycombinator.com/item?id=11382503

arisAlexis 11y ago

Please make movie with Gerard Depardieu

AceJohnny2 11y ago
Cast a nutter to play a nuttier nut. Perfect.

jb613 11y ago

"Hafner told me that in the middle of the development work for DriveCrypt, he discovered that Le Roux was still working on E4M and had incorporated some of his work for SecurStar into his personal project. Hafner was furious. Because E4M was an open-source product, the source code that Hafner had personally funded, he claimed, could now be used by anyone to develop an encryption product of their own." I've seen this a few times now (employer doesn't want employee to take knowledge out).

myrbergsarmy 11y ago

Wow. Thank you for the support. Donations are always appreciated! 1C6ZUd2WdoptjeqG1bxDZwwutBfmuPQU2k

dylanpyle 11y ago
worth noting that this is not the same user as https://news.ycombinator.com/user?id=myrbergs_army https://news.ycombinator.com/user?id=myrbergs_army
dang 11y ago
We banned this account and detached this subthread from https://news.ycombinator.com/item?id=11383195 https://news.ycombinator.com/item?id=11383195.

zzleeper 11y ago

On a slightly related question, what are you guys using instead of Truecrypt for virtual encripted disks? I use a bit of confidential data for research, and keep the identifiers on a TC container, but since it is no longer maintained I wonder when will it stop working and if VeraCrypt/CipherShed are good or not. I don't access the data that often, so speed is not that big of a deal, but the ability to cover my back is always good (e.g. say "I used XYZ which was deemed as the best free alternative at the time")

RandalSchwartz 11y ago
VeraCrypt is being very actively developed, including fixing a number of bugs that were found in TrueCrypt. Watch my interview with the main developer here, including some analysis of the code showing that perhaps different people worked on it over different time periods: https://twit.tv/shows/floss-weekly/episodes/340 https://twit.tv/shows/floss-weekly/episodes/340
dmix 11y ago
grugq made a nice list of alternatives to Truecrypt [1]. I also personally use Tomb [2] containers and dmcrypt/luks [3] for full-disk encryption on both Linux and Android. [1] http://grugq.tumblr.com/post/60464139008/alternative-truecrypt-implementations http://grugq.tumblr.com/post/60464139008/alternative-truecry... [2] https://www.dyne.org/software/tomb/ https://www.dyne.org/software/tomb/ [3] Setting up Archlinux with dmcrypt/luks only takes a few extra minutes during install: https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_system https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_... and Android uses dmcrypt when encryption is enabled.

apricot 11y ago

Cryptography: not even once. -- The US government

steve19 11y ago

This is a good warning to anyone wanting to develop crypto tech anonymously. Eventually if the tech is popular it will be profitable for a well meaning journalist to investigate and reveal your identify and publish childhood photos of you.

genericacct 11y ago

Fantastic read, but... looping a video by reloading it off the server everytime it's finished? You should be giving bandwidth to the poor!

austinhutch 11y ago
I thought this was happening to me on another site, but it turned out I had developer tools on (disabling cache). Might be what you're seeing.

iends 11y ago

Can I just pay for access to all 7 articles now? Having to wait another month for the last 4 makes me sad.

jcsnv 11y ago
me too :(

henrikschroder 11y ago

> On a website for the party, Cincinnatus posted an “after-action report.” “I’m making a note here,” he summarized, “huge success.” It's hard to overstate my satisfaction!

dang 11y ago

The submitted title was "Truecrypt was written by a international arms dealer named Paul LeRoux". That broke the HN guidelines by cherry-picking a single detail from the article, and it's also misleading enough that we're getting emails complaining about it. Rather than litigate what the article does or doesn't show, we've simply reverted the title. It seems particularly bad to make the title say something that the article doesn't actually claim.

currysausage 11y ago
The old title was wrong, the new one is devoid of any meaning. I guess the TrueCrypt connection is what got most of us interested in the piece, so something along the lines of "Truecrypt predecessor was started by international drug dealer Paul LeRoux" might have been helpful.
- dang 11y ago
  The article is still near the top of HN, and no one who looks at the thread will have much trouble figuring out what it's about. If the community agreed amongst itself, obviously we'd follow suit, but it doesn't, and people are going to complain no matter what we do.
zorpner 11y ago
It's a real shame that a bunch of people were tricked into reading an excellent piece of long-form journalism because someone singled out why it might interest them. The HN front page has a context, and the new title is completely incoherent there. Do better.
- mintplant 11y ago
  The previous title was factually incorrect: it did not match the claims of the article. Even the OP admits it was a mistake. https://news.ycombinator.com/item?id=11382412 https://news.ycombinator.com/item?id=11382412 The new title may not be great (as it's copied from the article, where it exists in the context of a larger series), but it's at least an improvement over one that was simply wrong.

poofyleek 11y ago

First McAfee http://www.huffingtonpost.com/2012/11/19/john-mcafee-belize_n_2158292.html http://www.huffingtonpost.com/2012/11/19/john-mcafee-belize_.... Now Le Roux. What is up with the security software guys? Are they destined to be evil geniuses?

dijit 11y ago
the curse of government looking over your shoulder constantly, the mental wear of being harassed.If you're unhinged it's easier to paint you the villain, especially if you do end up doing some questionable things.

favoriteketchup 11y ago

So, the senator(s) were Heinz and Kerry?

favoriteketchup 11y ago

So Paul Le Roux's birth mother -- the one who's the wife of an unnamed U.S. Senator -- was she previously the wife of another Senator from a different state and political party?

rurban 11y ago

Janet C. Phelan also wrote about him June 2015: http://journal-neo.org/2015/06/12/paul-calder-le-roux-arch-villain-or-arch-agent/ http://journal-neo.org/2015/06/12/paul-calder-le-roux-arch-v...

radicalman 11y ago

Now this is journalism I'm willing to pay for

fpaboim 11y ago

Awesome story

muzivi 11y ago

Just wanted to say that it was not necessary to block out the last part on the birth certificate where it says A true copy of records kept at XXXXX. It's easy enough to find out where the records are. They can be found at Makombe building in Harare somewhere in the archives. Three copies of a birth certificate are made. One is kept at the local registry office, the other is stored at Mokombe Harare and the third is issued to the holder. If your story is true you can easily bribe someone at Makombe building to show you a the base copy. In this case it even seems there are two copies to be found in Harare because there is a stamp that says Causeway Building which means the birth was most likely registered in Harare during the hyperinflation period hence the odd $200 dollar fee instead of the stamps that were used in the very old days. The birth also does not have a red streak line which means although it is typed instead of hand written it is not computerized. It is even possible there is an even earlier copy of the record BDH/1421/72 means the original birth was recorded way back in the Original Rhodesian days somewhere in Bulayo (BDH).

fosco 11y ago

I suspect had this article had this title from the beginning it would've been down voted. Why was it changed from 'TrueCrypt'

bipingautam 11y ago

i did not like truecrypt very much just because we could not choose the encryption encapsulation in any order we could choose (like something to remember like password) like in ANY order blowfish-blowfish-sherpent-aes ...... etc in any length or combination. there were just hardcoded defaults to choose

bipingautam 11y ago

katiabachko 11y ago

Folks might be interested that the new episode has been posted: http://atav.st/1UWp09h http://atav.st/1UWp09h It follows the arrival of a mysterious arms shipment, and Paul Le Roux's shift toward violence, with a cameo from an animal trainer who worked with the whale in Free Willy, and also, Le Roux's private militia in Somalia.

2ifrgtmypss 11y ago

very good. ty

katiabachko 11y ago

The author talks about the reporting on the ProPublica podcast: https://www.propublica.org/podcast/item/keeping-tabs-on-the-hacking-hero-who-became-a-criminal-kingpin https://www.propublica.org/podcast/item/keeping-tabs-on-the-...

DCPOS_Anthony 11y ago

What a fascinating tale.