9 ms·

I'm pretty sure the US government is why the TrueCrypt devs stopped all work. They got hit with a national security letter (NSL) or heavily leaned on and pressu

by edm0nd 7y ago

I'm pretty sure the US government is why the TrueCrypt devs stopped all work. They got hit with a national security letter (NSL) or heavily leaned on and pressured to stop making their product so awesome and un-breakable.

tptacek 7y ago
Of all the cryptographic tools to mythologize, a crappy last-generation full-disk encryption tool?
- ameister14 7y ago
  I mean, Paul LeRoux is associated with it and he's been mythologized already himself
  - jonny_eh 7y ago
    Have people settled on whether he's also Satoshi or not?
    - alwayseasy 7y ago
      It's unlikely to be him given his style of immediate profit-seeking and immense risk taking in the years that surround the creation of Bitcoin.
    - lawnchair_larry 7y ago
      It’s quite obvious that he is not.
      - jonny_eh 7y ago
        Why? Didn't Satoshi go quiet when Paul was arrested?
  - rofo1 7y ago
    To be clear, "associated" means absolutely nothing at all here. Zero proof or anything close.
    - eitland 7y ago
      He's not linked beyond reasonable doubt to TrueCrypt, but IIRC - there is clear evidence linking him to some earlier cryptographic software -and someone (the journalist who wrote the story?) tried to say that it was a precursor to TrueCrypt.
- jonathanpierre 7y ago
  Is that just a rant or do you have an actual reason to call TrueCrypt crappy? It was at least somewhat solid and it definitely had a great mindshare at the time. It wasn't niche. Also, describing small-scale intervention in cryptography by services "mythologic" in a thread about news about large-scale intervention in cryptography by those services is a bit odd.
  - tptacek 7y ago
    I don't even understand the theory underneath this supposed conspiracy, since full-disk encryption is utterly mainstream at this point. I also don't need to get too deep into what I don't like about TrueCrypt; use it if you like it. The problem is with the model of full-disk encryption; outside of phones with deeply integrated hardware designs that support it, FDE is the least powerful form of encryption we use. It wasn't even a speed bump for the Ulbricht investigators. By all means: enable FDE. You have to turn it on. It's not optional. But the threat it defends against is not the threat many people think it defends against. It's hard to imagine it being such a priority that any government would launch a conspiracy to shut down an open source project.
    - barrkel 7y ago
      AIUI it was a speedbump for Ulbricht; didn't they need to ambush him in a library in order to ensure they had access to his laptop's contents? (I mean, sure, it didn't protect him in the end. But it was a speedbump.)
      - nyolfen 7y ago
        this is true but i wouldnt count on it as evidence either way; fbi would not have nsa tools
      - pvg 7y ago
        ambush him in a library Someone started talking to him while someone else snagged his laptop - a thing you and a friend can do to more or less anyone. It's not like people rappelled down from helicopters with guns drawn.
- tomc1985 7y ago
  Why is it crappy?
- 93po 7y ago
  It was the only non-microsoft option that was accessible and easy to use and free for Windows. And MS's FDE is likely compromised and backdoored.
Someone1234 7y ago
I'm sure they were pressured, but the USG has deep pockets if they wanted someone to stop doing something they just throw a few million at them and call it done, there's far less chance of PR blowback then. Even just reading this article should show you that they kill you with kindness when they want to keep things hush-hush. If someone is developing a free tool, and are offered a retirement-tier payoff to stop, they're going to stop.
- monocasa 7y ago
  They didn't kill lavabit with kindness.
- whatshisface 7y ago
  If an average person got a huge windfall, that would raise a lot of attention, and people would wonder how they got the money. Police use sudden unexplained riches as a way to watch out for criminal activity, and everyone who knew the receiver of the windfall would ask questions. Between $10M and the other option, it may be easier to kill them with killing.
  - K0SM0S 7y ago
    Agencies routinely set up fake businesses for cover, with the cooperation of insiders at big names (e.g. Dell). So you set up a fake SaaS, have your big name client buy the big thing 25k / CPU x however many you need to reach payout, done. All legitimized by a fancy public stock name. If things really get too hot, it's easy to send a letter to any country's IRS via their local intell agency. You'd be surprised how simple it is to close files in this world. I'd suggest reading Snowden's autobiography, Permanent Record. Very eye-opening and a great read.
- jhart99 7y ago
  I always assumed that this is exactly what happened to Skype and Whatsapp.
  - paganel 7y ago
rebuilder 7y ago
I'm not sure that makes sense. The US could compel the devs to compromise their product but not keep them from issuing a cryptic statement and stopping work on the product?
- criddell 7y ago
  It doesn't make sense for two reasons to me. For one, the government can't compel you to do work. That's slavery. Also, it's open source software. TrueCrypt going down didn't change the security landscape at all.
  - turk73 7y ago
    On the face of it sure, but then the key people start having heart attacks and mysterious accidents and suddenly the problem goes away. And that's the world we live in.
  - dboreham 7y ago
    They offer you a large contract to do <something>, then they require that <some guy> they nominate work with you on the project. That guy introduces the backdoor.
  - SkyBelow 7y ago
    The government can. For example, take how the police will turn individuals into informants by getting them on trumped up drug charges and then offering them a deal if they work for the government, including engaging in acts that put them at risk of being killed. https://en.wikipedia.org/wiki/Murder_of_Rachel_Hoffman https://en.wikipedia.org/wiki/Murder_of_Rachel_Hoffman The end result is "Work for us or go to prison."
  - ceejayoz 7y ago
    > For one, the government can't compel you to do work. That's slavery. Slavery's perfectly legal. The 13th Amendment: "Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction." https://en.wikipedia.org/wiki/Penal_labor_in_the_United_States https://en.wikipedia.org/wiki/Penal_labor_in_the_United_Stat...
jimbob45 7y ago
But the source-available VeraCrypt still exists and is maintained.
turk73 7y ago
That sucks. No fan of the intel agencies in this country, they are the Deep State and will harm us just as readily as they would harm communists or terrorists. They are as much responsible for destroying our freedom as they are protecting it. The world needs strong crypto, even if it enables evildoers because it also protects the little people. Strong crypto makes the playing field level, something that control freaks all despise.
RcouF1uZ4gsC 7y ago
From the TrueCrypt webpage: http://truecrypt.sourceforge.net/ http://truecrypt.sourceforge.net/ > WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues The fact that they use awkward wording that contains words whose first letters that start with NSA (not secure as) is pretty suggestive that you are right.
- pstuart 7y ago
  Wow. In a different timeline I'd dismiss that as tinfoil hat time, but in this one it seems spot on.
  - ta999999171 7y ago
    > tinfoil hat time This trope needs to die already.
    - pfundstein 7y ago
      What would you suggest instead? It's a good way to convey unfounded paranoia or to acknowledge that what you're saying sounds like a conspiracy theory.
      - glitchdigger 7y ago
        > talking bout NSA “Unfounded” paranoia
      - ta999999171 7y ago
        There's nothing wrong with conspiracy theory. They regularly turn into conspiracy fact. That's not a dirty phrase either - regardless of what the media memo said back then. That's what I'm suggesting.
  - maxerickson 7y ago
    Is the idea that there would be consequences for a blatant message but not for a sort of more subtle one?
fredgrott 7y ago
no read the damn project notes on the ones that forked Truecrypt its obvious why as it needed fixes and someone clone and forked it to fix it. Not every action is NSA-CIA rigged..they are not hidden bogey men(women) and canni fact be defeated with light, truth, programming, and math
vfclists 7y ago
Why then aren't they able to do the same with LUKS, dm-crypt, cryfs, bitlocker etc? Does that mean they are only available because the 3 letter agencies can hack them?
lawnchair_larry 7y ago
You must have a low threshold for “pretty sure”, because there is no evidence whatsoever to suggest this. Also, it’s open source. Also, the author recommended bitlocker as a replacement. Also, the authors may not even be American (the original author of E4M wasn’t). Doesn’t really add up.

by edm0nd 7y ago

tptacek 7y ago

Of all the cryptographic tools to mythologize, a crappy last-generation full-disk encryption tool?

ameister14 7y ago
I mean, Paul LeRoux is associated with it and he's been mythologized already himself
- jonny_eh 7y ago
  Have people settled on whether he's also Satoshi or not?
  - alwayseasy 7y ago
    It's unlikely to be him given his style of immediate profit-seeking and immense risk taking in the years that surround the creation of Bitcoin.
  - lawnchair_larry 7y ago
    It’s quite obvious that he is not.
    - jonny_eh 7y ago
      Why? Didn't Satoshi go quiet when Paul was arrested?
- rofo1 7y ago
  To be clear, "associated" means absolutely nothing at all here. Zero proof or anything close.
  - eitland 7y ago
    He's not linked beyond reasonable doubt to TrueCrypt, but IIRC - there is clear evidence linking him to some earlier cryptographic software -and someone (the journalist who wrote the story?) tried to say that it was a precursor to TrueCrypt.
jonathanpierre 7y ago
Is that just a rant or do you have an actual reason to call TrueCrypt crappy? It was at least somewhat solid and it definitely had a great mindshare at the time. It wasn't niche. Also, describing small-scale intervention in cryptography by services "mythologic" in a thread about news about large-scale intervention in cryptography by those services is a bit odd.
- tptacek 7y ago
  I don't even understand the theory underneath this supposed conspiracy, since full-disk encryption is utterly mainstream at this point. I also don't need to get too deep into what I don't like about TrueCrypt; use it if you like it. The problem is with the model of full-disk encryption; outside of phones with deeply integrated hardware designs that support it, FDE is the least powerful form of encryption we use. It wasn't even a speed bump for the Ulbricht investigators. By all means: enable FDE. You have to turn it on. It's not optional. But the threat it defends against is not the threat many people think it defends against. It's hard to imagine it being such a priority that any government would launch a conspiracy to shut down an open source project.
  - barrkel 7y ago
    AIUI it was a speedbump for Ulbricht; didn't they need to ambush him in a library in order to ensure they had access to his laptop's contents? (I mean, sure, it didn't protect him in the end. But it was a speedbump.)
    - nyolfen 7y ago
      this is true but i wouldnt count on it as evidence either way; fbi would not have nsa tools
    - pvg 7y ago
      ambush him in a library Someone started talking to him while someone else snagged his laptop - a thing you and a friend can do to more or less anyone. It's not like people rappelled down from helicopters with guns drawn.
tomc1985 7y ago
Why is it crappy?
93po 7y ago
It was the only non-microsoft option that was accessible and easy to use and free for Windows. And MS's FDE is likely compromised and backdoored.

Someone1234 7y ago

I'm sure they were pressured, but the USG has deep pockets if they wanted someone to stop doing something they just throw a few million at them and call it done, there's far less chance of PR blowback then. Even just reading this article should show you that they kill you with kindness when they want to keep things hush-hush. If someone is developing a free tool, and are offered a retirement-tier payoff to stop, they're going to stop.

monocasa 7y ago
They didn't kill lavabit with kindness.
whatshisface 7y ago
If an average person got a huge windfall, that would raise a lot of attention, and people would wonder how they got the money. Police use sudden unexplained riches as a way to watch out for criminal activity, and everyone who knew the receiver of the windfall would ask questions. Between $10M and the other option, it may be easier to kill them with killing.
- K0SM0S 7y ago
  Agencies routinely set up fake businesses for cover, with the cooperation of insiders at big names (e.g. Dell). So you set up a fake SaaS, have your big name client buy the big thing 25k / CPU x however many you need to reach payout, done. All legitimized by a fancy public stock name. If things really get too hot, it's easy to send a letter to any country's IRS via their local intell agency. You'd be surprised how simple it is to close files in this world. I'd suggest reading Snowden's autobiography, Permanent Record. Very eye-opening and a great read.
jhart99 7y ago
I always assumed that this is exactly what happened to Skype and Whatsapp.
- paganel 7y ago

rebuilder 7y ago

I'm not sure that makes sense. The US could compel the devs to compromise their product but not keep them from issuing a cryptic statement and stopping work on the product?

criddell 7y ago
It doesn't make sense for two reasons to me. For one, the government can't compel you to do work. That's slavery. Also, it's open source software. TrueCrypt going down didn't change the security landscape at all.
- turk73 7y ago
  On the face of it sure, but then the key people start having heart attacks and mysterious accidents and suddenly the problem goes away. And that's the world we live in.
- dboreham 7y ago
  They offer you a large contract to do <something>, then they require that <some guy> they nominate work with you on the project. That guy introduces the backdoor.
- SkyBelow 7y ago
  The government can. For example, take how the police will turn individuals into informants by getting them on trumped up drug charges and then offering them a deal if they work for the government, including engaging in acts that put them at risk of being killed. https://en.wikipedia.org/wiki/Murder_of_Rachel_Hoffman https://en.wikipedia.org/wiki/Murder_of_Rachel_Hoffman The end result is "Work for us or go to prison."
- ceejayoz 7y ago
  > For one, the government can't compel you to do work. That's slavery. Slavery's perfectly legal. The 13th Amendment: "Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction." https://en.wikipedia.org/wiki/Penal_labor_in_the_United_States https://en.wikipedia.org/wiki/Penal_labor_in_the_United_Stat...

jimbob45 7y ago

But the source-available VeraCrypt still exists and is maintained.

turk73 7y ago

That sucks. No fan of the intel agencies in this country, they are the Deep State and will harm us just as readily as they would harm communists or terrorists. They are as much responsible for destroying our freedom as they are protecting it. The world needs strong crypto, even if it enables evildoers because it also protects the little people. Strong crypto makes the playing field level, something that control freaks all despise.

RcouF1uZ4gsC 7y ago

From the TrueCrypt webpage: http://truecrypt.sourceforge.net/ http://truecrypt.sourceforge.net/ > WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues The fact that they use awkward wording that contains words whose first letters that start with NSA (not secure as) is pretty suggestive that you are right.

pstuart 7y ago
Wow. In a different timeline I'd dismiss that as tinfoil hat time, but in this one it seems spot on.
- ta999999171 7y ago
  > tinfoil hat time This trope needs to die already.
  - pfundstein 7y ago
    What would you suggest instead? It's a good way to convey unfounded paranoia or to acknowledge that what you're saying sounds like a conspiracy theory.
    - glitchdigger 7y ago
      > talking bout NSA “Unfounded” paranoia
    - ta999999171 7y ago
      There's nothing wrong with conspiracy theory. They regularly turn into conspiracy fact. That's not a dirty phrase either - regardless of what the media memo said back then. That's what I'm suggesting.
- maxerickson 7y ago
  Is the idea that there would be consequences for a blatant message but not for a sort of more subtle one?

fredgrott 7y ago

no read the damn project notes on the ones that forked Truecrypt its obvious why as it needed fixes and someone clone and forked it to fix it. Not every action is NSA-CIA rigged..they are not hidden bogey men(women) and canni fact be defeated with light, truth, programming, and math

vfclists 7y ago

Why then aren't they able to do the same with LUKS, dm-crypt, cryfs, bitlocker etc? Does that mean they are only available because the 3 letter agencies can hack them?

lawnchair_larry 7y ago

You must have a low threshold for “pretty sure”, because there is no evidence whatsoever to suggest this. Also, it’s open source. Also, the author recommended bitlocker as a replacement. Also, the authors may not even be American (the original author of E4M wasn’t). Doesn’t really add up.