6 ms·

An update on Truecrypt

202 points by clarkm 13y ago

aareet 13y ago
This, in a nutshell, is the underutilized value of open source - the ability for the general public to conduct a trustworthy third party audit and validate security claims of software creators.
- deleted 13y ago
  [deleted]
- tptacek 13y ago
  Not really. This is the value of crowdsourcing. The audit itself is being conducted by a professional software security firm (our sister company, as it happens) and their portion of it might only have cost a small factor more had complete source code not been available. It's the money and expertise that are making this possible, not the source code. (Don't get me wrong: I strongly prefer open source software to closed.)
  - rmrfrmrf 13y ago
    Get outta here, party pooper!
  - nabla9 13y ago
    I have a question. Can government issue gag order to security firm doing audit and prevent them from releasing backdoors or intentional weaknesses they discover?
    - tptacek 13y ago
      No.
      - whyme 13y ago
        I'm surprised you're so confident considering how many experts were shocked to discover how far the US govt had been able to go.
        tptacek 13y ago
        Comes from an understanding of how service providers actually get gagged: the courts actively issue a gag rule based on orders they themselves issued. That's can't be true of basic science.
        shiven 13y ago
        What if the powers that be decide to "classify" the results/reports? I would guess that would be a big legal hurdle. But if things get to that point, a copy the report would probably show up on wikileaks... I guess?
        eli 13y ago
        That's not how classification works.
        tptacek 13y ago
        It's also not how research works. For something to be restrained from publication, the government needs to know it exists. But with new research results, they can't know what to restrain until it's too late. They could try passing a law outlawing security research, but: good luck with that.
        polarix 13y ago
        Don't they now know what to restrain? (due to this post, at the very least...)
        im3w1l 13y ago
        Well if they planted a backdoor, they can know it exists, and could restrain it before it is too late.
    - amenod 13y ago
      Probably not. But they can contact a security reseach company so they make a "crowdsourced" audit project, perform it and still leave a backdoor or two uncovered. TrueCrypt gets an official audit and NSA keeps the backdoors - win-win. </sarcasm> And there is less chance that anyone else will perform an audit in near future. :(
    - mafribe 13y ago
      I am not familiar with the legal situation. However, one needs also to consider extra-juridical means. A security company that does not comply with the demands of the relevant security services is unlikely ever to do major business again in the country where it is based.
salient 13y ago
> And finally, the most exciting news: we've signed a first contract with iSEC partners to evaluate large portions of the Windows software and bootloader code. This review will begin in January. That's huge. I assume you're not referring to having access to the Windows source code, though. Here's a crazy idea. After the whole NSA stuff, many governments are going to require Microsoft to give them access to the source code, if they want them to continue using it, or buy the new versions of Windows. Any chance you could contact such a government, to allow you to do the audit on their behalf, or to work together with them on it? That would be a win-win for everyone. They get a team of experts to review the Windows code base, and you get to know everything about Windows. They probably won't be very eager to get Americans to do this for them, though, so make sure you flaunt all of your credentials.
- mintplant 13y ago
  > After the whole NSA stuff, many governments are going to require Microsoft to give them access to the source code, if they want them to continue using it, or buy the new versions of Windows. That's interesting to hear. Got any more information on that?
  - Maxious 13y ago
    Well this acknowledges the existence of the source code sharing program... https://www.microsoft.com/en-us/sharedsource/government-security-program.aspx https://www.microsoft.com/en-us/sharedsource/government-secu...
    - deleted 13y ago
      [deleted]
      - deleted 13y ago
        [deleted]
  - mburns 13y ago
    The Chinese government has the Windows source code for a decade. Microsoft's press release: http://www.microsoft.com/en-us/news/press/2003/feb03/02-28gspchinapr.aspx http://www.microsoft.com/en-us/news/press/2003/feb03/02-28gs...
daeken 13y ago
> I usually take a pretty skeptical attitude on this blog when it comes to Internet security. For the most part we do things wrong, and I used to think most people didn't care. The fact is that I was wrong. If the response to our audit call is any evidence, you do care. You care a lot. I used to feel the exact same way the author did initially. It wasn't until this year, between teaching a class on security (whose demand I still can't even remotely fathom) and becoming more outspoken about my concerns around the way we handle security, that I really started to realize that people do care deeply about security. That said, most people don't know enough to positively impact security, but that's a problem of education; it's something I'm hoping to put a serious dent in over the next year.
- eps 13y ago
  > Education Make sure to cover responsible disclosure.
  - lawnchair_larry 13y ago
    This is subjective, and it's rather presumptuous to claim one particular philosophy as the "responsible" one. Microsoft rejected this term for that reason, despite the fact that it would benefit them.
deleted 13y ago
[deleted]
wil421 13y ago
This is extremely awesome and I support it. I have sensitive files with tax info and some software keys I like to keep protected. NSA aside I don't want some malware or vulnerability in my system allowing intruders to take my stuff.
- kirubakaran 13y ago
  Can't malware just keylog your passphrase?
  - deleted 13y ago
    [deleted]
  - wil421 13y ago
    Sure it could but would it be smart enough to find the crypt file. Hopefully McAfee can help with the key logger.
apaprocki 13y ago
Tip for gaining more donations: once they get 501c(3) status, many larger companies have established charity matching programs. Usually it just takes some employee initiative to ask for an organization to be added (/ paperwork verified) and then companies will match donations. In addition, philanthropy departments can be petitioned for grants. Given all the recent news, that might generate a decent amount of grants.
ThinkBeat 13y ago
I cannot explain exactly why but something about this project rubs me the wrong way. So much time spent doing bureaucratic things, organizing, raising money. Have meetings, setup a board. Did the authors, the people who wrote the code, that did all that work, receive such ample payment for their role? Should not some of the money raised be offered to the developers? (Some say that they are anonymous I dont know if that is true, but they do take donations on the site) Lets give them 70% of the money raised to work on TrueCrypt and make it even more amazing. They developers did all that work for free (?) , but now these people have to get paid really well to see if what the devs did is correct. Seems to me most of the money goes towards hiring a for profit consulting company. Great way to drum up business I guess. Meanwhile: From the official TrueCrypt FAQ: Q: TrueCrypt is open-source, but has anybody actually reviewed the source code? A: Yes. In fact, the source code is constantly being reviewed by many independent researchers and users. We know this because many bugs and several security issues have been discovered by independent researchers (including some well-known ones) while reviewing the source code. So the reviews and audits have been going on for a long time by many individuals around the world. Anyone can do it. As far as I know, Linux has never been subjected to a formal audit. it has been gawked at by thousands and thousands of individuals. None of them read the whole thing for sure, but parts.
- jbri 13y ago
  If people want to support the TrueCrypt developers, there's a "Donate" button on the TrueCrypt website. People have instead chosen to give money to an initiative to have a thorough independent audit of the TrueCrypt code - it seems to me like it would be morally wrong to take their money and give it to the TrueCrypt developers instead. Presumably, if their preference was for that money to go to the TrueCrypt developers instead, they'd have skipped the middleman and donated directly. Perhaps someone should organize a similar initiative for the Linux source code?
- justin66 13y ago
  > Did the authors, the people who wrote the code, that did all that work, receive such ample payment for their role? Should not some of the money raised be offered to the developers? (Some say that they are anonymous I dont know if that is true, but they do take donations on the site) Lets give them 70% of the money raised to work on TrueCrypt and make it even more amazing. If the authors of TrueCrypt have a mechanism in place to bring money in from TrueCrypt, a successful security audit will only make that a lot more profitable. If they don't, they're obviously not worried about it, so who cares? > They developers did all that work for free (?) , but now these people have to get paid really well to see if what the devs did is correct. Sixty thousand bucks divided amongst multiple people is not hugely generous compensation.

202 points by clarkm 13y ago

This, in a nutshell, is the underutilized value of open source - the ability for the general public to conduct a trustworthy third party audit and validate security claims of software creators.

deleted 13y ago
[deleted]
tptacek 13y ago
Not really. This is the value of crowdsourcing. The audit itself is being conducted by a professional software security firm (our sister company, as it happens) and their portion of it might only have cost a small factor more had complete source code not been available. It's the money and expertise that are making this possible, not the source code. (Don't get me wrong: I strongly prefer open source software to closed.)
- rmrfrmrf 13y ago
  Get outta here, party pooper!
- nabla9 13y ago
  I have a question. Can government issue gag order to security firm doing audit and prevent them from releasing backdoors or intentional weaknesses they discover?
  - tptacek 13y ago
    No.
    - whyme 13y ago
      I'm surprised you're so confident considering how many experts were shocked to discover how far the US govt had been able to go.
      - tptacek 13y ago
        Comes from an understanding of how service providers actually get gagged: the courts actively issue a gag rule based on orders they themselves issued. That's can't be true of basic science.
        shiven 13y ago
        What if the powers that be decide to "classify" the results/reports? I would guess that would be a big legal hurdle. But if things get to that point, a copy the report would probably show up on wikileaks... I guess?
        eli 13y ago
        That's not how classification works.
        tptacek 13y ago
        It's also not how research works. For something to be restrained from publication, the government needs to know it exists. But with new research results, they can't know what to restrain until it's too late. They could try passing a law outlawing security research, but: good luck with that.
        polarix 13y ago
        Don't they now know what to restrain? (due to this post, at the very least...)
        im3w1l 13y ago
        Well if they planted a backdoor, they can know it exists, and could restrain it before it is too late.
  - amenod 13y ago
    Probably not. But they can contact a security reseach company so they make a "crowdsourced" audit project, perform it and still leave a backdoor or two uncovered. TrueCrypt gets an official audit and NSA keeps the backdoors - win-win. </sarcasm> And there is less chance that anyone else will perform an audit in near future. :(
  - mafribe 13y ago
    I am not familiar with the legal situation. However, one needs also to consider extra-juridical means. A security company that does not comply with the demands of the relevant security services is unlikely ever to do major business again in the country where it is based.

salient 13y ago

> And finally, the most exciting news: we've signed a first contract with iSEC partners to evaluate large portions of the Windows software and bootloader code. This review will begin in January. That's huge. I assume you're not referring to having access to the Windows source code, though. Here's a crazy idea. After the whole NSA stuff, many governments are going to require Microsoft to give them access to the source code, if they want them to continue using it, or buy the new versions of Windows. Any chance you could contact such a government, to allow you to do the audit on their behalf, or to work together with them on it? That would be a win-win for everyone. They get a team of experts to review the Windows code base, and you get to know everything about Windows. They probably won't be very eager to get Americans to do this for them, though, so make sure you flaunt all of your credentials.

mintplant 13y ago
> After the whole NSA stuff, many governments are going to require Microsoft to give them access to the source code, if they want them to continue using it, or buy the new versions of Windows. That's interesting to hear. Got any more information on that?
- Maxious 13y ago
  Well this acknowledges the existence of the source code sharing program... https://www.microsoft.com/en-us/sharedsource/government-security-program.aspx https://www.microsoft.com/en-us/sharedsource/government-secu...
  - deleted 13y ago
    [deleted]
    - deleted 13y ago
      [deleted]
- mburns 13y ago
  The Chinese government has the Windows source code for a decade. Microsoft's press release: http://www.microsoft.com/en-us/news/press/2003/feb03/02-28gspchinapr.aspx http://www.microsoft.com/en-us/news/press/2003/feb03/02-28gs...

daeken 13y ago

> I usually take a pretty skeptical attitude on this blog when it comes to Internet security. For the most part we do things wrong, and I used to think most people didn't care. The fact is that I was wrong. If the response to our audit call is any evidence, you do care. You care a lot. I used to feel the exact same way the author did initially. It wasn't until this year, between teaching a class on security (whose demand I still can't even remotely fathom) and becoming more outspoken about my concerns around the way we handle security, that I really started to realize that people do care deeply about security. That said, most people don't know enough to positively impact security, but that's a problem of education; it's something I'm hoping to put a serious dent in over the next year.

eps 13y ago
> Education Make sure to cover responsible disclosure.
- lawnchair_larry 13y ago
  This is subjective, and it's rather presumptuous to claim one particular philosophy as the "responsible" one. Microsoft rejected this term for that reason, despite the fact that it would benefit them.

deleted 13y ago

[deleted]

wil421 13y ago

This is extremely awesome and I support it. I have sensitive files with tax info and some software keys I like to keep protected. NSA aside I don't want some malware or vulnerability in my system allowing intruders to take my stuff.

kirubakaran 13y ago
Can't malware just keylog your passphrase?
- deleted 13y ago
  [deleted]
- wil421 13y ago
  Sure it could but would it be smart enough to find the crypt file. Hopefully McAfee can help with the key logger.

apaprocki 13y ago

Tip for gaining more donations: once they get 501c(3) status, many larger companies have established charity matching programs. Usually it just takes some employee initiative to ask for an organization to be added (/ paperwork verified) and then companies will match donations. In addition, philanthropy departments can be petitioned for grants. Given all the recent news, that might generate a decent amount of grants.

ThinkBeat 13y ago

I cannot explain exactly why but something about this project rubs me the wrong way. So much time spent doing bureaucratic things, organizing, raising money. Have meetings, setup a board. Did the authors, the people who wrote the code, that did all that work, receive such ample payment for their role? Should not some of the money raised be offered to the developers? (Some say that they are anonymous I dont know if that is true, but they do take donations on the site) Lets give them 70% of the money raised to work on TrueCrypt and make it even more amazing. They developers did all that work for free (?) , but now these people have to get paid really well to see if what the devs did is correct. Seems to me most of the money goes towards hiring a for profit consulting company. Great way to drum up business I guess. Meanwhile: From the official TrueCrypt FAQ: Q: TrueCrypt is open-source, but has anybody actually reviewed the source code? A: Yes. In fact, the source code is constantly being reviewed by many independent researchers and users. We know this because many bugs and several security issues have been discovered by independent researchers (including some well-known ones) while reviewing the source code. So the reviews and audits have been going on for a long time by many individuals around the world. Anyone can do it. As far as I know, Linux has never been subjected to a formal audit. it has been gawked at by thousands and thousands of individuals. None of them read the whole thing for sure, but parts.

jbri 13y ago
If people want to support the TrueCrypt developers, there's a "Donate" button on the TrueCrypt website. People have instead chosen to give money to an initiative to have a thorough independent audit of the TrueCrypt code - it seems to me like it would be morally wrong to take their money and give it to the TrueCrypt developers instead. Presumably, if their preference was for that money to go to the TrueCrypt developers instead, they'd have skipped the middleman and donated directly. Perhaps someone should organize a similar initiative for the Linux source code?
justin66 13y ago
> Did the authors, the people who wrote the code, that did all that work, receive such ample payment for their role? Should not some of the money raised be offered to the developers? (Some say that they are anonymous I dont know if that is true, but they do take donations on the site) Lets give them 70% of the money raised to work on TrueCrypt and make it even more amazing. If the authors of TrueCrypt have a mechanism in place to bring money in from TrueCrypt, a successful security audit will only make that a lot more profitable. If they don't, they're obviously not worried about it, so who cares? > They developers did all that work for free (?) , but now these people have to get paid really well to see if what the devs did is correct. Sixty thousand bucks divided amongst multiple people is not hugely generous compensation.