4 ms·

This is creepy as hell. No mention of why it's supposed to be not secure - it's an open source project so it would be easy to point to a specific vulnerability

by Netcob 12y ago

This is creepy as hell. No mention of why it's supposed to be not secure - it's an open source project so it would be easy to point to a specific vulnerability. All of this shortly after passing audit. There are detailed steps towards switching to supposedly secure closed-source solutions by companies known to be working closely with the NSA. Also, since when do open source projects suddenly decide they are not as good enough as a closed-source alternative and then stop the project? Are we in danger of seeing a similar message on the homepage of LibreOffice and OpenOffice, declaring that you should switch to Microsoft Office? I can't even begin to imagine a valid scenario in which something like this would be put up by the developers, with no pressure other than some fatal security flaw about which they just really don't want to talk.

logicallee 12y ago
It doesn't matter why. If "we are now insecure" then the last thing you say is, "so please download these new versions, used only to decrypt your old files and nothing else." No we won't tell you what, if anything, was wrong, so you can make an informed decision.
- CHY872 12y ago
  The motivation would be so that if you had a TrueCrypt archive lying around on a drive that you find in 5 years time, it would be possible to decrypt it - but they don't want to allow encryption because they won't be continuing development, and so fixing future bugs will not be possible.
  - Zancarius 12y ago
    If that's the motivation then in 5 years' time, who's to say the new version will work as well (assuming that it also won't be updated)? That doesn't make any sense.
    - deleted 12y ago
      [deleted]
    - CHY872 12y ago
      They're saying that one should not continue to use orphaned software (when it's so security critical). So they're stopping the distribution of the encryption part of it, and continuing to distribute the part of the software that decrypts the code. This means that if (in five years) you find an archive that you can't open without TrueCrypt (and you uninstalled it etc) you'll still be easily able to find a signed version that will decrypt it for you. At the same time, the developer clearly doesn't want people to be encrypting new archives with it, so have removed that functionality. Removing the software in total would have lead to many mirror sites springing up, most with unproved providence (and a great opportunity for exploits). This method allows an official version to still exist (unmaintained, but still compatible with the current archives), whilst severely restricting new usages (by strongly warning against it and requiring using the dubious mirrors to obtain the software).
      - Zancarius 12y ago
        > This means that if (in five years) you find an archive that you can't open without TrueCrypt (and you uninstalled it etc) you'll still be easily able to find a signed version that will decrypt it for you. That still doesn't seem to answer the point. The differences between 7.1* and the questionable 7.2 are exclusively limited to what was ripped out. In 5 years, 7.1 and 7.2 will likely work precisely the same in terms of decryption. If a glibc update or similar breaks 7.1, it'll likely break 7.2. Perhaps I wasn't clear enough in my first comment, but fundamentally it seems like a silly argument to make to suggest that distributing a new release for some measure of future proofing readability is necessary. Outside "don't use this, it's broken," I can't really see "this will still work in 5 years' time" as a valid reason.
  - rflig 12y ago
    No matter how far in the future: If you find an 'old' TC volume/drive all you need to do is to install Win2k/XP/Vista/7, install TC 7.1a and decrypt. There's simply no need and practical use for a TC 7.2 with crippled functionality. Except one is forced by 'force majeure'. BTW: 7.1a is around on so many mirrors (and would be uploaded by enthusiasts if not) that it is ridiculous to post a crippled 7.2. Except one is forced by 'force majeure'.

by Netcob 12y ago

logicallee 12y ago

It doesn't matter why. If "we are now insecure" then the last thing you say is, "so please download these new versions, used only to decrypt your old files and nothing else." No we won't tell you what, if anything, was wrong, so you can make an informed decision.

CHY872 12y ago
The motivation would be so that if you had a TrueCrypt archive lying around on a drive that you find in 5 years time, it would be possible to decrypt it - but they don't want to allow encryption because they won't be continuing development, and so fixing future bugs will not be possible.
- Zancarius 12y ago
  If that's the motivation then in 5 years' time, who's to say the new version will work as well (assuming that it also won't be updated)? That doesn't make any sense.
  - deleted 12y ago
    [deleted]
  - CHY872 12y ago
    They're saying that one should not continue to use orphaned software (when it's so security critical). So they're stopping the distribution of the encryption part of it, and continuing to distribute the part of the software that decrypts the code. This means that if (in five years) you find an archive that you can't open without TrueCrypt (and you uninstalled it etc) you'll still be easily able to find a signed version that will decrypt it for you. At the same time, the developer clearly doesn't want people to be encrypting new archives with it, so have removed that functionality. Removing the software in total would have lead to many mirror sites springing up, most with unproved providence (and a great opportunity for exploits). This method allows an official version to still exist (unmaintained, but still compatible with the current archives), whilst severely restricting new usages (by strongly warning against it and requiring using the dubious mirrors to obtain the software).
    - Zancarius 12y ago
      > This means that if (in five years) you find an archive that you can't open without TrueCrypt (and you uninstalled it etc) you'll still be easily able to find a signed version that will decrypt it for you. That still doesn't seem to answer the point. The differences between 7.1* and the questionable 7.2 are exclusively limited to what was ripped out. In 5 years, 7.1 and 7.2 will likely work precisely the same in terms of decryption. If a glibc update or similar breaks 7.1, it'll likely break 7.2. Perhaps I wasn't clear enough in my first comment, but fundamentally it seems like a silly argument to make to suggest that distributing a new release for some measure of future proofing readability is necessary. Outside "don't use this, it's broken," I can't really see "this will still work in 5 years' time" as a valid reason.
- rflig 12y ago
  No matter how far in the future: If you find an 'old' TC volume/drive all you need to do is to install Win2k/XP/Vista/7, install TC 7.1a and decrypt. There's simply no need and practical use for a TC 7.2 with crippled functionality. Except one is forced by 'force majeure'. BTW: 7.1a is around on so many mirrors (and would be uploaded by enthusiasts if not) that it is ridiculous to post a crippled 7.2. Except one is forced by 'force majeure'.