7 ms·

The element that does not square with any theories that suggest benevolent intent behind the change is the recommendation that users switch to Bitlocker. Surely

by 4bpp 12y ago

The element that does not square with any theories that suggest benevolent intent behind the change is the recommendation that users switch to Bitlocker. Surely, a Truecrypt developer who got served a gagging order to build in a backdoor would realise that a big and compliant target such as Microsoft would have been subject to the same measure long ago, and likewise that if a pre-existing vulnerability on a sufficient scale to justify this went unnoticed in an open-source project even after a proper audit, the situation is unlikely to look that much better in a closed-source solution (that only the makers and government agencies have access to). While this might be reading a tad much into it, the language of the announcement, specifically the "...as it may contain unfixed security issues" bit, sounds like what somebody who just came out on the losing end of a heated debate about whether some bug-feature should or should not be considered the former would say. Knowing the vitriol and determination with which software developer arguments are often carried out, this would explain the observed combination of remarkable dedication and haphazard execution.

UVB-76 12y ago
> The element that does not square with any theories that suggest benevolent intent behind the change is the recommendation that users switch to Bitlocker. I realize we are firmly in conspiracy theory territory here, but perhaps the suggestion that users switch to Bitlocker is intended to be so patently absurd as to be a signal that the developers are under duress?
- jebblue 12y ago
  I'd agree, that seems more believable than some of the other theories I've read.
- dsuth 12y ago
  That's my take on it as well, even though it fails the Occam's razor test. This all sounds like a very understated way of saying "we can no longer develop truecrypt with impunity, and the only other options are closed source, and highly likely to be compromised out of the gate".
- tacotime 12y ago
  This is currently my favorite theory, for lack of a better word. It's also potentially pretty disturbing news. I saw another user mention the term warrant canary. I'd call it a warrant canary for the cautious/well informed. Unless there is some serious action on the horizon, no one well informed will ever use a truecrypt release past 7.2 ever again. https://en.wikipedia.org/wiki/Warrant_canary https://en.wikipedia.org/wiki/Warrant_canary My very first thought upon hearing this news was that just maybe the trucrypt devs are secretly cheering for others to come and replace the hole they fill in this world. Maybe this is the best possible thing they could do to inspire the next generation of truecrypt. They've laid a good foundation but they know they can't win the war for free information security on their own. So what better good could they do than to inspire the mother of invention; necessity.
Adaptive 12y ago
Agreed on the language/vitriol interpretation. I was thinking the same when I listed rogue content maintainer.
deleted 12y ago
[deleted]
tomku 12y ago
As crazy as it sounds, I think you're right and it's just the developer(s) quitting (rage-quitting?) the project. Nothing else makes sense. The Bitlocker thing seems strange until you realize that it probably really IS the best alternative for most users. The users who are paranoid enough to not trust Bitlocker can probably look out for their own security, so it makes sense to give instructions for the rest. None of the explanations people have came up with regarding intelligence agencies and conspiracies really hold water. If the devs were compromised, I doubt they would be given the freedom to post something like they did today. If they were under some kind of NSL or gag order, this would almost certainly violate it.
- danrik 12y ago
  No more than shutting down Lavabit violated whatever NSLs/court orders were directed at it.
- mercer 12y ago
  > The Bitlocker thing seems strange until you realize that it probably really IS the best alternative for most users. The users who are paranoid enough to not trust Bitlocker can probably look out for their own security, so it makes sense to give instructions for the rest. It seems odd to me that security specialists would recommend a flawed tool to 'the masses'. It just doesn't fit with what I usually read from people in this line of work.
  - tomku 12y ago
    It's pragmatic. BitLocker may or may not be flawed[1], but I don't see a lot of better options for disk encryption on Windows being presented. [1] - Whether it's flawed or not depends on your needs. Not everyone cares about defending their data against an attacker with the resources of a nation-state - many just want their laptop's hard drives to be effectively inaccessible if the device is stolen or lost.

by 4bpp 12y ago

UVB-76 12y ago

> The element that does not square with any theories that suggest benevolent intent behind the change is the recommendation that users switch to Bitlocker. I realize we are firmly in conspiracy theory territory here, but perhaps the suggestion that users switch to Bitlocker is intended to be so patently absurd as to be a signal that the developers are under duress?

jebblue 12y ago
I'd agree, that seems more believable than some of the other theories I've read.
dsuth 12y ago
That's my take on it as well, even though it fails the Occam's razor test. This all sounds like a very understated way of saying "we can no longer develop truecrypt with impunity, and the only other options are closed source, and highly likely to be compromised out of the gate".
tacotime 12y ago
This is currently my favorite theory, for lack of a better word. It's also potentially pretty disturbing news. I saw another user mention the term warrant canary. I'd call it a warrant canary for the cautious/well informed. Unless there is some serious action on the horizon, no one well informed will ever use a truecrypt release past 7.2 ever again. https://en.wikipedia.org/wiki/Warrant_canary https://en.wikipedia.org/wiki/Warrant_canary My very first thought upon hearing this news was that just maybe the trucrypt devs are secretly cheering for others to come and replace the hole they fill in this world. Maybe this is the best possible thing they could do to inspire the next generation of truecrypt. They've laid a good foundation but they know they can't win the war for free information security on their own. So what better good could they do than to inspire the mother of invention; necessity.

Adaptive 12y ago

Agreed on the language/vitriol interpretation. I was thinking the same when I listed rogue content maintainer.

deleted 12y ago

[deleted]

tomku 12y ago

As crazy as it sounds, I think you're right and it's just the developer(s) quitting (rage-quitting?) the project. Nothing else makes sense. The Bitlocker thing seems strange until you realize that it probably really IS the best alternative for most users. The users who are paranoid enough to not trust Bitlocker can probably look out for their own security, so it makes sense to give instructions for the rest. None of the explanations people have came up with regarding intelligence agencies and conspiracies really hold water. If the devs were compromised, I doubt they would be given the freedom to post something like they did today. If they were under some kind of NSL or gag order, this would almost certainly violate it.

danrik 12y ago
No more than shutting down Lavabit violated whatever NSLs/court orders were directed at it.
mercer 12y ago
> The Bitlocker thing seems strange until you realize that it probably really IS the best alternative for most users. The users who are paranoid enough to not trust Bitlocker can probably look out for their own security, so it makes sense to give instructions for the rest. It seems odd to me that security specialists would recommend a flawed tool to 'the masses'. It just doesn't fit with what I usually read from people in this line of work.
- tomku 12y ago
  It's pragmatic. BitLocker may or may not be flawed[1], but I don't see a lot of better options for disk encryption on Windows being presented. [1] - Whether it's flawed or not depends on your needs. Not everyone cares about defending their data against an attacker with the resources of a nation-state - many just want their laptop's hard drives to be effectively inaccessible if the device is stolen or lost.