4 ms·

>If I had to wager a crazy bet, I would go with newly developed Dead-Man's-Switch gone wrong. That's an interesting thought, although I don't think there's any

>If I had to wager a crazy bet, I would go with newly developed Dead-Man's-Switch gone wrong. That's an interesting thought, although I don't think there's any way to verify that it's actually gone 'wrong', is there?

BoppreH 12y ago
If it was operator error during the development of a Dead-Man's-Switch, the developer will probably come out in public explaining the situation and apologizing. And if this is a Dead-Man's-Switch gone right, why are they advocating the use of BitLocker and searching for random Linux packages? Edit: is "coming out in public" the correct term here? I have a feeling it only applies to closet-like scenarios.
- Shank 12y ago
  If it was a hastily constructed DMS (such as in the event of imminent threat), the author may not have had time to research and test a comparable Linux alternative. If you knew that something bad could happen, you would work as fast as possible to set it up, rather than risk not being able to have anything working in time. The reason why is quite simple: if a malicious third party were to raid or steal the private key, this kind of deterrent message should act as ample warning not to trust any further releases than what has already been released. If a government agent were to capture a developer and hold him or her hostage to attain the key (and thus release a backdoor), this type of DMS would immediately draw scrutiny to any actor attempting to release a new version that claims differently. If anything, the implicit statement is "continue using 7.1a and do not update beyond that in the event that something newer is offered." In light of the recent audit, it appears that 7.1a is secure -- and as a result, it can still be used for cryptography purposes (however subsequent releases may not).
  - BoppreH 12y ago
    Why have dozens of steps and seventeen screenshots detailing how to migrate a Windows partition and only a joke line for the Linux version? And why Bitlocker? Then there was the license change, new version with different features... This imbalance of effort strikes me as incredibly odd if the author was merely rushed.
    - vertis 12y ago
      Linux users can be trusted to work things out for themselves?
      - npsimons 12y ago
        I'll wager most Linux users don't even use TrueCrypt, since we've had FDE in the form of LUKS/DMcrypt since forever, and could not give a damn about being able to read those partitions from other OSes (as if! Since when do Windows and OSX support Linux filesystems? it's always been the other way around).
  - Zancarius 12y ago
    I just had a thought that might negate such a thing in the eyes of the general public (or at least the easily trusting sorts). Let's assume that this is a faulty DMS that was slapped together due to imminent threat by state actors. If these state actors were sufficiently powerful, couldn't they instead press ahead anyway with obtaining the developer's private keys, account data, etc., while publicly parading either the real developer (or an actor) in front of the spotlight briefly enough to claim that this was all a mistake? Next, release another series of new versions (with backdoors) that are fully controlled by the state actor under the guise that they're perfectly okay. Of course, this would itself be easily defeated by either examining the history of the individual who claims to be the developer (if applicable) and through some scrutiny of the new binaries, although I'd imagine the latter would be anticipated by the actors behind the charade. The closest thing in my mind that this resembles is a warrant canary as someone else pointed out earlier today. I suppose that in effect the DMS and canary achieve roughly the same goal so perhaps I'm just splitting hairs at this point. I also don't see either of these scenarios working perfectly except to warn people who are themselves already somewhat paranoid.
- novaleaf 12y ago
  I don't think it's important what alternative they are suggesting. The important point is that the developers (?) are advocating that users stop using their product. Forest through the trees, if you will.
- exarch 12y ago
  >And if this is a Dead-Man's-Switch gone right, why are they advocating the use of BitLocker and searching for random Linux packages? One possibility is that they did it this way specifically because it's legally compliant with some order they got, but suspicious enough to raise alarm in the tech community and telegraph that something has gone deeply, deeply wrong. This could be a warrant canary.

BoppreH 12y ago

If it was operator error during the development of a Dead-Man's-Switch, the developer will probably come out in public explaining the situation and apologizing. And if this is a Dead-Man's-Switch gone right, why are they advocating the use of BitLocker and searching for random Linux packages? Edit: is "coming out in public" the correct term here? I have a feeling it only applies to closet-like scenarios.

Shank 12y ago
If it was a hastily constructed DMS (such as in the event of imminent threat), the author may not have had time to research and test a comparable Linux alternative. If you knew that something bad could happen, you would work as fast as possible to set it up, rather than risk not being able to have anything working in time. The reason why is quite simple: if a malicious third party were to raid or steal the private key, this kind of deterrent message should act as ample warning not to trust any further releases than what has already been released. If a government agent were to capture a developer and hold him or her hostage to attain the key (and thus release a backdoor), this type of DMS would immediately draw scrutiny to any actor attempting to release a new version that claims differently. If anything, the implicit statement is "continue using 7.1a and do not update beyond that in the event that something newer is offered." In light of the recent audit, it appears that 7.1a is secure -- and as a result, it can still be used for cryptography purposes (however subsequent releases may not).
- BoppreH 12y ago
  Why have dozens of steps and seventeen screenshots detailing how to migrate a Windows partition and only a joke line for the Linux version? And why Bitlocker? Then there was the license change, new version with different features... This imbalance of effort strikes me as incredibly odd if the author was merely rushed.
  - vertis 12y ago
    Linux users can be trusted to work things out for themselves?
    - npsimons 12y ago
      I'll wager most Linux users don't even use TrueCrypt, since we've had FDE in the form of LUKS/DMcrypt since forever, and could not give a damn about being able to read those partitions from other OSes (as if! Since when do Windows and OSX support Linux filesystems? it's always been the other way around).
- Zancarius 12y ago
  I just had a thought that might negate such a thing in the eyes of the general public (or at least the easily trusting sorts). Let's assume that this is a faulty DMS that was slapped together due to imminent threat by state actors. If these state actors were sufficiently powerful, couldn't they instead press ahead anyway with obtaining the developer's private keys, account data, etc., while publicly parading either the real developer (or an actor) in front of the spotlight briefly enough to claim that this was all a mistake? Next, release another series of new versions (with backdoors) that are fully controlled by the state actor under the guise that they're perfectly okay. Of course, this would itself be easily defeated by either examining the history of the individual who claims to be the developer (if applicable) and through some scrutiny of the new binaries, although I'd imagine the latter would be anticipated by the actors behind the charade. The closest thing in my mind that this resembles is a warrant canary as someone else pointed out earlier today. I suppose that in effect the DMS and canary achieve roughly the same goal so perhaps I'm just splitting hairs at this point. I also don't see either of these scenarios working perfectly except to warn people who are themselves already somewhat paranoid.
novaleaf 12y ago
I don't think it's important what alternative they are suggesting. The important point is that the developers (?) are advocating that users stop using their product. Forest through the trees, if you will.
exarch 12y ago
>And if this is a Dead-Man's-Switch gone right, why are they advocating the use of BitLocker and searching for random Linux packages? One possibility is that they did it this way specifically because it's legally compliant with some order they got, but suspicious enough to raise alarm in the tech community and telegraph that something has gone deeply, deeply wrong. This could be a warrant canary.