7 ms·

That's LavaBit 2. I've been a long time TC user and if there's the trait it has it's the quality and a high degree of polish. And now looking at the diff and t

by abcd_f 12y ago

That's LavaBit 2. I've been a long time TC user and if there's the trait it has it's the quality and a high degree of polish. And now looking at the diff and the screenshot of that in-app "Not secure" message, the polish is just not there. It feels like it was something that was slapped together in a rush or by someone who's not an original developer. The SF page alone is a big red flag. If you compare its nearly hysterical tone and ridiculous BitLocker advice to the tone and content of the actual app, they don't add up at all. This leaves us with a handful of discrepancies between the last good state of the project and what's out there now. So it's either someone else's hackjob or it is original and the discrepancies are intentional. Then, factor in the .exe sig match, and it pretty much leaves only the latter option - the original devs made an absurdly non-TC-like release. The question is "why?"

selmnoo 12y ago
This is a pretty confusing case, hard to make much of it, LavaBit 2 is of course a possibility. But while we're making these theories, I wanna sound my wild theory: Considering that: (1) TrueCrypt authors go to great to keep their identities hidden, and (2) it turns out TrueCrypt is not free/open software -- TrueCrypt is actually a project by some spooky 3-letter agency. But anyway, thoughts on alternatives? CiskCryptor (http://en.wikipedia.org/wiki/DiskCryptor http://en.wikipedia.org/wiki/DiskCryptor) sounds like a nice one, it's FLOSS. Thoughts on it?
- x1798DE 12y ago
  I really don't think we need to be running to TrueCrypt alternatives quite yet. If Phase II of the audit comes back showing TrueCrypt as insecure, then it's time to start worrying about that, but given that everyone was happy to keep using TrueCrypt up until 1 day ago even though it hasn't been updated in over 2 years, I don't think there's any big rush to switch to something else even if ongoing development stops.
  - deleted 12y ago
    [deleted]
  - simonw 12y ago
    "given that everyone was happy to keep using TrueCrypt up until 1 day ago" The same was true for OpenSSL a few weeks ago. One of the most plausible theories is that the TrueCrypt developers found a gaping security hole (ala OpenSSL) and realised that releasing a fix for it would reveal the bug and compromise every TrueCrypt partition in existence, so they chose to kill the project rather than risk the safety of all of that currently encrypted data. If that scenario is true, there's a big rush to switch to something else before the bug is discovered by other researchers.
    - jdbernard 12y ago
      If that was the case, why not fix the bug and then tell everybody to upgrade to the new fixed version ASAP?
      - hack37 12y ago
        by fixing the bug you tell everybody what/where the bug is and if anybody has a copy of someone else encrypted disk (think external backup, amazon etc..) they can decrypt it.
      - skolor 12y ago
        That's effectively the same thing as releasing details of the bug. It would take time to take the patch and figure out the bug from it, but it would be fairly easily done for a determined attacker.
    - x1798DE 12y ago
      Their warning about it being insecure is clearly a joke, as their alternate suggestions (particularly for linux and Mac) are ones that no one should ever take seriously. TrueCrypt passed Phase I of the audit, and Phase II of the audit is coming down the pipe soon enough. Also keep in mind that TrueCrypt is one of the most widely-used cross-platform drive encryption tools and has been for some time. It seems far more likely to me that TrueCrypt is secure than that a more obscure competitor, no matter what the developers say in a weird, cryptic message that everyone assumed was their site being hacked.
    - 12y ago
- e40 12y ago
  TrueCrypt authors go to great to keep their identities hidden I donated at least two times to them via PayPal. How anonymous could they be if they got funds via PayPal? Not very, in this day and age. I would image it's trivial for the US government to find their true names based on this fact alone.
  - pekk 12y ago
    Since this thread is all about paranoia, how did you verify that anyone ultimately received the funds?
    - e40 12y ago
      Obviously, I could not. truecrypt.org had a donate button which redirected to a paypal page, and I donated. I'm assuming they wouldn't set up a donation method that merely gave the funds to paypal.
  - intelliot 12y ago
    What's their PayPal identity?
wahsd 12y ago
I just don't quite understand the panic about microsoft not supporting XP anymore. It's not like that was a surprise announcement or even that the deadline was just met. It was April 8th....and TrueCrypt just now shut down in panic? ...Because XP support stopped??? WTF is going on? It's not even like support means anything, other than that they will no longer improve or fix it, i.e., there's still time to migrate away as XP degrades. It says nothing about whether XP is secure in and of itself. This whole incident is about as weird as weird gets. I saw a post that suggested it might be a canary, i.e., an event that must be interpreted as a certain action having taken place...a negative message....an absence of an indication that everything is ok. But that also seems odd since I am not quite sure that if TrueCrypt people were who we all want to believe they were, would suggest using bitLocker. bitLocker??? Alone that suggestion smells like rotten fish just by its association with MS and the US government. You should put money on the fact that it really was someone associated with certain ever increasingly fascist governments of, likely the USA or Israel, that compromised TrueCrypt in a way that set off an "auto-destruct" sequence. It's probably a reaction to the Snowden compromise, with increased funding and efforts to regain domination that he exposed by becoming even more totalitarian through an "Operation Kristallnacht" sprint against civilian institutions.
- codeulike 12y ago
  * bitLocker??? Alone that suggestion smells like rotten fish * The Bitlocker recommendation does seem strange. But when you look around the Windows ecosystem, there isn't much else that could be recommended. What would you recommend Windows people use, other than Bitlocker?
  - dublinben 12y ago
    TrueCrypt 7.1a is still safe to use. So is GPG.
    - phpnode 12y ago
      how do you conclude that any TrueCrypt version is secure in light of this disclosure?
higherpurpose 12y ago
If TruCrypt got taken over, it should tell us something that they recommended Bitlocker (about Bitlocker).
CWuestefeld 12y ago
There's another possibility that I haven't seen mentioned yet. It could be that the developer(s) want to get out anyway. The fact that they've been doing it for so long indicates that they've got some strong feelings about privacy. Perhaps they're staging the whole thing as their way out, to make a political statement, pushing us further to do something about the government's stand on privacy.
dendory 12y ago
The whole message on the site makes no sense and I think that's on purpose. What likely happened is the US gov found the TC authors, then used their weight to try and get them to back door the binaries. Authors didn't want to, but couldn't publicize the letters without going to jail, so they made up the most ridiculous story for why they were giving up on the project, the best possible outcome so that they wouldn't go to jail and wouldn't subject users to the required back door.
- jordigh 12y ago
  This is the most plausible explanation I have seen so far.
- at-fates-hands 12y ago
  This my first thought when I read it and how it ended so abruptly. Conspiracy theories not withstanding, it's clear someone or some agency got to the developers and they just pulled the ejection seat for their own legal protection. Can't say I blame them. I've had the feds show up where I lived once and I nearly shit a brick when I realized what was going on. You never want the weight the government beating down your back.

by abcd_f 12y ago

selmnoo 12y ago

This is a pretty confusing case, hard to make much of it, LavaBit 2 is of course a possibility. But while we're making these theories, I wanna sound my wild theory: Considering that: (1) TrueCrypt authors go to great to keep their identities hidden, and (2) it turns out TrueCrypt is not free/open software -- TrueCrypt is actually a project by some spooky 3-letter agency. But anyway, thoughts on alternatives? CiskCryptor (http://en.wikipedia.org/wiki/DiskCryptor http://en.wikipedia.org/wiki/DiskCryptor) sounds like a nice one, it's FLOSS. Thoughts on it?

x1798DE 12y ago
I really don't think we need to be running to TrueCrypt alternatives quite yet. If Phase II of the audit comes back showing TrueCrypt as insecure, then it's time to start worrying about that, but given that everyone was happy to keep using TrueCrypt up until 1 day ago even though it hasn't been updated in over 2 years, I don't think there's any big rush to switch to something else even if ongoing development stops.
- deleted 12y ago
  [deleted]
- simonw 12y ago
  "given that everyone was happy to keep using TrueCrypt up until 1 day ago" The same was true for OpenSSL a few weeks ago. One of the most plausible theories is that the TrueCrypt developers found a gaping security hole (ala OpenSSL) and realised that releasing a fix for it would reveal the bug and compromise every TrueCrypt partition in existence, so they chose to kill the project rather than risk the safety of all of that currently encrypted data. If that scenario is true, there's a big rush to switch to something else before the bug is discovered by other researchers.
  - jdbernard 12y ago
    If that was the case, why not fix the bug and then tell everybody to upgrade to the new fixed version ASAP?
    - hack37 12y ago
      by fixing the bug you tell everybody what/where the bug is and if anybody has a copy of someone else encrypted disk (think external backup, amazon etc..) they can decrypt it.
    - skolor 12y ago
      That's effectively the same thing as releasing details of the bug. It would take time to take the patch and figure out the bug from it, but it would be fairly easily done for a determined attacker.
  - x1798DE 12y ago
    Their warning about it being insecure is clearly a joke, as their alternate suggestions (particularly for linux and Mac) are ones that no one should ever take seriously. TrueCrypt passed Phase I of the audit, and Phase II of the audit is coming down the pipe soon enough. Also keep in mind that TrueCrypt is one of the most widely-used cross-platform drive encryption tools and has been for some time. It seems far more likely to me that TrueCrypt is secure than that a more obscure competitor, no matter what the developers say in a weird, cryptic message that everyone assumed was their site being hacked.
  - 12y ago
e40 12y ago
TrueCrypt authors go to great to keep their identities hidden I donated at least two times to them via PayPal. How anonymous could they be if they got funds via PayPal? Not very, in this day and age. I would image it's trivial for the US government to find their true names based on this fact alone.
- pekk 12y ago
  Since this thread is all about paranoia, how did you verify that anyone ultimately received the funds?
  - e40 12y ago
    Obviously, I could not. truecrypt.org had a donate button which redirected to a paypal page, and I donated. I'm assuming they wouldn't set up a donation method that merely gave the funds to paypal.
- intelliot 12y ago
  What's their PayPal identity?

wahsd 12y ago

I just don't quite understand the panic about microsoft not supporting XP anymore. It's not like that was a surprise announcement or even that the deadline was just met. It was April 8th....and TrueCrypt just now shut down in panic? ...Because XP support stopped??? WTF is going on? It's not even like support means anything, other than that they will no longer improve or fix it, i.e., there's still time to migrate away as XP degrades. It says nothing about whether XP is secure in and of itself. This whole incident is about as weird as weird gets. I saw a post that suggested it might be a canary, i.e., an event that must be interpreted as a certain action having taken place...a negative message....an absence of an indication that everything is ok. But that also seems odd since I am not quite sure that if TrueCrypt people were who we all want to believe they were, would suggest using bitLocker. bitLocker??? Alone that suggestion smells like rotten fish just by its association with MS and the US government. You should put money on the fact that it really was someone associated with certain ever increasingly fascist governments of, likely the USA or Israel, that compromised TrueCrypt in a way that set off an "auto-destruct" sequence. It's probably a reaction to the Snowden compromise, with increased funding and efforts to regain domination that he exposed by becoming even more totalitarian through an "Operation Kristallnacht" sprint against civilian institutions.

codeulike 12y ago
* bitLocker??? Alone that suggestion smells like rotten fish * The Bitlocker recommendation does seem strange. But when you look around the Windows ecosystem, there isn't much else that could be recommended. What would you recommend Windows people use, other than Bitlocker?
- dublinben 12y ago
  TrueCrypt 7.1a is still safe to use. So is GPG.
  - phpnode 12y ago
    how do you conclude that any TrueCrypt version is secure in light of this disclosure?

higherpurpose 12y ago

If TruCrypt got taken over, it should tell us something that they recommended Bitlocker (about Bitlocker).

CWuestefeld 12y ago

There's another possibility that I haven't seen mentioned yet. It could be that the developer(s) want to get out anyway. The fact that they've been doing it for so long indicates that they've got some strong feelings about privacy. Perhaps they're staging the whole thing as their way out, to make a political statement, pushing us further to do something about the government's stand on privacy.

dendory 12y ago

The whole message on the site makes no sense and I think that's on purpose. What likely happened is the US gov found the TC authors, then used their weight to try and get them to back door the binaries. Authors didn't want to, but couldn't publicize the letters without going to jail, so they made up the most ridiculous story for why they were giving up on the project, the best possible outcome so that they wouldn't go to jail and wouldn't subject users to the required back door.

jordigh 12y ago
This is the most plausible explanation I have seen so far.
at-fates-hands 12y ago
This my first thought when I read it and how it ended so abruptly. Conspiracy theories not withstanding, it's clear someone or some agency got to the developers and they just pulled the ejection seat for their own legal protection. Can't say I blame them. I've had the feds show up where I lived once and I nearly shit a brick when I realized what was going on. You never want the weight the government beating down your back.