6 ms·

I've said this before in a few places, and it's (semi-) relevant here, but I really think people need to relax about replacing TrueCrypt. Despite the "security

by x1798DE 12y ago

I've said this before in a few places, and it's (semi-) relevant here, but I really think people need to relax about replacing TrueCrypt. Despite the "security concerns" expressed in the TrueCrypt page, which were clearly a joke, there's no reason to think TrueCrypt has any significant vulnerabilities at this time, and the second phase of the audit will take place as scheduled. The last time TrueCrypt was updated was two years ago - it's stable software that doesn't need constant tweaking, so the developers bowing out is not a problem. Chances are, someone will either fork TrueCrypt (version 3.1 of the TrueCrypt license seems to make this a legitimate possiblity) or create a replacement, possibly using the same container format. TrueCrypt is pretty much just as good as it was before this happened. Give it a couple of months before you start switching over to some other solution (which is likely to be less "battle-hardened" than the incredibly popular TrueCrypt anyway, and thus somewhat more likely to be insecure). There's no rush.

deleted 12y ago
[deleted]
Alupis 12y ago
I agree. There was no rush to switch away 6 months ago. The latest version (besides the new decrypt-only release) was over a year ago. It's pretty solid from my use-case... and the audit should relax any fears (nothing obvious has been discovered yet). I think the "security concerns" expressed on the truecrypt page are more-or-less for future visitors to understand the project is not maintained anymore (albeit a poor way to go about expressing that)
loteck 12y ago
>which were clearly a joke There's a lot of information flying around so I may have missed something. Why is the official page, which states that there are security concerns, "clearly" a joke?
- cavilling_elite 12y ago
  I think it is the flippant manner in which they expose the security concern and recommend a product few would actually use.
- x1798DE 12y ago
  Most people took TC recommending Bitlocker as a joke (myself included), because it's a closed-source proprietary encryption method made by Microsoft, which is the ethic that TrueCrypt has represented in the decade that it existed, but even if that's a bit too subtle humor, if you look at the options they give for encryption on other platforms [1], you can see that it's obviously not a serious security-based recommendation. For Linux, they recommend: >Use any integrated support for encryption. Search available installation packages for words encryption and crypt, install any of the packages found and follow its documentation. Does that seem serious to you? For Mac OSX, here is the configuration they recommend for creating an encrypted volume: http://truecrypt.sourceforge.net/OSXNewImage.png http://truecrypt.sourceforge.net/OSXNewImage.png Note where under Encryption they've selected "None". 1. http://truecrypt.sourceforge.net/OtherPlatforms.html http://truecrypt.sourceforge.net/OtherPlatforms.html
paddyoloughlin 12y ago
Looking at all the reactions, it doesn't seem that clear they were a joke.
ulms 12y ago
It seems odd that they would remove all of the binaries as well. Want to commit a readonly version? Fine. But what about now, when less technical folks might want to install TrueCrypt on a new computer? The point is, now another entity will need to establish validity as being a trusted provider; there was no reason to rock the boat per se, and as someone who laughs at most things, it just... really isn't altogether funny, unfortunately. edit: assuming that it turned out to be a joke, for the sake of discussion (though is there a difference at this point?)
- joeuser939 12y ago
  They've always removed old binaries when they release new ones. They used to ban users from their forums when they asked for old binaries. They've changed binaries too without bumping the version number and then re-released them unannounced. This has been known for a very long time now. I'm not sure why people are surprised at the latest developments: http://16s.us/software/TCHunt/TCD/readme.txt http://16s.us/software/TCHunt/TCD/readme.txt
  - ulms 12y ago
    Interesting. Admittedly I hadn't paid a lot of attention other than "get the latest release and install it", so I wasn't aware that they did any of those things. Thanks for clarifying.
zokier 12y ago
The feature request to replace TC in Tails was added to their issue tracker 11 months ago. It is not a knee-jerk reaction to todays events.
- x1798DE 12y ago
  That's why I said semi-relevant. I think the renewed interest in finding alternatives in TrueCrypt is clearly due to the devs stepping out, which is unrelated to its removal from Tails. It doesn't even seem implausible that in the (in my opinion, incredibly likely) event of a fork, the new fork will be a strong candidate for inclusion in Tails, assuming it has active development, a FOSS-compatible license and a more open development process (again, all of which may be possible). The reason I wanted to post here was to hopefully convince some people in kneejerk mode to just give the dust a bit of time to settle, since I imagine many people would be using this list to help them migrate.
higherpurpose 12y ago
I think RealCrypt is a fork of TrueCrypt (which wasn't mentioned in the post): http://rpmfusion.org/Package/realcrypt http://rpmfusion.org/Package/realcrypt
Zancarius 12y ago
> Chances are, someone will either fork TrueCrypt (version 3.1 of the TrueCrypt license seems to make this a legitimate possiblity) Given this comment and some inspiration from tacotime in this [1] post, it dawned on me: What if this whole thing is a not-so-subtle effort by the developer(s) to renew interest in TrueCrypt and pass the torch? The license ambiguity might be an issue (in terms of whether it retroactively covers encryption support in earlier versions or not), but if that were resolved, then perhaps all of this speculation, wild conspiracies, and other noise is for naught. Maybe this is their way of stepping down and saying "Hey, look, we're not maintaining this anymore. We're changing the license, so knock yourselves out." [1] https://news.ycombinator.com/item?id=7814800 https://news.ycombinator.com/item?id=7814800
- kaoD 12y ago
  As far as I know encryption wasn't removed in 7.2, just disabled via error messages. You could just fork it given the new license and reenable encryption, right?
  - TheMacMini09 12y ago
    I think that would be possible, yes.
  - Zancarius 12y ago
    If you can believe the anonymous gists that were posted a day or so ago, huge swathes of code were removed containing much/some of the encryption logic. It's possible that may not be true, but forking it would be a possibility. I'm assuming that the license changes are technically retroactive since it seems the developer(s) have decided it's time to move on (and who can blame them after 10 years?).
deleted 12y ago
[deleted]
kijin 12y ago
TrueCrypt is undoubtedly stable, but it is getting rather long in the tooth. For example, TrueCrypt can't encrypt the system drive if your computer uses UEFI and/or your boot drive has a GPT parition table. This is a major nuisance since nearly all new PCs have UEFI enabled by default. But TrueCrypt development has all but stalled for the last couple of years, and now there's zero hope of ever getting UEFI support.
ralphc 12y ago
There's been a lot of hand-wringing about the license, but if the TrueCrypt devs want to be anonymous and/or go away, who's going to complain if someone puts out another version?

by x1798DE 12y ago

deleted 12y ago

[deleted]

Alupis 12y ago

I agree. There was no rush to switch away 6 months ago. The latest version (besides the new decrypt-only release) was over a year ago. It's pretty solid from my use-case... and the audit should relax any fears (nothing obvious has been discovered yet). I think the "security concerns" expressed on the truecrypt page are more-or-less for future visitors to understand the project is not maintained anymore (albeit a poor way to go about expressing that)

loteck 12y ago

>which were clearly a joke There's a lot of information flying around so I may have missed something. Why is the official page, which states that there are security concerns, "clearly" a joke?

cavilling_elite 12y ago
I think it is the flippant manner in which they expose the security concern and recommend a product few would actually use.
x1798DE 12y ago
Most people took TC recommending Bitlocker as a joke (myself included), because it's a closed-source proprietary encryption method made by Microsoft, which is the ethic that TrueCrypt has represented in the decade that it existed, but even if that's a bit too subtle humor, if you look at the options they give for encryption on other platforms [1], you can see that it's obviously not a serious security-based recommendation. For Linux, they recommend: >Use any integrated support for encryption. Search available installation packages for words encryption and crypt, install any of the packages found and follow its documentation. Does that seem serious to you? For Mac OSX, here is the configuration they recommend for creating an encrypted volume: http://truecrypt.sourceforge.net/OSXNewImage.png http://truecrypt.sourceforge.net/OSXNewImage.png Note where under Encryption they've selected "None". 1. http://truecrypt.sourceforge.net/OtherPlatforms.html http://truecrypt.sourceforge.net/OtherPlatforms.html

paddyoloughlin 12y ago

Looking at all the reactions, it doesn't seem that clear they were a joke.

ulms 12y ago

It seems odd that they would remove all of the binaries as well. Want to commit a readonly version? Fine. But what about now, when less technical folks might want to install TrueCrypt on a new computer? The point is, now another entity will need to establish validity as being a trusted provider; there was no reason to rock the boat per se, and as someone who laughs at most things, it just... really isn't altogether funny, unfortunately. edit: assuming that it turned out to be a joke, for the sake of discussion (though is there a difference at this point?)

joeuser939 12y ago
They've always removed old binaries when they release new ones. They used to ban users from their forums when they asked for old binaries. They've changed binaries too without bumping the version number and then re-released them unannounced. This has been known for a very long time now. I'm not sure why people are surprised at the latest developments: http://16s.us/software/TCHunt/TCD/readme.txt http://16s.us/software/TCHunt/TCD/readme.txt
- ulms 12y ago
  Interesting. Admittedly I hadn't paid a lot of attention other than "get the latest release and install it", so I wasn't aware that they did any of those things. Thanks for clarifying.

zokier 12y ago

The feature request to replace TC in Tails was added to their issue tracker 11 months ago. It is not a knee-jerk reaction to todays events.

x1798DE 12y ago
That's why I said semi-relevant. I think the renewed interest in finding alternatives in TrueCrypt is clearly due to the devs stepping out, which is unrelated to its removal from Tails. It doesn't even seem implausible that in the (in my opinion, incredibly likely) event of a fork, the new fork will be a strong candidate for inclusion in Tails, assuming it has active development, a FOSS-compatible license and a more open development process (again, all of which may be possible). The reason I wanted to post here was to hopefully convince some people in kneejerk mode to just give the dust a bit of time to settle, since I imagine many people would be using this list to help them migrate.

higherpurpose 12y ago

I think RealCrypt is a fork of TrueCrypt (which wasn't mentioned in the post): http://rpmfusion.org/Package/realcrypt http://rpmfusion.org/Package/realcrypt

Zancarius 12y ago

> Chances are, someone will either fork TrueCrypt (version 3.1 of the TrueCrypt license seems to make this a legitimate possiblity) Given this comment and some inspiration from tacotime in this [1] post, it dawned on me: What if this whole thing is a not-so-subtle effort by the developer(s) to renew interest in TrueCrypt and pass the torch? The license ambiguity might be an issue (in terms of whether it retroactively covers encryption support in earlier versions or not), but if that were resolved, then perhaps all of this speculation, wild conspiracies, and other noise is for naught. Maybe this is their way of stepping down and saying "Hey, look, we're not maintaining this anymore. We're changing the license, so knock yourselves out." [1] https://news.ycombinator.com/item?id=7814800 https://news.ycombinator.com/item?id=7814800

kaoD 12y ago
As far as I know encryption wasn't removed in 7.2, just disabled via error messages. You could just fork it given the new license and reenable encryption, right?
- TheMacMini09 12y ago
  I think that would be possible, yes.
- Zancarius 12y ago
  If you can believe the anonymous gists that were posted a day or so ago, huge swathes of code were removed containing much/some of the encryption logic. It's possible that may not be true, but forking it would be a possibility. I'm assuming that the license changes are technically retroactive since it seems the developer(s) have decided it's time to move on (and who can blame them after 10 years?).

deleted 12y ago

[deleted]

kijin 12y ago

TrueCrypt is undoubtedly stable, but it is getting rather long in the tooth. For example, TrueCrypt can't encrypt the system drive if your computer uses UEFI and/or your boot drive has a GPT parition table. This is a major nuisance since nearly all new PCs have UEFI enabled by default. But TrueCrypt development has all but stalled for the last couple of years, and now there's zero hope of ever getting UEFI support.

ralphc 12y ago

There's been a lot of hand-wringing about the license, but if the TrueCrypt devs want to be anonymous and/or go away, who's going to complain if someone puts out another version?