6 ms·

This project will probably get outdated by windows 11 or 12, it will lose support and become legacy ... I don't see why people should spend money auditing it,

This project will probably get outdated by windows 11 or 12, it will lose support and become legacy ... I don't see why people should spend money auditing it, instead of building maintainable alternatives

abhididdigi 12y ago
Do you have any source to say Truecrypt becomes outdated? The last I checked, it was working just fine in Windows 8. I don't think anything would be _drastically_ changing in Windows 11 and 12.
plus 12y ago
People have already spent the money to audit it, back before development was officially discontinued. What do you expect them to do with the money? Return it to the people who donated?
nadams 12y ago
This is extremely unlikely. Windows API doesn't change that drastically between versions. Which is why people don't have to recompile their programs for newer/different versions of Windows.
- michaelt 12y ago
  Windows maintains good compatibility for userspace applications, but they don't guarantee driver compatibility. A Windows 95 program might run on Windows 7, but drivers for Windows 95 probably wouldn't! Truecrypt manages to create virtual disks that look a lot like regular disks, so I assume it does some kernel-level stuff to make that work.
Someone1234 12y ago
TrueCrypt was much more flexible than anything Windows has to offer. Bitlocker is great for enterprise-style encryption, in particular on machines with TPM chips. However many consumer machines do not include a TPM, even in 2015. TrueCrypt allowed you to encrypt individual drives, even offline drives, with no Bitlocker overhead. You also weren't required to decrypt them upon each boot like Windows' Bitlocker insists upon. Additionally TrueCrypt would also encrypt directories, USB drives, hidden volumes, various encryption algorithms, double encryption, and so on. Plus it was cross-platform friendly (or at least more so than BitLocker). What are we meant to use to move encrypted data from Linux to Windows now? 7Zip w/AES 256?
- pakled_engineer 12y ago
  Tar the directory(s) and use GnuPG/libgcrypt aes-256-gcm https://www.gnupg.org/documentation/manuals/gcrypt/Available-cipher-modes.html https://www.gnupg.org/documentation/manuals/gcrypt/Available... OpenSSL is on every system and can encrypt files with aes-256-gcm if for whatever reasons libgcrypt can't be used http://stackoverflow.com/questions/12153009/openssl-c-example-of-aes-gcm-using-evp-interfaces http://stackoverflow.com/questions/12153009/openssl-c-exampl... Tarsnap you can copy keys to any platform that will run Tarsnap http://www.tarsnap.com/man-tarsnap-keygen.1.html http://www.tarsnap.com/man-tarsnap-keygen.1.html http://jamesoff.net/site/2009/09/10/tarsnap-under-cygwin/ http://jamesoff.net/site/2009/09/10/tarsnap-under-cygwin/
  - pjc50 12y ago
    This is a huge pain for when you want to read it again. Truecrypt will let you define little mountable volumes which can be loaded as you need them.
    - pakled_engineer 12y ago
      I find tarsnap much easier/better than any block crypto mount. Intelligent backups that only synch what you've changed. Luks containers and tc-play exist if you must use a mounted container.
- bhayden 12y ago
  Not to mention how much the US governments advocates against encryption they can't have backdoors to. They have a lot more influence over the encryption in Windows than TrueCrypt. Not suggesting they DO have backdoors to Bitlocker, there's not enough evidence, but the probability is much higher.
  - TehCorwiz 12y ago
    They do in the form of OneDrive. https://news.ycombinator.com/item?id=8546524 https://news.ycombinator.com/item?id=8546524 Short story is that if you use Windows 8{.1} and have a Microsoft account then it will upload your BitLocker keys by default. Seems to me like a backdoor if ever I heard one.
cjg 12y ago
Not sure why you've been downvoted. There is no active development on the project any more and it doesn't work with UEFI. There's no free full disk encryption for Windows users with modern (UEFI) boxes. The money would be better spent on that, but returning crowdfunded money... tricky.
- markcerqueira 12y ago
  This is HackerNews. Being right doesn't get you upvotes.
jszymborski 12y ago
I think the main issue with encryption from windows is the lack of opacity. https://en.wikipedia.org/wiki/BitLocker#Security_concerns https://en.wikipedia.org/wiki/BitLocker#Security_concerns
- higherpurpose 12y ago
  I don't think he meant use Bitlocker, but that the current Truecrypt will stop working in Windows 11 or 12. Or you can start trusting forks of Truecrypt that base their code on the post-audit code for Truecrypt.
  - jszymborski 12y ago
    Ah, oops. But yah, overall I think auditing TrueCrypt is just as relevant today as it was when it was stalled in development and they raised the funds.
- torrance 12y ago
  I think the word you're looking for is 'transparency'.
  - jszymborski 12y ago
    right, I would have rather written "their opacity", rather than "their lack of opacity".
IvyMike 12y ago
If any of the TrueCrypt forks gain traction, this will be useful as at least it establishes an audited baseline. (TrueCrypt had a weird license that makes forking a little strange; more here: https://security.stackexchange.com/questions/58994/are-there-any-reasonable-truecrypt-forks https://security.stackexchange.com/questions/58994/are-there... ) (Edit: just saw tptacek recommending against the forks. I guess this is uglier than I thought. https://news.ycombinator.com/item?id=9069708 https://news.ycombinator.com/item?id=9069708 )
- tptacek 12y ago
  I would use the word "messy" in preference to "ugly", since I think there are best intentions all around in this situation.
EliRivers 12y ago
I don't see why people should spend money auditing it, instead of building maintainable alternatives When someone builds a new one (as happens every other day), we'll have to start again, right back at the beginning, fixing all the bugs in it and auditing it. About halfway through that process, someone will come along and say "I don't see why people should spend money auditing it, instead of building maintainable alternatives"... There will always be new projects doing things in different ways. That's no reason not to make sure that something we have now works properly.

abhididdigi 12y ago

Do you have any source to say Truecrypt becomes outdated? The last I checked, it was working just fine in Windows 8. I don't think anything would be _drastically_ changing in Windows 11 and 12.

plus 12y ago

People have already spent the money to audit it, back before development was officially discontinued. What do you expect them to do with the money? Return it to the people who donated?

nadams 12y ago

This is extremely unlikely. Windows API doesn't change that drastically between versions. Which is why people don't have to recompile their programs for newer/different versions of Windows.

michaelt 12y ago
Windows maintains good compatibility for userspace applications, but they don't guarantee driver compatibility. A Windows 95 program might run on Windows 7, but drivers for Windows 95 probably wouldn't! Truecrypt manages to create virtual disks that look a lot like regular disks, so I assume it does some kernel-level stuff to make that work.

Someone1234 12y ago

TrueCrypt was much more flexible than anything Windows has to offer. Bitlocker is great for enterprise-style encryption, in particular on machines with TPM chips. However many consumer machines do not include a TPM, even in 2015. TrueCrypt allowed you to encrypt individual drives, even offline drives, with no Bitlocker overhead. You also weren't required to decrypt them upon each boot like Windows' Bitlocker insists upon. Additionally TrueCrypt would also encrypt directories, USB drives, hidden volumes, various encryption algorithms, double encryption, and so on. Plus it was cross-platform friendly (or at least more so than BitLocker). What are we meant to use to move encrypted data from Linux to Windows now? 7Zip w/AES 256?

pakled_engineer 12y ago
Tar the directory(s) and use GnuPG/libgcrypt aes-256-gcm https://www.gnupg.org/documentation/manuals/gcrypt/Available-cipher-modes.html https://www.gnupg.org/documentation/manuals/gcrypt/Available... OpenSSL is on every system and can encrypt files with aes-256-gcm if for whatever reasons libgcrypt can't be used http://stackoverflow.com/questions/12153009/openssl-c-example-of-aes-gcm-using-evp-interfaces http://stackoverflow.com/questions/12153009/openssl-c-exampl... Tarsnap you can copy keys to any platform that will run Tarsnap http://www.tarsnap.com/man-tarsnap-keygen.1.html http://www.tarsnap.com/man-tarsnap-keygen.1.html http://jamesoff.net/site/2009/09/10/tarsnap-under-cygwin/ http://jamesoff.net/site/2009/09/10/tarsnap-under-cygwin/
- pjc50 12y ago
  This is a huge pain for when you want to read it again. Truecrypt will let you define little mountable volumes which can be loaded as you need them.
  - pakled_engineer 12y ago
    I find tarsnap much easier/better than any block crypto mount. Intelligent backups that only synch what you've changed. Luks containers and tc-play exist if you must use a mounted container.
bhayden 12y ago
Not to mention how much the US governments advocates against encryption they can't have backdoors to. They have a lot more influence over the encryption in Windows than TrueCrypt. Not suggesting they DO have backdoors to Bitlocker, there's not enough evidence, but the probability is much higher.
- TehCorwiz 12y ago
  They do in the form of OneDrive. https://news.ycombinator.com/item?id=8546524 https://news.ycombinator.com/item?id=8546524 Short story is that if you use Windows 8{.1} and have a Microsoft account then it will upload your BitLocker keys by default. Seems to me like a backdoor if ever I heard one.

cjg 12y ago

Not sure why you've been downvoted. There is no active development on the project any more and it doesn't work with UEFI. There's no free full disk encryption for Windows users with modern (UEFI) boxes. The money would be better spent on that, but returning crowdfunded money... tricky.

markcerqueira 12y ago
This is HackerNews. Being right doesn't get you upvotes.

jszymborski 12y ago

I think the main issue with encryption from windows is the lack of opacity. https://en.wikipedia.org/wiki/BitLocker#Security_concerns https://en.wikipedia.org/wiki/BitLocker#Security_concerns

higherpurpose 12y ago
I don't think he meant use Bitlocker, but that the current Truecrypt will stop working in Windows 11 or 12. Or you can start trusting forks of Truecrypt that base their code on the post-audit code for Truecrypt.
- jszymborski 12y ago
  Ah, oops. But yah, overall I think auditing TrueCrypt is just as relevant today as it was when it was stalled in development and they raised the funds.
torrance 12y ago
I think the word you're looking for is 'transparency'.
- jszymborski 12y ago
  right, I would have rather written "their opacity", rather than "their lack of opacity".

IvyMike 12y ago

If any of the TrueCrypt forks gain traction, this will be useful as at least it establishes an audited baseline. (TrueCrypt had a weird license that makes forking a little strange; more here: https://security.stackexchange.com/questions/58994/are-there-any-reasonable-truecrypt-forks https://security.stackexchange.com/questions/58994/are-there... ) (Edit: just saw tptacek recommending against the forks. I guess this is uglier than I thought. https://news.ycombinator.com/item?id=9069708 https://news.ycombinator.com/item?id=9069708 )

tptacek 12y ago
I would use the word "messy" in preference to "ugly", since I think there are best intentions all around in this situation.

EliRivers 12y ago

I don't see why people should spend money auditing it, instead of building maintainable alternatives When someone builds a new one (as happens every other day), we'll have to start again, right back at the beginning, fixing all the bugs in it and auditing it. About halfway through that process, someone will come along and say "I don't see why people should spend money auditing it, instead of building maintainable alternatives"... There will always be new projects doing things in different ways. That's no reason not to make sure that something we have now works properly.