Estel | # 51 | 2014-10-02, 00:57 | Report

I'm genuinely shocked, and very disappointed with former TrueCrypt developers (even though I understand that the might have been put in very hard situation, what they did is just wrong,especially the form). I don't know what happened no surprise, almost no one really know), but I see 3 separate possibilities:

1. (unlikely, IMO) - Truecrypt had backdoor, and developers suspected that some subsequent pass of grand code audit (that is going on for some long time, already) will reveal it.

2. Considering, that TrueCrypt was used by activists, anti-government protesters, whistleblowers, and sometimes even terrorists from all around the world - i.e. all bunch of folkf that gov guys doesn't like, for different reasons, including the most famous case of Snowden and journalists that cooperated with him - someone (probably a group of governments following USA initiative, not a single one) decided to shut TrueCrypt down, on the excuse of cryptoanarchy threat. Now, they could have done it via two ways;

2a. Offering TrueCrypt developers a large (as in big, big, biiiig) amount of money, big enough to make them "forget" why they were working on truecrypt.

2b. Threatening TrueCrypt developers with something very, very serious, probably on various levels. I would be surprised, if they would experience both official and unofficial forms of pressure, including, but not limited to, things that seriously threatened their lives or lives of their relatives/loved ones. It could have gone to the point that they just simply told themselves "**** this!" - not everyone is a type that is willing to sacrifice so important things for higher good, and I can pretty good understand that (not agree with, but understand).

2a + 2b. Mix off all of the above things.
---

Now, a small disclaimer - usually, I'm not into conspiracy theories. But software like TrueCrypt don't just disappear overnight for no reason, and the thing they have done to the code and license clearly states planned action, probably months before. Still, not-so long ago, TrueCrypt had clear roadmap (just like it had all those years before), including support for windoze 8 etc! They never gave a **** about windows stopping XP updates, that's for sure.

There is also the LavaBit case (which was also used by Snowden), and how gov tried to force it's owner to include NSA plugins - forcing him to cease development the same way, just much less secretively (but LavaBit wasn't as big as TrueCrypt, and definitely not as viable for forking by 3th party).

Last but not least, the suggestion to use BitLocker is a plain joke. It's clearly done by TrueCrypt devs in a way that speaks between the lines, on purpose. Which would suggest variant 2b as more viable. Of course there is that thing with first letters of announcement and (crippled) latin, which isn't exactly my cup of tea, but still seems like a way too strange coincidence.
---

Summing it up, the way it was done states clearly, that 3th party was involved in TrueCrypt - that is the thing I'm, personally, sure about.

The whole thing put security of using any TrueCrypt in doubt - at the same time, when TrueCrypt got closed, while still having perfectly working 7.1 version, used successfully by thousands, including Snowden - another too strange coincidence. It almost looks like some party *want* people to stop using TrueCrypt (although believing people will just move to bitlocker is plain silly and I don't think anyone is so stupid to count on it... Thought, with gov guys, you never know, they're not most able and dependable folk, honestly).

Out best hope is the audit, and continuation of code development by FOSS Community under different name, by less secretive team (TrueCrypt team was never very transparent, to be honest - although, the code was...) - I really hope for it to happen, and I'm quite disappointed that it haven't sparked much more interest in helping the audit, by knowledgeable folks (especially, changes in code during last few years).

Personally, I'm going to still use latest "real" version, both on desktop and N900 for my selectivity-critical needs.

/Estel

shawnjefferson | # 52 | 2014-10-03, 06:07 | Report

Or it could be exactly what the developers said: they were getting bored with it, and with encryption freely available on Windows and Linux, they saw no great need for their software anymore.

Besides, anyone is free to take it up and continue it on. Nothing was stopped or prevented. If you are believer in conspiracy theories, they could have just killed the developer(s), taken over their Internet identities and continued to provide a back-doored encryption software.

ste-phan | # 53 | 2014-10-03, 08:02 | Report

What do you think about the commercial option by Jetico (Finland) and their alternative, BestCrypt?

-Req: Linux 2.6.x or higher, libudev, Qt4 (optional, for GUI)
-Marketing tag line: TrueCrypt users, welcome to BestCrypt!

> Familiar 'Volume' and 'Container' structure
> No backdoors – check our source code

As a reference, I am currently using the Jetico Firewall to get a Windows 8 media machine walking in line with regards of aggressive phoning home behavior.
It has a price tag but on the other hand, I feel I finally got the stuff I was looking for!

Jedibeeftrix | # 54 | 2014-10-03, 08:50 | Report

i tend to the theory that legal pressure forced the devs to cease work in the way that they did, and that the existing product is as secure as anything else out there (until proved otherwise).

so, as far as I am concerned, as long as TC works fine on Windows 10 I'm good for another five years.

Estel | # 55 | 2014-10-03, 23:42 | Report

I don't think so - they "tips" on moving to other encryption methods they've left on their website are TERRIBLE, especially compared to usual TrueCrypt manuals, that many, many, many times stressed the importance of avoiding side-channels attacks, untrusted/unsigned sources of encryption software, etc.

The instructions left on the site are:
---

a) for linux - search for anything with "crypt" in name, install it and use. ROTFL!

b) for windows - use build-in encryption software provided by company known and proven to contain hooks for all major agencies that might be interested in your data. LMAO!
---

Anyone who have, even once, read TrueCrypt manual with understanding, notice that it's pure irony, on the very first sight. It is giving so ridiculous "tips for security", that it MUST be done on purpose - targeted on people that used TrueCrypt for serious things, as they notice irony/absurdity, immediately.
---

I have thought about it a little more - especially the fact, that TrueCrypt developers always tried (and to most point, succeed) to stay completely anonymous, at the same time, giving really professional tips about plausible dependability, etc. I think that it gives us some hint on the country they might have been from, and by extension, to the reasons of TrueCrypt closure.

In my opinion, they were either from one of the countries that REALLY breaks human rights in brutal way (think iran, etc), or from the country that have legal mechanisms to issue warrants that also deny even *informing* anyone that you got this warrant issued, under severe penalty threat - aka, USA (or one of the countries that works very closely with USA and respect their warrants - think UK).

In the latter case - which I think makes more sense, in the light of recent developments - devs stressed their anonymity so much, to avoid getting such warrants, obliging them to provide backdoors. Instead of guarding themselves with shield of lawyers (which is expensive) and, sooner or later, being forced to do legal fight for their right to provied REAL truecrypt (with such fight being exhausting, emotionally and financially), they decided to just avoid it, by remaining unknown to any agencies.

Now, it obviously worked for many years, but TrueCrypt had become more and more PITA for various agencies (including public informations about their failures to break truecrypt-encrypted disks in some major cases). As a cherry on top, the biggest USA intelligence failure - Snowden thing - happened, and whole world get to know what tools he used to securely leave USA intelligence with their pants down.

I guess that they decided that "enough is enough", and did considerable effort to track TrueCrypt developers down, found that they live in USA (or one of strongly affiliated countries) and issued the strongest warrant they could. TrueCrypt devs, living anonymously for years and lacking said "shield of lawyers" could have just decided to close things down, warning users in the most obvious, but still non-direct way (+, eventually, by that latin phrase encoded into text written in red - if it's the case, I hope that discovering it won't get them into legal penalties for breaking warrant rules of "not informing anyone").

As said, after thinking about it a longer while, I think that the above might be the thing closest to actual events.

/Estel

shawnjefferson | # 56 | 2014-10-04, 17:57 | Report

Estel, none of that actually stops true crypt however. If they have the sort of power you think they do, they could have seized the whole infrastructure (instead of killing the devs, although that's probably always an option if you are a conspiracy buff), pretended to be the devs and backdoored the packages themselves.

I doubt all these conspiracy theories and rather believe the story on it's face, even given the "strange" advice on the website-who knows who wrote that and what exactly their motivations were. Maybe they were in a hurry, maybe they didn't feel like creating a large tech manual explaining how to install, secure and maintain someone else's software. Maybe they just didn't care.

On the subject of "what do I use now" and "trust", to have complete trust you would have to:

1. have the source code, and the ability to review it for weaknesses or backdoors (including any libraries used that may effect the security or effectiveness of the encryption.)

2. ability to compile the binary yourself (and complete trust in the entire environment you compile it on).

Without doing those two things, you are putting your trust in someone else who could have been co-opted by the same power you are accusing the True Crypt developers of having been affected by.

As far as breaking device encryption, I believe there are better methods for the NSA or law enforcement than trying to shutdown TrueCrypt (which can't work, since you know someone else will just take on development, or people will just keep using the last version.)

- torture the password out of the person (these techniques are known to be used by some governments.)
- legally require them to provide the password (less teeth, but might work in some circumstances.)
- crack the password (I'm assuming the NSA has access to very good hardware and people)

---

Last edited by shawnjefferson; 2014-10-04 at 18:00. Reason: formatting

pichlo | # 57 | 2014-10-04, 18:14 | Report

That approach has one limitation though. It requires having the person in your hands. If all you have is the device then cracking may be your only option left.

malfunctioning | # 58 | 2014-10-13, 16:56 | Report

Although we can't be certain, I tend to agree with your general hypothesis that a third party was involved here, for the many reasons you mention. That being the case, it's hard to be disappointed with the TrueCrypt team, as we don't know what type of situation exactly they were facing.

Recommending BitLocker is a clear joke, and it reminds me of the famous letter of Sigmund Freud, who was requested by te Nazis to say in writing that he hadn't been mistreated by the Gestapo before leaving Vienna, and he wrote: "I can wholeheartedly recommend the Gestapo to anyone".

The positive thing about TrueCrypt is that its code is open, so its soundness can in principle be proven to a reasonable degree of certainty.

malfunctioning | # 59 | 2014-10-13, 17:08 | Report

I don't think they just abandoned the TrueCrypt project and just wrote that bizarre stuff on their site out of hastiness. We are talking about a very prominent and important project into which thousands of man hours have been spent. An important project with a roadmap.

Sure there are other methods to access encrypted data (the simplest being access to the human who owns the device). But just because there are crooks out there with crowbars it doesn't mean you should leave your car doors open.

As for actually breaking encryption, a solid encryption program can be proven mathematically unbreakable. How long does it take to break a single AES-256 encrypted archive? With current technology and algorithms (and assuming a good encryption key) I think it would take too long. And definitely too long to justify wasting the state's resources to access my midget porn collection.

minimos | # 60 | 2014-10-13, 17:18 | Report

And the work is *partially* done: http://istruecryptauditedyet.com/
(but note also that it required the initiative of a few important cryptographers and donations for about 50000 USD to fund the auditing in order to start the project)