For TrueCrypt Users.

andrew129260 · May 29, 2014

msgerbs said:
Open source software isn't supposed to be able to die. Isn't the whole idea that somebody is supposed to take over? Why was the open-source TrueCrypt only ever touched by an elusive team?

andrew129260 give it a rest with the anti-cloud crusade and fear-mongering.

Open source software dies all the time. Linux distros die, volunteers fade away, etc.

Open source also does not mean something is secure either. Look at heartbleed.

Encryption is difficult, and is very complex. It is not something a script kiddie can modify or do.

Therefore it makes sense to me that a small amount of individuals (a team) were the only ones working on it.

I am not saying it will not be picked up by someone else, I am sure it can be given there are enough people unhappy with this change.

I also am not anti-cloud, I see a lot of benefits with it, such as security software being able to track threats in real time. But for storing all my data, not so much.
And I don't see it as fear mongering, I see it as truth. But you are free to disagree. Everyone can have an opinion.

msgerbs · May 29, 2014

andrew129260 said:
msgerbs said:

Open source software isn't supposed to be able to die. Isn't the whole idea that somebody is supposed to take over? Why was the open-source TrueCrypt only ever touched by an elusive team?

andrew129260 give it a rest with the anti-cloud crusade and fear-mongering.

Click to expand...

Open source software dies all the time. Linux distros die, volunteers fade away, etc.

Open source also does not mean something is secure either. Look at heartbleed.

Encryption is difficult, and is very complex. It is not something a script kiddie can modify or do.

Therefore it makes sense to me that a small amount of individuals (a team) were the only ones working on it.

I am not saying it will not be picked up by someone else, I am sure it can be given there are enough people unhappy with this change.

I also am not anti-cloud, I see a lot of benefits with it, such as security software being able to track threats in real time. But for storing all my data, not so much.
And I don't see it as fear mongering, I see it as truth. But you are free to disagree. Everyone can have an opinion.

It's fear-mongering because you use misinformation to make your point, citing sources that are only somewhat relevant with some catchy header. All while totally failing to address any counter-arguments. But we're off-topic.

I guess I don't understand why the dev team needed to all be one singular entity, that just seems like a bad idea to me. They should coordinate, sure, but being a single entity with total anonymity and presenting only a single face seems to be rather counter to the goal of open source. In practice, "open source" in the case of TrueCrypt really only ever meant "Free software! Oh, and you can look at the source if you want to see if we're tricking you, but good luck!".

OvenMaster · May 29, 2014

I have to agree with Andrew. So far as data security goes, I always assume the worst and try to have backup plans.

Some call it paranoia or fear-mongering or FUD. Others call it safety, caution, and taking care. Some trust the cloud. I don't. All the NSA monitoring revelations showed that safety and privacy of our personal data which we once thought was safe is now compromised, and people really do need to take steps to protect their privacy. Considering that people are up against the computing power of the U.S. Government, I don't think that there are any steps too drastic to take.

Anak · May 30, 2014

Update from Steve Gibson | GRC

Yes, Virginia, TrueCrypt is still safe to use.
Posted on May 30, 2014 by Steve Gibson

So opens the short editorial I wrote this morning and placed at the top of GRC’s new TrueCrypt Final Version Repository page.

Source: Yes, Virginia, TrueCrypt is still safe to use. | Steve (GRC) Gibson's Blog

The pointer in this blog takes you here: https://www.grc.com/misc/truecrypt/truecrypt.htm

It is one of the editorial pages on his GRC | Shields Up! Security/Data Recovery site, you will find it listed in Other on the menu bar.

The first two-thirds deal with what has transpired with TrueCrypt in the last couple of days and the last third of the page has a green info box relating a "conversation" with one of the developers (David) of Truecrypt.

The bottom has:

Final v7.1a materials.

v7.1a installation packages.

Source code as a gzipped TAR and a ZIP.

And additional online TrueCrypt sites and repositories.

A Guy · Jun 1, 2014

Some information

What happened to Truecrypt - May 2014 - ETCwiki

Possible NEW site

TrueCrypt - organizing a future

A Guy

Anshad Edavana · Jun 1, 2014

This points to the weakness of open source. Nobody is liable to answer anybody in the open source world. After all free software is a charity work - "Don’t count the teeth of a gift horse".

Btw, "DiskCryptor" seems to be a better alternative - https://diskcryptor.net/wiki/Main_Page

Callender · Jan 1, 2015

VeraCrypt - Based on TrueCrypt but fixed vulnerabilities?

Well I'm just about to try Veracrypt v1.0f stable release. ~~Note: Not compatible with TrueCrypt storage format.~~ Released 30th December 2014.

Edit: Latest version can mount Truecrypt volumes.

VeraCrypt - Why is this more secure than TrueCrypt?

Download VeraCrypt - MajorGeeks

https://veracrypt.codeplex.com/releases/view/565079

Anak · Apr 4, 2015

Update:

TrueCrypt Audit Phase II completed: 4 vulnerabilities identified, April 2, 2015.

Today, phase 2 of the TrueCrypt analysis has completed. The researches have uploaded the final report as a PDF document to the official website from where it can be downloaded.
A total of four vulnerabilities were discovered:

Keyfile mixing is not cryptographically sound (low).

Unauthenticated ciphertext in volume headers (undetermined).

CryptAcquireContext may silently fail in unusual scenarios (high).

AES implementation susceptible to cache timing attacks (high).

Source: TrueCrypt Audit Phase II completed: 4 vulnerabilities identified

The official website has a secondary link to the PDF report and other Truecrypt reports in the footnotes.
This is a direct download link to the PDF report: Phase II analysis is completed

Callender; Any conclusions with your Veracrypt testing?

OvenMaster · Apr 4, 2015

Anak, thanks for that update. Very interesting.
Also, I myself switched to VeraCrypt as of January 2015. Except for VeraCrypt taking much longer to mount file containers compared to TrueCrypt (supposedly because of increased iterations, they say), it's just as convenient as TrueCrypt.
My two cents.

Callender · Apr 7, 2015

Veracrypt testing?

Well I reckon that VeraCrypt needs an audit too. At least it does patch some of the vulnerabilities in TrueCrypt!

At the moment I have both Truecrypt and VeraCrypt installed. I've kept TrueCrypt as some volumes on external hard drives are TrueCrypt volumes. The interesting thing is that VeraCrypt can mount TrueCrypt volumes and now claims to be able to convert them to VeraCrypt volumes. I haven't tried converting but mounting works fine.

I haven't done any testing really - just general usage but have had no problems so far.

For TrueCrypt Users.

andrew129260

IT Support Pro

My Computer

msgerbs

New member

My Computer

OvenMaster

Folding@Home

My Computer

Anak

New member

My Computer

A Guy

Righteous Dude

My Computer

Anshad Edavana

New member

My Computer

Callender

New member

My Computer

Anak

New member

My Computer

OvenMaster

Folding@Home

My Computer

Callender

New member

My Computer

Similar threads