For TrueCrypt Users.

[Anak]

If anyone is trying to contact TrueCrypt and wondering why there is no response or you are getting a re-direct to the TrueCrypt| SourceForge repository when trying to visit their site:

WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues

This page exists only to help migrate existing data encrypted by TrueCrypt.

TrueCrypt| SourceForge repository

Whither TrueCrypt?
Posted on May 28, 2014 by Steve Gibson

My guess is that the TrueCrypt self-takedown
is going to turn out to be legitimate.​

We know NOTHING about the developers behind TrueCrypt.

Research Professor Matthew Green, Johns Hopkins Cryptographer who recently helped to launch the TrueCrypt Audit, is currently as clueless as anyone. But his recent tweets indicate that he has come to the same conclusion that I have:......

More: Whither TrueCrypt? | Steve (GRC) Gibson's Blog

Risk Assessment/Security & Hacktivism

“TrueCrypt is not secure,” official SourceForge page abruptly warns:
Support for decade-old crypto program pulled, touching off Internet firestorm.
​

May 28 2014, 4:48pm EST

One of the official webpages for the widely used TrueCrypt encryption program says that development has abruptly ended and warns users of the decade-old tool that it isn't safe to use.

TrueCrypt is not secure, official SourceForge page abruptly warns | Ars Technica

TrueCrypt, the popular open-source encryption program, on Wednesday unexpectedly recommended that users drop its product and shift to Microsoft's Bitlocker.

TrueCrypt now encouraging users to use Microsoft's Bitlocker | PCWorld

 

[Callender]

Extracting Truecrypt passwords

I wonder if they're worried about methods like these:

Forensic tool to decrypt TrueCrypt, Bitlocker and PGP containers and disks released | gHacks Technology News

I've known about those issues for a long time so on my machine hibernation is disabled, page file is cleared each shutdown and memory dumps are deleted and overwritten. Truecrypt is set to never cache passwords.

Or are they suggesting a built in backdoor?

I don't think that I'd trust Bitlocker as an alternative unless it could be 100% guaranteed that there are no backdoors!

Now I'm left wondering what encryption method to use for sensitive personal files.

 

[essaytee]

I'm sticking with 7.1a for the time being.

Now I start my search for a replacement product.

 

[Chorizo]

The fact that the web page is telling people to use BitLocker (BitLocker!!!) of all things is a very clear sign that one of two things happened:

1.) They were hacked and somehow lost control of absolutely all their data, keys, certificates, etc. The hackers are doing it for the lulz of TrueCrypt recommending BitLocker, for all intents and purposes their "opposite."

2.) The US government made an ultimatum to give them a backdoor. Instead they shut down and by recommending BitLocker they are letting everyone who is familiar with TrueCrypt and BitLocer know that something really bizarre just happened and to make our own conclusions. They can't explain what happened because they have been told they would go to prison, as we learned from Lavabit.

It's inconceivable that they just quit the project out of the blue and recommended BitLocker without any logical reason or explanation.

Try to find a cached version of www.truecrypt.org. I sure can't find one. Getting errors on the Google cached version and Archive.org. I don't claim that I use those tools often, but I've never seen errors like that for heavily trafficked web sites.

 

[Britton30]

It sounds like a Homeland "Security" gambit to further the lack or privacy to individuals in the name of anti-whatever plans.

I suppose Bit Locker could be used, if I remember it takes a piece of hardware, Trusted Platform Module (TPM) to work.

 

[OvenMaster]

I'm sticking with 7.1a for the time being.

Now I start my search for a replacement product.

I agree. I've used TC since ±2008 and I have trusted it. But if it's been compromised, that's an extremely disturbing development. I am not happy. BitLocker is being touted as an alternative, but I strongly suspect Microsoft-U.S. Government backdoor, behind-the-scenes collaboration. EDIT: Besides, BitLocker is only available for Ultimate and Enterprise. That leaves us Professional and Home users out in the cold.

 

[Chorizo]

Fortunately there doesn't seem to be any reason to believe that any 7.1a exe installed weeks or months ago would have anything fishy going on with it, and the crypto audit report just concluded that it has no critical flaws and no backdoor. Unfortunately they didn't put an md5 of the .exes they analyzed (only for the source code), so it's hard to know if a copy downloaded today is the same as the ones audited. Hopefully some "known good" copies will be mirrored. The scrubbing of truecrypt.org from the main website caches is creepy (if ml that is in fact what happened). The site had excellent tutorials and documentation - who knows if anyone bothered to save a copy of the site.

 

[Golden]

How to securely download (and check) Truecrypt 7.1a:
akselvoll.net: How to securely download TrueCrypt 7.1a

For those of you that still wish to encrypt data containers using it:
http://www.sevenforums.com/tutorials/241427-truecrypt-encrypt-data-folders.html

 

[Britton30]

Colin the link in your tut under Installation seems to be dead. I tried it a few times and get a "This Page Cannot be displayed..." error.

 

[Golden]

Colin the link in your tut under Installation seems to be dead. I tried it a few times and get a "This Page Cannot be displayed..." error.

My mistake, I mistyped the location. Fixed.

 

[Anak]

Great find Golden! ( akselvoll.net )

Britton, try the filehippo link on the aksevoll site, it works for me or use the link at the bottom of my post.
Golden, Firefox was trying, but it wanted me to try again. (Server not Found)

- who knows if anyone bothered to save a copy of the site.

This is the search result from: Internet Archive: TrueCrypt


But there are 47 results for TrueCrypt, mostly audio or video save for one, a download for v1.0: Internet Archive Search: TrueCrypt


Old apps only has version 4.3: Old Version of TrueCrypt Download - OldApps.com

7.1a still available from Filehippo: Download TrueCrypt 7.1a - FileHippo.com

 

[Britton30]

It works now Colin.
Yeah Steve, I just wanted to point out Colin's old link was taken down.

 

[Anak]

Works for me also. Okay Gary.


Some members have asked if there are alternatives to TrueCrypt. There are a lot and you should use caution in what you decide to choose, if it helps, read over these two sites:
How to Know when It Is Safe to Download Something: 7 Steps
How To Do Your Research Before You Download Free Software

In addition to the above tips I always follow these two details;

• Before opening or running. Make sure you scan anything you download with your up-to-date anti-malware program.

• And the best of all is your brain and your gut feeling, if it doesn't seem right or is too good to be true, don't do it.

When in doubt, cancel out!


Now, 'bout those alternatives:
These are mostly open source, ranked by "Likes": TrueCrypt Alternatives and Similar Software - AlternativeTo.net

Covers fourteen areas of encryption:
Probably the Best Free Security List in the World - Page 19/Encryption - www.techsupportalert.com

 

[Britton30]

Another different type of encryption is to use 7-Zip with a 32 character password with alpha-numerical and special characters. Store the password on a password protected USB drive.

I also submit every .exe or zipped file I download to https://www.virustotal.com/ to get 50 or so, other opinions.

 

[Indianatone]

Read what the Register has to say about this here:

TrueCrypt considered HARMFUL ? downloads, website meddled to warn: 'It's not secure' ? The Register

 

[Golden]

Link to Truecrypt audit report at top of this site...

Is TrueCrypt Audited Yet?

 

[Indianatone]

Even more news from the Register????

TrueCrypt turmoil latest: Bruce Schneier reveals what he'll use instead ? The Register

 

[andrew129260]

But yet people want to "securely" store their stuff in the cloud.........

Hilarious.

I'll say it again,

Made by humans, broken by humans. Encryption will not save you. Anything in the security world is a deterrent. Not impossible. Not a full 100% solution. There is no such thing.

If the government or whoever wants your data, they will get it.

The difference is whether you will know it or not.

 

[Anak]

The death of TrueCrypt: a symptom of a greater problem

Open Source Software (OSS) is in danger. We rely on OSS every day to encrypt online banking and shopping, serve our web pages, move and deliver our email, render our web pages, manage our websites, power the world’s encyclopedia, and so much more......

The death of TrueCrypt: a symptom of a greater problem | bradkovach.blog

 

[msgerbs]

Open source software isn't supposed to be able to die. Isn't the whole idea that somebody is supposed to take over? Why was the open-source TrueCrypt only ever touched by an elusive team?

andrew129260 give it a rest with the anti-cloud crusade and fear-mongering.