Truecrypt

[directhex]

Word is it's a warrant canary - the TrueCrypt developers were subpoena'd by the US government under legislation which would make it illegal for them not to cooperate, and illegal to admit that they were now operating on US government orders. So they've made previously agreed statements that prove they're compromised (e.g. recommending Bitlocker) without breaking the law by admitting that they're compromised.

[Zak33]

Word is it's a warrant canary - the TrueCrypt developers were subpoena'd by the US government under legislation which would make it illegal for them not to cooperate, and illegal to admit that they were now operating on US government orders. So they've made previously agreed statements that prove they're compromised (e.g. recommending Bitlocker) without breaking the law by admitting that they're compromised.

worthy of a bounce....

[wasabi]

worthy of a bounce....

Sad it has come to this. Land of the Free

[peterb]

Well, there seems to be a fairly determined effort to preserve it, although how successful it will be is difficult to predict. There is a lot of source code to understand, it seems. http://www.forbes.com/sites/jameslyn...-should-it-be/

However, the new site (and new dev team - which is the reason for concern) can be found in the link below, along with all the previous versions up to and including 7.1a - with the caveat that they are not being maintained (at least of the moment).

I hope that source code is well documented...

www.truecrypt.ch

[scott1541]

I'm probably being a bit paranoid but the problem I see now with new developers taking over is that you don't know who they are. The new developers could actually be NSA/GCHQ workers disguised as regular developers, you just don't know.

[directhex]

I'm probably being a bit paranoid but the problem I see now with new developers taking over is that you don't know who they are. The new developers could actually be NSA/GCHQ workers disguised as regular developers, you just don't know.

Same goes for the old guys, who worked anonymously

[scott1541]

Same goes for the old guys, who worked anonymously

True, but IMO now there's even more chance this is the case if they weren't in on it already

[BobF64]

The new developers could actually be NSA/GCHQ workers disguised as regular developers, you just don't know.

All software developers or their employers could be NSA/GCHQ controlled, and youd never know.

At some point, you have to accept that the data you are encrypting is actually of no value to governments or their agencies, and therefore it doesnt matter if they can decrypt it.

[scaryjim]

At some point, you have to accept that the data you are encrypting is actually of no value to governments or their agencies, and therefore it doesnt matter if they can decrypt it.

Good point this: how much difference will it actually make to you if a government agency knows what's on your hard drive? What do you actually have to hide? Obviously they absolutely should not be looking at your personal data, but I'd rather the government had that kind of backdoor access than, say, some random cyber-criminal from Russia.

And that's the killer here of course: the new TrueCrypt team could be opportunistic cyber-criminals. And I think that's a more legitimate fear than that some government super-snoop agency might be able to decrypt your hard drive if they wanted to (and had access to it).

[Agent]

but I'd rather the government had that kind of backdoor access than, say, some random cyber-criminal from Russia.

What a terrible view to have

What happens when the government becomes the criminal?

https://www.youtube.com/watch?v=9cX0BYbpmbM

The problem with designing inherently insecure software is that you don't get to say who has access. It can be, and will be abused.

[BobF64]

And that's the killer here of course: the new TrueCrypt team could be opportunistic cyber-criminals. And I think that's a more legitimate fear than that some government super-snoop agency might be able to decrypt your hard drive if they wanted to (and had access to it).

Yes, non-government types being able to syphon or access your data is a more likely problem, but that said, theres other things you should be doing to prevent that in the first place, like securing your network.

[peterb]

What a terrible view to have

What happens when the government becomes the criminal?

https://www.youtube.com/watch?v=9cX0BYbpmbM

The problem with designing inherently insecure software is that you don't get to say who has access. It can be, and will be abused.

Government activities are subject to scrutiny and oversight by Parliament - it may not be entirely adequate, but it is there.

The activities of 'cyber criminals' is not, almost by definition not - apart from that of security/law enforcement organisations.

Which is the lesser of the two evils?

[Agent]

Government activities are subject to scrutiny and oversight by Parliament - it may not be entirely adequate, but it is there.

The activities of 'cyber criminals' is not, almost by definition not - apart from that of security/law enforcement organisations.

Which is the lesser of the two evils?

Many people would consider a lot of people in Parliament, GCGQ and the NSA to be criminals.

Parliament is corrupt. Oversight by these people is not an oversight that has any value.

We now have secret courts, with secret trials with secret decisions being made. And we're to merely trust the people that have allowed this?

You're reinforcing the point - There isn't a lesser evil. If you make something purposefully insecure, you have no right to then complain about it when the insecurity is used against you. 'Oversight' is a terrible reason that's spun by people who want to convince you everything is under control. Sure it is, just not by the people.

[Zak33]

Parliament is corrupt.

bit strong that one mate!

[Agent]

bit strong that one mate!

True. It's probably one for QT more than a software thread - I don't want to get too political in here. It's just interesting that people consider a place that has been in the news for scandals over the last few years, including criminal charges being brought, mixed with a general low technical understanding to be in a position to 'overview' the decisions by the people doing the monitoring.

It's diverging away from the original point though: You really don't have a choice in who accesses the back-doors once they are in place. You shouldn't have them present in the first place.

[BobF64]

Sure it is, just not by the people.

And when was the country last run by the people?

Don't confuse democratic elections with actual democracy.