I'm pretty sure the US government is why the TrueCrypt devs stopped all work. They got hit with a national security letter (NSL) or heavily leaned on and pressured to stop making their product so awesome and un-breakable.
> WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues
The fact that they use awkward wording that contains words whose first letters that start with NSA (not secure as) is pretty suggestive that you are right.
This trope needs to die already.
“Unfounded” paranoia
That's not a dirty phrase either - regardless of what the media memo said back then.
That's what I'm suggesting.
You make your case as if you have proof, which you likely don't. It's a moot point.
Your mind will see what it wants.
For some people out there, this kinda shit keeps them safe/alive.
There were vulnerabilities in the software, but nothing that allows the governments to break the encryption with. The Windows client had some privilege escalation attack but that doesn't allow decryption of data at rest. On Linux TrueCrypt is still fine to use, the only downside is, the password based key derivation function is starting to show it's age. However, provided your password is around 128 bits, that's not a problem.
I suppose the fact that it contains words that start with TIN (TrueCrypt is not) provides sufficient justification for your hat, anyhow.
Even just reading this article should show you that they kill you with kindness when they want to keep things hush-hush. If someone is developing a free tool, and are offered a retirement-tier payoff to stop, they're going to stop.
If things really get too hot, it's easy to send a letter to any country's IRS via their local intell agency.
You'd be surprised how simple it is to close files in this world. I'd suggest reading Snowden's autobiography, Permanent Record. Very eye-opening and a great read.
[1] https://www.fnlondon.com/articles/facebook-whatsapp-puts-all...
Also, it's open source software. TrueCrypt going down didn't change the security landscape at all.
https://en.wikipedia.org/wiki/Murder_of_Rachel_Hoffman
The end result is "Work for us or go to prison."
Slavery's perfectly legal. The 13th Amendment:
"Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction."
https://en.wikipedia.org/wiki/Penal_labor_in_the_United_Stat...
See: Three Felonies a Day
That may be your personal opinion, but legally speaking, it is not true in any sense.
I think under the right conditions, a good many state intelligence services would not let the letter of the law get in their way. I just don't think the particular scenario above makes sense.
What makes sense:
-devs discovered some vulnerability but were persuaded that disclosing it would endanger important operations in progress. They were not coerced but reached a compromise with (agency).
-Devs were told, in no uncertain terms, that they need to discourage use of Truecrypt. Seems kind of low-impact, so probably not the case.
- Truecrypt was an (agency) project all along, and the faction arguing for universal access to strong cryptography finally lost out. The cat being out of the bag, and given the difficulty of introducing new vulnerabilities into an open-source tool used by the professionally paranoid, the best option was to try to discredit Truecrypt to the extent possible.
There is value in misdirection.
Does that mean they are only available because the 3 letter agencies can hack them?
- there is clear evidence linking him to some earlier cryptographic software
-and someone (the journalist who wrote the story?) tried to say that it was a precursor to TrueCrypt.
Also, describing small-scale intervention in cryptography by services "mythologic" in a thread about news about large-scale intervention in cryptography by those services is a bit odd.
By all means: enable FDE. You have to turn it on. It's not optional. But the threat it defends against is not the threat many people think it defends against. It's hard to imagine it being such a priority that any government would launch a conspiracy to shut down an open source project.
(I mean, sure, it didn't protect him in the end. But it was a speedbump.)
Someone started talking to him while someone else snagged his laptop - a thing you and a friend can do to more or less anyone. It's not like people rappelled down from helicopters with guns drawn.
But, there are also other tools out there.
> It wasn't even a speed bump for the Ulbricht investigators.
Are you talking about the situation where they had to very carefully snatch a running laptop from a suspect so that they can't lock it? Seems to me like FDE would have been at least a significant speedbump had they not circumvented it. Why else would they go to such trouble? And what would they have done if the suspect hadn't used his laptop in a public place?
Screw open his laptop when it's turned off and he's away from home, install a keylogger into the bios. Put a camera onto the shelf to film which keys he types to log in. If he puts a blanket over his head: solely rely on the sound each key makes. Hack his computer remotely using one of the government owned 0days and dump the keys. Use side channels to attain the password via the power outlet in the neighbouring house.
They had countless ways and they chose the one that revealed the least about their capabilities.
FDE's not worthless. Again, I don't think it's even optional; one of your laptops is eventually going to get stolen, and you're going to want the reassurance that at the very least, once it loses power, the thief won't have access to your data (meaning, in effect, that most thieves will never have access to your data). And it's somewhat more powerful on phones, which have integrated designs to make FDE more granular.
But the idea that of all the things the USG could spend energy on, aftermarket FDE software would be their target? It's not very plausible.