Hacker News Reader

>which were clearly a joke

There's a lot of information flying around so I may have missed something. Why is the official page, which states that there are security concerns, "clearly" a joke?

I think it is the flippant manner in which they expose the security concern and recommend a product few would actually use.

Most people took TC recommending Bitlocker as a joke (myself included), because it's a closed-source proprietary encryption method made by Microsoft, which is the ethic that TrueCrypt has represented in the decade that it existed, but even if that's a bit too subtle humor, if you look at the options they give for encryption on other platforms [1], you can see that it's obviously not a serious security-based recommendation.

For Linux, they recommend: >Use any integrated support for encryption. Search available installation packages for words encryption and crypt, install any of the packages found and follow its documentation.

Does that seem serious to you?

For Mac OSX, here is the configuration they recommend for creating an encrypted volume: http://truecrypt.sourceforge.net/OSXNewImage.png

Note where under Encryption they've selected "None".

1. http://truecrypt.sourceforge.net/OtherPlatforms.html

> Chances are, someone will either fork TrueCrypt (version 3.1 of the TrueCrypt license seems to make this a legitimate possiblity)

Given this comment and some inspiration from tacotime in this [1] post, it dawned on me: What if this whole thing is a not-so-subtle effort by the developer(s) to renew interest in TrueCrypt and pass the torch? The license ambiguity might be an issue (in terms of whether it retroactively covers encryption support in earlier versions or not), but if that were resolved, then perhaps all of this speculation, wild conspiracies, and other noise is for naught. Maybe this is their way of stepping down and saying "Hey, look, we're not maintaining this anymore. We're changing the license, so knock yourselves out."

[1] https://news.ycombinator.com/item?id=7814800

As far as I know encryption wasn't removed in 7.2, just disabled via error messages. You could just fork it given the new license and reenable encryption, right?

I think that would be possible, yes.

If you can believe the anonymous gists that were posted a day or so ago, huge swathes of code were removed containing much/some of the encryption logic. It's possible that may not be true, but forking it would be a possibility.

I'm assuming that the license changes are technically retroactive since it seems the developer(s) have decided it's time to move on (and who can blame them after 10 years?).

TrueCrypt is undoubtedly stable, but it is getting rather long in the tooth.

For example, TrueCrypt can't encrypt the system drive if your computer uses UEFI and/or your boot drive has a GPT parition table. This is a major nuisance since nearly all new PCs have UEFI enabled by default. But TrueCrypt development has all but stalled for the last couple of years, and now there's zero hope of ever getting UEFI support.

The feature request to replace TC in Tails was added to their issue tracker 11 months ago. It is not a knee-jerk reaction to todays events.

That's why I said semi-relevant. I think the renewed interest in finding alternatives in TrueCrypt is clearly due to the devs stepping out, which is unrelated to its removal from Tails. It doesn't even seem implausible that in the (in my opinion, incredibly likely) event of a fork, the new fork will be a strong candidate for inclusion in Tails, assuming it has active development, a FOSS-compatible license and a more open development process (again, all of which may be possible). The reason I wanted to post here was to hopefully convince some people in kneejerk mode to just give the dust a bit of time to settle, since I imagine many people would be using this list to help them migrate.

I think RealCrypt is a fork of TrueCrypt (which wasn't mentioned in the post):

http://rpmfusion.org/Package/realcrypt

I agree. There was no rush to switch away 6 months ago. The latest version (besides the new decrypt-only release) was over a year ago. It's pretty solid from my use-case... and the audit should relax any fears (nothing obvious has been discovered yet).

I think the "security concerns" expressed on the truecrypt page are more-or-less for future visitors to understand the project is not maintained anymore (albeit a poor way to go about expressing that)

Looking at all the reactions, it doesn't seem that clear they were a joke.

It seems odd that they would remove all of the binaries as well. Want to commit a readonly version? Fine. But what about now, when less technical folks might want to install TrueCrypt on a new computer?

The point is, now another entity will need to establish validity as being a trusted provider; there was no reason to rock the boat per se, and as someone who laughs at most things, it just... really isn't altogether funny, unfortunately.

edit: assuming that it turned out to be a joke, for the sake of discussion (though is there a difference at this point?)

They've always removed old binaries when they release new ones. They used to ban users from their forums when they asked for old binaries.

They've changed binaries too without bumping the version number and then re-released them unannounced.

This has been known for a very long time now. I'm not sure why people are surprised at the latest developments:

http://16s.us/software/TCHunt/TCD/readme.txt

Interesting. Admittedly I hadn't paid a lot of attention other than "get the latest release and install it", so I wasn't aware that they did any of those things. Thanks for clarifying.

There's been a lot of hand-wringing about the license, but if the TrueCrypt devs want to be anonymous and/or go away, who's going to complain if someone puts out another version?