Comment by toxicFork | Hacker News Reader

Top New Best Ask Show Jobs

Comment by toxicFork | Hacker News Reader

Parent Full thread

So, TrueCrypt has been audited[0][1], but abandoned.

Do we use it as it is, or use a fork that will be more up-to-date?

Can we actually fork it? Some comments on [1] mention that it's illegal to fork it. Others point to existing forks.

I am just confused about what to do, or even what other people are doing.

What are the thoughts of the HN community regarding TrueCrypt?

[0] http://istruecryptauditedyet.com/

[1] http://blog.cryptographyengineering.com/2015/04/truecrypt-re...

If you do a cursory search on the audit, you will find the discussion here about the second link. Generally, TrueCrypt seems to be trustworthy still. Forks generally seem permissible, but must not use the TrueCrypt name. While forks may not technically be allowed, making any sort of claim against a forked project would require the authors of TrueCrypt to de-anonymize themselves, which seems unlikely.

That being said, this article is about data in transit, and TrueCrypt protects data at rest. I'm sure there is a better place to be having this conversation about TrueCrypt.

Why would you use TrueCrypt rather than a maintained, properly-open-source system? dm-crypt / cryptsetup-luks is maintained, secure, and ordinary GPL, and I believe there's a windows implementation. You probably can't use it for your root disk on windows, but if you're serious about security you're probably not running the millions of lines of closed, potentially-backdoored code that is windows.

Use it. 7.1a has been shown safe. Watch https://truecrypt.ch/ for news about any developments (CipherShed and/or VeraCrypt) as well as being a trusted source for 7.1a.

Reply on news.ycombinator.com