Relaunched TrueCrypt site with original content and documentation

https://www.truecrypt71a.com

by unr3al011 • 11 years ago

71 53 11 years ago

zz1• 11 years ago

No link or mention of the audit? I guess it would be very useful!

luck873• 11 years ago

It is available the version 7.1a, but the TrueCrypt development has stopped (for now). An alternative solution is VeraCrypt (build over Truecrypt 7.1a): https://veracrypt.codeplex.com/

VeraCrypt says to add extra security features (ex. TrueCrypt uses PBKDF2-RIPEMD160 with 1000 iterations whereas in VeraCrypt we use 327661): https://veracrypt.codeplex.com/discussions/569777#PostConten...

Do you think VeraCrypt is an valid alternative? or have they only fix something in TrueCrypt ( like change the CONSTANT value of iterations )

dtech• 11 years ago

They're your most realistic option right now. They are actively developing it and added things like newer algorithms (e.g. SHA2).

There's CipherSched but that is basically a completely new program/rewrite which is very far from done.

However, I don't agree with VeraCrypts choices. They've changed several things that make mounting slow (0,5s -> 10s), which is annoying, especially if you mistype the password. Providing the option for increased security isn't bad, but they refuse to give users overrides to disable those slow security options because they are of the opinion that users can't assess the tradeoff for themselves. Which leads people to just go back to truecrypt because it works way better in their minds.

m82labs• 11 years ago

This is an odd conclusion to come to. Are there a lot of users of True/Veracrypt that don't understand this? I guess I just don't see my grandparents using either of these packages, and I can't imagine a lot of "normal" users "trying out" a new encryption program.

mhogomchungu3• 11 years ago

They're your most realistic option right now.

zuluCrypt[1] is another option if you are on linux.

Its GPL licensed and exists in a lot of distribution's repositories(Will appear in debian and ubuntu repositories shortly)

It supports TrueCrypt volumes,VeraCrypt volumes and LUKS volumes.

[1] http://mhogomchungu.github.io/zuluCrypt/

ikeboy2• 11 years ago

Why would someone want to use Veracrypt but not have the increased security? Why not just use Truecrypt?

ilurk• 11 years ago

Disclaimer: this site is not affiliated with, nor is it the official site of TrueCrypt

AFAIK there are several forks out there. But who is behind them? Can they be trusted?

BTW, for those looking for the code, this is the only reliable host for the Truecrypt source code:

https://github.com/AuditProject/truecrypt-verified-mirror

tokenizerrr• 11 years ago

We don't even know who was behind TrueCrypt itself. How could that be trusted? Because it was open source and people could and have reviewed the code.

metaos• 11 years ago

good work :)

v4n4d1s• 11 years ago

Why not https://truecrypt.ch/?

jordigh• 11 years ago

"Free open source"? Did they actually get an open source license this time?

If not, this website could be in violation of the license, but as discussed before, it's very unlikely the TrueCrypt authors would pursue this copyright violation.

unr3al011• 11 years ago

thats the original caption from their old website.

ralala• 11 years ago

What do you think about https://diskcryptor.net/wiki/Main_Page

Paul_S• 11 years ago

Why can't the original devs just leak the reason behind all this? I don't expect it on their official website but honestly, how difficult is it to just let people know?

brillenfux• 11 years ago

And what? Eat bad food with a bad view for the rest of your life?

fiveoak• 11 years ago

Probably because they can't legally disclose the reason.

nickysielicki3• 11 years ago

If I was concerned about my data, I wouldn't touch TrueCrypt with a 10 foot pole. More specifically I wouldn't touch Windows.

Developers don't abruptly shut down projects. If there are problems with the code, they release statements and patches. If they lose interest in the project, they call it orphaned and ask for maintainers. If it's a mix of the two, they at least say so.

But what happened with TrueCrypt was truly bizarre. No warning. No phase-out. Telling people to move to BitLocker?

I think there's only one way to interpret that. They did something bizarre because it was all the noise they could make without telling us what really happened. AKA some of their developers got served gag orders.

But what on earth could a TrueCrypt dev be gagged for? A gag order implies that some three-letter-agency had enough foresight to know they were planning to disclose something. If it was that there was a government backdoor in TrueCrypt itself, how would NSA/FBI know that they discovered it? How would they know that it could be tied back to them? Why didn't the audit [1] catch it? Gag orders are pretty loose in terms of legality in the first place, but even still, would a gag order prevent them from releasing a statement about a security hole (without mentioning its origin) and releasing patches?

It's a total guess, but my theory is that TrueCrypt discovered something outside their codebase (EG: Windows itself) that was undermining encryption. They reached out to Microsoft, who contacted FBI/NSA, and they were served their gag orders. This is the only theory I can think of that makes a gag order possible, in other situations the FBI/NSA wouldn't have been able to know about a disclosure before it happened.

[1]: istruecryptauditedyet.com

jaawn3• 11 years ago

If they discovered an issue in Windows, and it led to gag orders, why would they tell people to move to BitLocker (a Microsoft product)?

nickysielicki3• 11 years ago

This is obviously all conjecture, but my argument is that they made their actions as bizarre as possible because it's the only way to get out a distress call. They abruptly push a release that removes all the core functionality. They abruptly say that there will be no future releases. They wanted everyone to plainly see that this isn't them just giving up on the project because they've lost interest.

Suggesting people use Bitlocker is completely against everything they stand for. Here are some quotes off the FAQ on OP's rehosted website:

> Will TrueCrypt be open-source and free forever?
Yes, it will. We will never create a commercial version of TrueCrypt, as we believe in open-source and free security software.
> Why is TrueCrypt open-source? What are the advantages?
As the source code for TrueCrypt is publicly available, independent researchers can verify that the source code does not contain any security flaw or secret ‘backdoor’. If the source code were not available, reviewers would need to reverse-engineer the executable files. However, analyzing and understanding such reverse-engineered code is so difficult that it is practically impossible to do (especially when the code is as large as the TrueCrypt code).
Remark: A similar problem also affects cryptographic hardware (for example, a self-encrypting storage device). It is very difficult to reverse-engineer it to verify that it does not contain any security flaw or secret ‘backdoor’.

These same people who condemned closed-source crypto in their FAQ are now suggesting using a closed-source encryption suite? It is completely absurd, and that's the point.

ionised4• 11 years ago

I suspect that by recommending encryption software that is highly unreliable like Bitlocker (by virtue of being closed source and developed by Microsoft who we know cannot be trusted) they sent up a huge red flag to their user base.

Nobody would expect the TrueCrypt devs to recommend something like this, so it is immediately suspect and all anyone really needs to asusme something isn't right (like a gag order).

ryanlol4• 11 years ago

No warning? No phase-out? Are you kidding me. TrueCrypt was completely dead by the time they shut down the project.

piq• 11 years ago

Who are we? Why do you need cookies to deliver your service? I rather trust steve gibsons website https://www.grc.com/misc/truecrypt/truecrypt.htm

luck873• 11 years ago

Yes, I agree that this is the truth. This sort of mystery about the end of truecrypt was unfounded.

Relaunched TrueCrypt site with original content and documentation

Related Stories