TrueCrypt forum gone? (TrueCrypt either stopped development or was hacked?)

I did edit my post, but I did not realize blainefry had already made a post explaining the color coding. I also had not read your reply yet with your *facepalm* explaining the color coding when I had made the change to my post. I guess I should have made a separate post instead of adding it to my existing post.

 

Something else I brought up pages ago...
https://www.wilderssecurity.com/thre...ment-or-was-hacked.364391/page-3#post-2376249

What are these articles? Got links?

 

Thank you Randcal! I will see if I can find the articles again. I spent a lot of time reading about TC shutting down when I learned about it, and yes I delete my post that you quoted. I decided I should look through the license again before asking that question again. Your fast lol

 

This is the article that got me looking into the license issue. This is what made me realize there could be a problem with the license after I read the following from this article: “There are a lot of things they could have done to make it easier for people to take over this code, including fixing the licensing situation,” Green said. “But maybe what they did today makes that impossible. I found other articles as well. Still looking. Hope I have enough time to find them for you before I leave. http://krebsonsecurity.com/2014/05/true-goodbye-using-truecrypt-is-not-secure/

 

Yes that's a popular one. That section is actually quoted by Cory Doctorow here too:

http://boingboing.net/2014/05/29/mysterious-announcement-from-t.html

But to be honest, I was never really clear on licensing issues with TC. Forks have existed for years. (Diskcryptor that's being promoted here is based on it, for example.) But ultimately as I was saying a few pages ago, I'm not actually sure it matters.

The Linux Foundation (through it's OpenCryptoAudit twitter) not only said the audit would continue (as Green confirmed in that article), but they also said they are "considering several scenarios, including potentially supporting a fork under appropriate free license, w/ a fully reproducible build."

Bottom line is, TC is obviously too good and too important to die. It won't.

 

Ok, so I looked at a few recent articles I read, and one of them had a link to Wikipedia stating TrueCrypt's license could block further development of TC. Here is one of the articles that linked Wikipedia. https://gigaom.com/2014/05/29/heres...the-sudden-and-mysterious-death-of-truecrypt/ Here is the link to Wikipedia that is being referenced by the article. https://en.wikipedia.org/wiki/TrueCrypt#License_and_Open_Source_status

I know I read a few more articles that either linked this Wikipedia reference when talking about TC's license, or briefly mentioned there being a problem with the license directly without reference. I think Wikipedia will probably be updated soon, but articles are using this reference presently when talking about TC's license. I hope to find a few more of them for you if needed. If you are involved in TC's development in some way then I can see them possibly being useful to clear up any confusion, but if not it may be a waste of my time. I only have had a chance to look at a few articles I looked though. There are just so many of them now. This is really big news in the world of encryption.

 

If you notice, there is already a subsection mentioning the 3.1 change. But yes, when it gets to stuff like this, it gets murky even if you're a software licensing attorney (which I'm not). If they're all just referencing Wikipedia, don't worry about it.

But if the Linux Foundation says they can fork it under an appropriate free license without any problems, I trust them. If anyone is familiar with this kind of stuff it would be them.

 

I have an archive of TC builds, and I have TC 7.1a so i'm good to go. I definitely have no reason to switch to something else. The audit only reinforces my decision to stick with TC. I have already stated previously in this thread I would continue to use TC. I just do not want to see it's development stopped. Bitlocker is not a replacement for TC for most TC users. Some users will not use bitlocker out of a lack of trust, others for cost reasons, some due to a lack of features in bitlocker, or a combination of all the above.

 

Oh yeah, you definitely don't have to worry about that...

https://en.wikipedia.org/wiki/TrueCrypt#Archives_and_repositories

 

In my particular case the difficulties with GPT and UEFI are not something I am up against. Perhaps at some point that will change for me. I moved over to linux for many of the "lack of trust" issues that circulate around MS anything!! Plus you cannot imagine how much faster my machines are running Linux.

Speaking of a wish list for a TC fork: it should be possible to write a linux version that would offer WDE and even a hidden OS under that platform. If a dream could come true, that would be one on my "short list"!!!!!


I have read several posts regarding LUKS/DMCrypt (linux WDE) and several "high timers" feel its quite doable. For some reason the interest level is low amongst linux true bloods.

 

Is there any scenario outside of system encryption where that would be an issue with TC 7.1a?

How easy are you finding that to manage? I never really considered the implications of trying to make my primary machine a Linux one. It would take a decent amount of planning to know exactly what functionality I would be losing and consider how it would affect my work/life flow. I would definitely need Wine or a good virtual machine, but again I'm not sure how much that would handicap me, if at all.

Out of curiosity, why are you not using LUKS and dm-crypt? What distro are you running?

::EDIT::
I now notice you edited to mention those, but I guess my question still stands. The Ubuntu installer actually allows you the option of encrypting your whole disk while you install the OS.

 

I only have time now for a partial response. I do use full disk encryption with LUKS and LVM so my entire system disk is in fact covered!! Its solid - BUT - it does not offer any hidden option. Where I live that could become a problem if I ever have to defend myself from an adversary. I am using that system to type this post.

I'll get back tomorrow but now my family is wanting to leave. LOL!!

 

I'm sure it would be doable, when I was reading up on LUKS/dm-crypt it was clear on the wiki that the developers are of the opinion the whole "plausible deniability" construction has issues where it meets the real world, and simply haven't implimented hidden volumes for philosophical rather than technical reasons. Many of the points made are valid too.
Not to even mention the potential trouble for the (greater?) number who ignore the feature because they don't need it, and suffer consequences in less free parts of the world for "refusing" to divulge a second password that was never set to begin with.... "deniable filesystems" are a two edged sword. As a developer who was also human, how would you feel if people got imprisoned or beaten, because of a feature you included and they chose not to use? There are parts of the world where that would be the consequence.

 

@ BeardyFace

Hi, OK, & don't worry about posting on here, the more the merrier.

@ MrBrian

Thanx

 

Kali Linux has implemented key destruction. It's time for all the nay-sayers, like the LUKS/dm-crypt devs to follow suit, with that, and other anti-forensic techniques. Some TC users are the same way - "doesn't help", yadda, yadda, Oh yeah? Prove it doesn't. Put it in there and notate it with a warning. Like if I screw up a current LUKS install, I somehow have some recourse with the LUKS devs now, LOL!

 

All easily solved by putting a This is the hidden part.txt file in there. TC says "Hidden" when it's mounted. Plus, I think that's a BS argument anyway. In a place where they will do that to you, they will just say you have hidden encryption even if there is no encryption at all. "All your pictures have stego messages in them, prove they dont!"

 

Don't bug me about it bug the cryptsetup devs, it's their argument... an individual can indeed set up a hidden volume with the sole purpose of being able to give it up..
Though by the same token, a user can back his data up to prevent loss.. how many ordinary users do?

 

This is a truly silly idea, refusal to divulge your password is legal, destruction of evidence is a crime...
Edit:
Both plausible deniability and nuke options have arguments for and against, people and developers are entitled to their opinions as you are entitled to yours.

In the case of LUKS/dm-crypt though, it's a FOSS project, if you want a feature the devs don't.. go fork it

 

some nice and interesting points but has there ever been a situation where in court or a legal case where they said you have a hidden os/container ?

I think it all boils down to the your system and how it is set up, tc manual I think mentioned you must use your decoy os as much as the hidden one also. Guess it boils down to your plausible deniability setup, seen people on here in the past argue the tc hidden os system is best and would much rather have a password prompt during boot to indicate encryption exist while others prefer the non-existence of FDE setup.

Can see the points for either PD setups really but one thing I am trying to figure out is the kill switch, if someone else say a family member or an adversary switches on your system and your currently in the hidden os then surely the poo has hit the fan already.

Some suggested Virtual box and virtual o/s, some have suggested offload your other work onto say freenas which supports encryption.

I could be wrong but I don't fancy the above ideas too much IF you did not get to the kill switch (or powering machine off), with virtual systems anyone can still click virtualbox and get straight into your hidden virtual o/s and with Freenas or similar the argument could also be made an adversary can simply connect to a monitor and see whats going on or if a password/login prompt appears or hdd activity light indicates somethings running and Nas does not have a hidden Nas o/s.

I have often wondered if an adversary can run a usb or external program is run and it scans your hdd and takes snapshots of programs or files running, or that could just be my paranoia !

Anyone have any ideas on the kill switch or lack of getting to it ?

 

FYI Note: These are two articles of interest you may want to read. Both of the following titles are self-expanatory (both articles are posted at cryptome.org)

TrueCrypt Forensics dated 31 May 2014 at cryptome.org

Related:
TrueCrypt Last Download for Testing May 30, 2014

-- Tom

 

@Paranoid Eye

Each person's threat model is different, there is no one size fits all solution, TC probably offer/s/ed the most comprehensive answer as it is/was highly configurable to suit.

Some general principles for any solution though:

If your adversary can get to your running system before you dismount any encrypted volumes you're screwed
(or soon enough after if they're capable of cold boot attacks)
If your adversary can get to your offline system without your knowlege you're screwed
If your adversary can get to your offline system repeatedly without your knowlege you're extremely screwed
If you're not extremely careful, and your adversary inspects your system thoroughly, they can probably learn more than you thought they could
Deniable filesystems as a feature of a program, invite suspicion that you've used them, even if set up so they're undetectable.
Deniability of such filesystems is work to maintain (read the TC manual about what their recommendations are) If some three letter agency observes you using your computer on Monday, then confiscates it, they might not pe able to technically prove you were using a hidden os, but if you give them access to the decoy, it's trivial to prove you wern't using *it* (last access times) and your deniability is screwed

If you have sufficient warning:
Dismounting your system will render it secure to the extent you can resist/refuse giving your password - your adversary may or may not be able to do "bad things" to induce you to
Rendering your data permanently irretreivable quickly is trivial even on systems without a "nuke option" (overwrite headers / secure delete keyfiles ) though doing so in a way that can't be proved you did is somewhat less easy - depending on your adversary this too may be unwise

Biggest one of all
No solution is perfect - choose with care - set up with care and thought

 

My apologies, that #was# directed at them

 

Actually, destruction of evidence is only a crime (in free societies) if you already know you are the subject of an investigation. If a reporter gets a 'bad feeling' somewhere, he can do what he wants. That would be like saying anyone who uses 'wiping' software, #routinely#, is destroying evidence.

 

Interesting read here IMO http://www.forbes.com/sites/jameslyne/2014/06/02/truecrypt-is-back-but-should-it-be/

TrueCrypt. To be forked? Already forked? Deja vu all over again?

Regards.

__

 

Funny how the self destructing header key thing just keeps on popping up.
In the scenario where you just have a feeling the data should be destroyed, well, that is quite different from what most people are thinking about.
Most posts about volume destruction involve a special command (or switch) that produces instant wiping of master keys. The sole purpose of this is to be activated when you are fairly certain your adversary knows you have the data.
In that case, you WILL be accused of destruction of evidence. To me it appears that the only reason to use such a destruct system is when the data is so valuable you are willing to be jailed, tortured, and/or killed to keep it a secret. Otherwise, you are better off using a hidden volume. At least then you would have the option to reveal the hidden data and possibly reduce your sentence or, heaven forbid, stop your torture or execution.