The article also mentions that truecrypt passphrases can be recovered this way. Is this true? This would seem like a very major security oversight for software whose main focus is security.