News for hackers. Stuff that matters.
Re:TrueCrypt suggesting migration to BitLocker? by 4bpp on Wednesday May 28, 2014 @05:44PM (#7813163)
The element that does not square with any theories that suggest benevolent intent behind the change is the recommendation that users switch to Bitlocker. Surely, a Truecrypt developer who got served a gagging order to build in a backdoor would realise that a big and compliant target such as Microsoft would have been subject to the same measure long ago, and likewise that if a pre-existing vulnerability on a sufficient scale to justify this went unnoticed in an open-source project even after a proper audit, the situation is unlikely to look that much better in a closed-source solution (that only the makers and government agencies have access to).

While this might be reading a tad much into it, the language of the announcement, specifically the "...as it may contain unfixed security issues" bit, sounds like what somebody who just came out on the losing end of a heated debate about whether some bug-feature should or should not be considered the former would say. Knowing the vitriol and determination with which software developer arguments are often carried out, this would explain the observed combination of remarkable dedication and haphazard execution.

Re:TrueCrypt suggesting migration to BitLocker? by UVB-76 on Wednesday May 28, 2014 @05:55PM (#7813212)
> The element that does not square with any theories that suggest benevolent intent behind the change is the recommendation that users switch to Bitlocker.

I realize we are firmly in conspiracy theory territory here, but perhaps the suggestion that users switch to Bitlocker is intended to be so patently absurd as to be a signal that the developers are under duress?

Re:TrueCrypt suggesting migration to BitLocker? by dsuth on Wednesday May 28, 2014 @10:46PM (#7814431)
That's my take on it as well, even though it fails the Occam's razor test. This all sounds like a very understated way of saying "we can no longer develop truecrypt with impunity, and the only other options are closed source, and highly likely to be compromised out of the gate".
Re:TrueCrypt suggesting migration to BitLocker? by tacotime on Thursday May 29, 2014 @12:08AM (#7814675)
This is currently my favorite theory, for lack of a better word. It's also potentially pretty disturbing news. I saw another user mention the term warrant canary. I'd call it a warrant canary for the cautious/well informed. Unless there is some serious action on the horizon, no one well informed will ever use a truecrypt release past 7.2 ever again. https://en.wikipedia.org/wiki/Warrant_canary

My very first thought upon hearing this news was that just maybe the trucrypt devs are secretly cheering for others to come and replace the hole they fill in this world. Maybe this is the best possible thing they could do to inspire the next generation of truecrypt. They've laid a good foundation but they know they can't win the war for free information security on their own. So what better good could they do than to inspire the mother of invention; necessity.

Re:TrueCrypt suggesting migration to BitLocker? by jebblue on Wednesday May 28, 2014 @07:16PM (#7813609)
I'd agree, that seems more believable than some of the other theories I've read.
Re:TrueCrypt suggesting migration to BitLocker? by tomku on Wednesday May 28, 2014 @06:40PM (#7813420)
As crazy as it sounds, I think you're right and it's just the developer(s) quitting (rage-quitting?) the project. Nothing else makes sense.

The Bitlocker thing seems strange until you realize that it probably really IS the best alternative for most users. The users who are paranoid enough to not trust Bitlocker can probably look out for their own security, so it makes sense to give instructions for the rest.

None of the explanations people have came up with regarding intelligence agencies and conspiracies really hold water. If the devs were compromised, I doubt they would be given the freedom to post something like they did today. If they were under some kind of NSL or gag order, this would almost certainly violate it.

Re:TrueCrypt suggesting migration to BitLocker? by danrik on Wednesday May 28, 2014 @09:26PM (#7814096)
No more than shutting down Lavabit violated whatever NSLs/court orders were directed at it.
Re:TrueCrypt suggesting migration to BitLocker? by mercer on Thursday May 29, 2014 @08:31AM (#7815867)
> The Bitlocker thing seems strange until you realize that it probably really IS the best alternative for most users. The users who are paranoid enough to not trust Bitlocker can probably look out for their own security, so it makes sense to give instructions for the rest.

It seems odd to me that security specialists would recommend a flawed tool to 'the masses'. It just doesn't fit with what I usually read from people in this line of work.

Re:TrueCrypt suggesting migration to BitLocker? by tomku on Thursday May 29, 2014 @10:37AM (#7816396)
It's pragmatic. BitLocker may or may not be flawed[1], but I don't see a lot of better options for disk encryption on Windows being presented.

[1] - Whether it's flawed or not depends on your needs. Not everyone cares about defending their data against an attacker with the resources of a nation-state - many just want their laptop's hard drives to be effectively inaccessible if the device is stolen or lost.

Re:TrueCrypt suggesting migration to BitLocker? by Adaptive on Wednesday May 28, 2014 @05:55PM (#7813213)
Agreed on the language/vitriol interpretation. I was thinking the same when I listed rogue content maintainer.