TrueCrypt compromised by ?????

Right now we only know that the site was hacked. There is no solid news if there is anything wrong with Truecrypt but since it is open source and no information about the exploit has been told, it is relatively safe to assume that it is a scam.

Bill Kindle

The more I've read about it I'm seeing that the MD5 hashes weren't matching up, so if it's a hoax, it's pretty damn elaborate.

scottalanmiller

@Bill-Kindle said:

The more I've read about it I'm seeing that the MD5 hashes weren't matching up, so if it's a hoax, it's pretty damn elaborate.

Which checksums weren't matching?

Bill Kindle

let me go back and find that article.

Edit. Apologies, I read part of the article wrong. BILL FAIL

Reid Cooper

@Bill-Kindle said:

let me go back and find that article.

Edit. Apologies, I read part of the article wrong. BILL FAIL

LOL

Reid Cooper

Does that mean we don't think that there is anything to this?

StrongBad

@Reid-Cooper said:

Does that mean we don't think that there is anything to this?

Sniff test says that this is a scam to me.

technobabble

Well everyones talking about it on twitter and other websites. Here's what PC World is saying: http://www.pcworld.com/article/2241300/truecrypt-now-encouraging-users-to-use-microsofts-bitlocker.html

StrongBad

Not sure that that clears anything up. If the site was hacked that would explain this. Something is very fishy. And what about non-Windows users. XP retirement would mean nothing for them.

alexntg

@technobabble said:

Well everyones talking about it on twitter and other websites. Here's what PC World is saying: http://www.pcworld.com/article/2241300/truecrypt-now-encouraging-users-to-use-microsofts-bitlocker.html

That makes sense, as Windows has the same functionality built-in.

alexntg

@StrongBad said:

Not sure that that clears anything up. If the site was hacked that would explain this. Something is very fishy. And what about non-Windows users. XP retirement would mean nothing for them.

OS X has had disk encryption for years.

Dashrender

@alexntg said:

@technobabble said:

Well everyones talking about it on twitter and other websites. Here's what PC World is saying: http://www.pcworld.com/article/2241300/truecrypt-now-encouraging-users-to-use-microsofts-bitlocker.html

That makes sense, as Windows has the same functionality built-in.

Sure, but it's closed source.. so it's really not trustworthy!

alexntg

@Dashrender said:

@alexntg said:

@technobabble said:

Well everyones talking about it on twitter and other websites. Here's what PC World is saying: http://www.pcworld.com/article/2241300/truecrypt-now-encouraging-users-to-use-microsofts-bitlocker.html

That makes sense, as Windows has the same functionality built-in.

Sure, but it's closed source.. so it's really not trustworthy!

Until recently, no one had actually audited TrueCrypt's code, so for a very long time, it could have had massive backdoors that no one cared to look for. Whether it's open source or close source, it doesn't really matter. On one side, you hope the folks that wrote it were trustworthy and that if there were any issues, they or an associate caught it. On the other hand, you hope that the folks that wrote it were trustworthy and that if there were any issues, they or an associate caught it. Unless you're manually auditing the code yourself, what does it matter?

JaredBusch

This seems too coordinated for a hack IMO. There are way too many pieces being changed at the same time. Yeah if it was just the website or just the source code, but the way back machine has no info? That is abnormal. The new executable being signed with the correct but recently reissued key? Unusual.

This is a lot of stuff to change and would be an unprecedented public hack.

scottalanmiller

@alexntg said:

@Dashrender said:

@alexntg said:

@technobabble said:

Well everyones talking about it on twitter and other websites. Here's what PC World is saying: http://www.pcworld.com/article/2241300/truecrypt-now-encouraging-users-to-use-microsofts-bitlocker.html

That makes sense, as Windows has the same functionality built-in.

Sure, but it's closed source.. so it's really not trustworthy!

Until recently, no one had actually audited TrueCrypt's code, so for a very long time, it could have had massive backdoors that no one cared to look for. Whether it's open source or close source, it doesn't really matter. On one side, you hope the folks that wrote it were trustworthy and that if there were any issues, they or an associate caught it. On the other hand, you hope that the folks that wrote it were trustworthy and that if there were any issues, they or an associate caught it. Unless you're manually auditing the code yourself, what does it matter?

No one published an audit. Doesn't imply that it wasn't audited.

scottalanmiller

@JaredBusch said:

This seems too coordinated for a hack IMO. There are way too many pieces being changed at the same time. Yeah if it was just the website or just the source code, but the way back machine has no info? That is abnormal. The new executable being signed with the correct but recently reissued key? Unusual.

This is a lot of stuff to change and would be an unprecedented public hack.

True it is seemingly more and more likely to be legit.

It's not really a needed product anymore across any platform. But still very odd.

alexntg

@scottalanmiller said:

@alexntg said:

@Dashrender said:

@alexntg said:

@technobabble said:

Well everyones talking about it on twitter and other websites. Here's what PC World is saying: http://www.pcworld.com/article/2241300/truecrypt-now-encouraging-users-to-use-microsofts-bitlocker.html

That makes sense, as Windows has the same functionality built-in.

Sure, but it's closed source.. so it's really not trustworthy!

Until recently, no one had actually audited TrueCrypt's code, so for a very long time, it could have had massive backdoors that no one cared to look for. Whether it's open source or close source, it doesn't really matter. On one side, you hope the folks that wrote it were trustworthy and that if there were any issues, they or an associate caught it. On the other hand, you hope that the folks that wrote it were trustworthy and that if there were any issues, they or an associate caught it. Unless you're manually auditing the code yourself, what does it matter?

No one published an audit. Doesn't imply that it wasn't audited.

Nor does it imply that it was audited.

scottalanmiller

No. But every company and every individual had the right and the ability to audit. That's important. Companies have coverage tools that they use all the time on this stuff.

technobabble

Unless I am mistaken Bit locker is only for enterprise which is another reason its not a good replacement.

alexntg

@technobabble said:

Unless I am mistaken Bit locker is only for enterprise which is another reason its not a good replacement.

BitLocker's available with 8.1 Pro.

alexntg

@scottalanmiller said:

No. But every company and every individual had the right and the ability to audit. That's important. Companies have coverage tools that they use all the time on this stuff.

Have you used TrueCrypt before?

scottalanmiller

@technobabble said:

Unless I am mistaken Bit locker is only for enterprise which is another reason its not a good replacement.

And requires different tools on different platforms.

scottalanmiller

@alexntg said:

@scottalanmiller said:

No. But every company and every individual had the right and the ability to audit. That's important. Companies have coverage tools that they use all the time on this stuff.

Have you used TrueCrypt before?

Long ago just a little. Use LUKS now.

alexntg

@scottalanmiller said:

@alexntg said:

@scottalanmiller said:

No. But every company and every individual had the right and the ability to audit. That's important. Companies have coverage tools that they use all the time on this stuff.

Have you used TrueCrypt before?

Long ago just a little. Use LUKS now.

Did you audit TrueCrypt?