Home | Blog | Software | Reviews and Features | Forum | Help | Donate | About us
topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • September 27, 2016, 12:15:57 PM
  • Proudly celebrating 10 years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Last post Author Topic: TrueCrypt is Now Abandonware?!  (Read 20450 times)

mwb1100

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 1,515
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #25 on: May 30, 2014, 04:02:50 AM »
Another problem with that scenario is that while Vista and later support BitLocker, not all editions of Windows support it. You need to have Ultimate or Enterprise (or Pro on Win8). Home, Home Premium, or Pro (on Vista or Win7)  won't cut it.  And that's putting aside the trust issues that people might have with BitLocker.

It's certainly possible that the devs (I thought there were 2 or 3) don't want to work on the project anymore and might not think it's as important as it once was.  But it would be a pretty mean thing to remove people's ability to continue to choose to use the encryption capabilities as they existed in 7.1a just because there are alternatives out there. Then again, they weren't being paid by the users (or if they are, it's donations only), so other than by way of goodwill, there's no reason to expect that the devs should provide anything.

I wouldn't be too surprised if the devs simply resent that the audit effort got a rather large funding pretty quickly (I think that it's possible that the $70K crowdfunded for the audit might be more than the TrueCrypt project received in donations), and decided to pack it in as a result.

Stoic Joker

  • Honorary Member
  • Joined in 2008
  • **
  • Posts: 6,264
    • View Profile
    • www.StoicJoker.com
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #26 on: May 30, 2014, 06:50:26 AM »
Another problem with that scenario is that while Vista and later support BitLocker, not all editions of Windows support it. You need to have Ultimate or Enterprise (or Pro on Win8). Home, Home Premium, or Pro (on Vista or Win7)  won't cut it.  And that's putting aside the trust issues that people might have with BitLocker.

That's a really big (like $200) sticking point to contend with. Especially when coupled with the fact that BitLocker requires the existence of a system partition and a TPM chip or thumb drive "key" to implement, so it's really - a bit of a PITA - not a 2 click fix.

rgdot

  • Supporting Member
  • Joined in 2009
  • **
  • Posts: 1,856
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #27 on: May 30, 2014, 06:55:41 AM »
How many used TC for whole disk encryption vs containers? In the case of the latter, which I guess had more users, Bitlocker is not even an alternative.

phitsc

  • Honorary Member
  • Joined in 2008
  • **
  • Posts: 1,186
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #28 on: May 30, 2014, 06:55:51 AM »
If a crowd-funded security audit of your FOSS project doesn't convince you that there is a tremendous interest in your project, I don't know what will.

Also, bitlocker cannot replace TrueCrypt, as bitlocker is not cross-platform.

And then, why no encouragement for someone to fork, if they see a need for the tool?

Even for someone not usually into conspiracy theories this sounds rather fishy.

40hz

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 11,763
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #29 on: May 30, 2014, 07:49:26 AM »
I'm guessing somebody hired them. Hence the abrupt cessation with no advance warning or details given.  

Forking in the usual sense isn't possible. Truecrypt has its own somewhat ambiguous license which is most assuredly not written in the spirit of the GPL. The FSF has disputed TC's characterization of itself as a "free open source" project for some time now. And with the recent news it's been noted that the license has also been changed so that all "attribution" language has been removed. Since that language also spoke of derivative works, the right to do derivatives or incorporate TC into another product (in exchange for attribution to TC) also appears to no longer apply - hence: no fork. Legal opinion seems to concur that TC's code cannot be forked or incorporated in something else under the current licensing language.  

Expect a commercial product release in the near future.
« Last Edit: May 30, 2014, 08:01:49 AM by 40hz »

wraith808

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 8,269
  • "In my dreams, I always do it right."
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #30 on: May 30, 2014, 09:27:28 AM »
So... anyone have a spare copy of an earlier version lying around?  Redoing my computer, and realized that I didn't keep a copy...

40hz

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 11,763
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #31 on: May 30, 2014, 09:49:20 AM »
So... anyone have a spare copy of an earlier version lying around?  Redoing my computer, and realized that I didn't keep a copy...

rqa.jpg

Filehippo.com still shows older pre-7.2 versions available from them for download although I don't know if these versions have already been 'new' disabled or how long they'll remain up. Better jump on it and check. All the other major download sites I looked at are showing version 7.2 only.
« Last Edit: May 30, 2014, 09:55:13 AM by 40hz »

rgdot

  • Supporting Member
  • Joined in 2009
  • **
  • Posts: 1,856
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #32 on: May 30, 2014, 09:52:15 AM »
I have a "Truecrypt Setup.exe" 7.1a on my XP. If that's not ok I believe Filehippo keeps some old versions. http://www.filehippo.../download_truecrypt/

rgdot

  • Supporting Member
  • Joined in 2009
  • **
  • Posts: 1,856
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #33 on: May 30, 2014, 09:53:11 AM »
I lost the race to 40hz  :P

Jibz

  • Developer
  • Joined in 2005
  • ***
  • Posts: 1,119
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #34 on: May 30, 2014, 10:01:20 AM »
Theres some archived stuff at the bottom of https://www.grc.com/...ecrypt/truecrypt.htm

wraith808

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 8,269
  • "In my dreams, I always do it right."
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #35 on: May 30, 2014, 10:04:43 AM »
I have a "Truecrypt Setup.exe" 7.1a on my XP. If that's not ok I believe Filehippo keeps some old versions. http://www.filehippo.../download_truecrypt/

I got a 7.1a from FileHippo and I'll check it when I get home.  If it's not good, then I might be asking you for your setup file ;)

I only use containers.. and bitlocker doesn't help with that.  *sigh*

How long before this is forked?  I mean, the source *was* available, right?

40hz

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 11,763
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #36 on: May 30, 2014, 10:05:01 AM »
I lost the race to 40hz  :P

I probably only had the jump because I've had clients all in a tizzy start e-mailing me about this beginning at 5:00 this morning -  so I've had time to go look.  ;D

I can't sympathize too much with their moaning. Much as I like TrueCrypt, I've warned them repeatedly to be cautious about deploying or depending on it since (a) AFAIK nobody really knows who's behind it; and (b) it's a 'free' product - and sometimes free products just disappear without warning leaving you high and dry.

Guess I was right on both points. :huh:

I hate it when that happens. ;)

wraith808

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 8,269
  • "In my dreams, I always do it right."
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #37 on: May 30, 2014, 10:10:14 AM »
Theres some archived stuff at the bottom of https://www.grc.com/...ecrypt/truecrypt.htm

Wow, thanks!  That's a very useful link!

I can't sympathize too much with their moaning. Much as I like TrueCrypt, I've warned them repeatedly to be cautious about deploying or depending on it since (a) AFAIK nobody really knows who's behind it; and (b) it's a 'free' product - and sometimes free products just disappear without warning leaving you high and dry.

Guess I was right on both points. :huh:

Not with OSS :)  Which is why I lean towards that for free software that I'm really going to integrate into my workflow.

Quote
The mistake these developers made was in believing that they still “owned” TrueCrypt, and that it was theirs to kill.

40hz

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 11,763
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #38 on: May 30, 2014, 10:15:44 AM »
How long before this is forked?  I mean, the source *was* available, right?

As previously mentioned, TC was never released under a standard FOSS license. And that license has since been changed. The new license makes no provision for using any part of TC's code (which is available) in (or for) something else. Most lawyers think TC cannot be legally forked given the license it's under.

Such is the danger of taking the label "free open-source software" as read without looking into the actual license that applies. Anybody can call anything a FOSS project without incurring any legal obligation or liability. And many individuals and companies (including Microsoft and Oracle) routinely use the word "open" to mislead and muddy up the waters.

Caveat emptor! And beware of geeks bearing gifts. :tellme:

40hz

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 11,763
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #39 on: May 30, 2014, 10:22:45 AM »
Not with OSS :)  Which is why I lean towards that for free software that I'm really going to integrate into my workflow.


You're probably a better coder than I'll ever be. There are several OSS products I depend on that I'd be forced to abandon unless somebody else continues to maintain them. Because I certainly couldn't. And also why I send them a check.

Having source available is all well and good. In theory. But unless you have the chops to maintain and develop it yourself - or the money to single-handedly fund ongoing work on it - once the project's dev team quits the field you’re up the proverbial creek. Or at least I'd mostly be. ;D YMMV ;)
« Last Edit: May 30, 2014, 10:30:51 AM by 40hz »

mwb1100

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 1,515
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #40 on: May 30, 2014, 10:37:12 AM »
And that license has since been changed. The new license makes no provision for using any part of TC's code (which is available) in (or for) something else.

The 7.1a release is licensed under the TrueCrypt License Version 3.0, which seems to permit forks (even if it's not truly an open source license due to attribution and renaming clauses or other restrictions).  As far as I know, the license that TrueCrypt 7.2 was released under wouldn't apply to the 7.1a release.


40hz

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 11,763
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #41 on: May 30, 2014, 11:37:34 AM »
And that license has since been changed. The new license makes no provision for using any part of TC's code (which is available) in (or for) something else.

The 7.1a release is licensed under the TrueCrypt License Version 3.0, which seems to permit forks (even if it's not truly an open source license due to attribution and renaming clauses or other restrictions).  As far as I know, the license that TrueCrypt 7.2 was released under wouldn't apply to the 7.1a release.



All of the TC licenses have been questioned by various Linux/FOSS groups. Several attorneys characterized the licenses as "a legal minefield" and "misleading."

I really can't see anybody (in a position to do so) wanting to have anything to do with TC going forward. The encryption methods are well known, and there are a lot of good programmers out there. What TC brought to the party was a simple GUI and easily installable binaries. It primarily made some complex technology accessible to the masses. Praiseworthy - but nothing that couldn't be done by others.

TrueCrypt's codebase is not essential for anything. There are already existing projects (e.g. tc-play and others) that have been released under genuine FOSS licensing. These could just as easily be used to provide the same functionalities TrueCrypt formerly offered - or to create entirely new encryption products.

I personally think TrueCrypt got used as much as it did for three very simple reasons: (1) It worked. (2) It was easy to install. (3) It was easy to use. None of that is something that couldn't be accomplished by other coders. Especially with the talent pool that's out there.

And it will.

So vaya con Dios, TrueCrypt...

So long, and thanks for all the fish. :Thmbsup: ;)



----------------------------------------------------------------------------------------

Note: the thing that really makes this story interesting is wondering what actually went down.

Especially if it was another "Lavabit situation." Because if it was, it's something we all need to be concerned about.
« Last Edit: May 30, 2014, 11:49:35 AM by 40hz »

J-Mac

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 2,913
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #42 on: May 30, 2014, 12:14:00 PM »
I have the setup files for TC 7.0a and 7.0a1 if anyone is interested.

Jim

CWuestefeld

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 1,001
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #43 on: May 30, 2014, 01:00:12 PM »
I just can't see that the means of announcing this is in character for this project. It just doesn't make sense to recommend BitLocker (given suspicion of MS being sympathetic to gov't surveillance), or to completely ignore Unix and Mac users. I think there's something more than meets the eye.

I’m giving equal odds between:
  • Warrant canaryw (“we’re not saying that we’re being forced to introduce a vulnerability, but we have reason to believe that users of this program may be in danger”). While difficult to add an actual backdoor, it may be that they're being pressured to put a flaw into their PRG code or something subtle like that.
  • The developer(s) is in a snit, maybe because of the trouble of the audit, and just wants to burn it all down
  • The developer just wants to move on, and is taking an opportunity to make a political statement by stepping out in this way (like the Reichstag fire – cause the damage yourself, but make it look like your enemy caused it)

mwb1100

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 1,515
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #44 on: May 30, 2014, 01:05:28 PM »
All of the TC licenses have been questioned by various Linux/FOSS groups.

Just for future reference, here's one of the better posts I came across about problems with the TC license. It's for license version 2.5 in this particular case - I have no idea if any of these issues were addressed by TC license v3.0 used by TC v 7.1a:

  - http://lists.freedes...-October/000276.html

CWuestefeld

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 1,001
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #45 on: May 30, 2014, 01:13:10 PM »
I'm not very excited about any of the alternatives offered by ghacks. I'm looking for an encrypted container, and only a couple do that. And BestCrypt is very expensive, and the other one gives too few details to trust.

There'a a wikipedia article offering a Comparison of disk encryption softwarew that might be a better place to start looking. There are a whole pile of programs considered, with comparison for OS supported and a bunch of features.

TaoPhoenix

  • Supporting Member
  • Joined in 2011
  • **
  • Posts: 4,548
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #46 on: May 30, 2014, 01:26:55 PM »
Okay, here's a new angle.

From a "medium layperson" point of view, what's with this explosion of tools that aren't valid/supported anymore? Maybe MS's notes on the slow death of XP vaguely filtered to me, but I didn't see any articles ever of this current rash of stuff breaking.

Heartbleed, barely a one time shot (but shouldn't really), but truecrypt devs just getting "bored"/other and quitting bothering to update? What is it about May 2014 that takes one of the top contenders in encryption out of the game forever!?

(Rant)
What is with these .Gov depts claiming to spend *Billions* on "Cybersecurity" and then the next story out of Slashdot is "OpenSSL" (that basically the entire Internet uses) "gets two developers". So lemme do the math on my seven dollar calculator. A software routine that counts for like $555 Million in software security security services experiences the greatest hack ever in twenty years, and some foundation assigns Joe and Ted to fix it?!

Slashdot has a sharp eye for Security Theater but where's even the theater?! You see these weird proposals now and then for fancy new initiatives, but how about just funding five guys and a supply of pizza? Nope. Can't do that. It might even break six figures.

:mad:
« Last Edit: May 30, 2014, 01:38:11 PM by TaoPhoenix »

40hz

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 11,763
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #47 on: May 30, 2014, 01:43:04 PM »
At this point I'd put my money on CU's earlier suggestion:

Quote
The developer just wants to move on, and is taking an opportunity to make a political statement by stepping out in this way (like the Reichstag fire – cause the damage yourself, but make it look like your enemy caused it)

   -or-

They were told to stop (i.e. threatened).

    -or-

They decided to roll up their mat - and bug out. Which is also plausible considering the abrupt nature of the cessation. Perhaps it was reaching the point where their identities risked being exposed. And being identified would have resulted in serious consequences for them. (It'd be a riot if these guys were NSA contractors who put TC together just to put a fly in the ointment.)

Whatever. I doubt we'll ever really know for sure. :huh:

TaoPhoenix

  • Supporting Member
  • Joined in 2011
  • **
  • Posts: 4,548
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #48 on: May 30, 2014, 02:00:08 PM »
I just can't see that the means of announcing this is in character for this project. It just doesn't make sense to recommend BitLocker (given suspicion of MS being sympathetic to gov't surveillance), or to completely ignore Unix and Mac users. I think there's something more than meets the eye.

I’m giving equal odds between:
  • Warrant canaryw (“we’re not saying that we’re being forced to introduce a vulnerability, but we have reason to believe that users of this program may be in danger”). While difficult to add an actual backdoor, it may be that they're being pressured to put a flaw into their PRG code or something subtle like that.
  • The developer(s) is in a snit, maybe because of the trouble of the audit, and just wants to burn it all down
  • The developer just wants to move on, and is taking an opportunity to make a political statement by stepping out in this way (like the Reichstag fire – cause the damage yourself, but make it look like your enemy caused it)

I just want to drift a little off topic to add exposure to a concept that I barely could reference before.

Warrant Canary/Canary Server/____

https://en.wikipedia.../wiki/Warrant_canary

I think this will become an undersold concept in security concepts. It runs like this:
"Today I was not arrested for ____".

While it is horribly vulnerable to slackards like me, for someone really on the front line of a top level issue, it's a way to send a negative signal that trouble is brewing. I'd seen it described once before a long ways back, but this thread produced a fresh new reference that I just had to echo.

I think it adds a (rather desperate) new level to "you have the right to remain silent".


J-Mac

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 2,913
    • View Profile
    • Donate to Member
Re: TrueCrypt is Now Abandonware?!
« Reply #49 on: May 30, 2014, 03:12:33 PM »
Steve Gibson wrote earlier about some tweets between Steven Barnhart and his "contact" at TrueCrypt, someone named "David". As follows:

Quote
And then the TrueCrypt developers were heard from . . .
Steven Barnhart (@stevebarnhart) wrote to an eMail address he had used before and received several replies from “David.” The following snippets were taken from a twitter conversation which then took place between Steven Barnhart (@stevebarnhart) and Matthew Green (@matthew_d_green):

    TrueCrypt Developer “David”: “We were happy with the audit, it didn't spark anything. We worked hard on this for 10 years, nothing lasts forever.”
    Steven Barnhart (Paraphrasing): Developer “personally” feels that fork is harmful: “The source is still available as a reference though.”
    Steven Barnhart: “I asked and it was clear from the reply that "he" believes forking's harmful because only they are really familiar w/code.”
    Steven Barnhart: “Also said no government contact except one time inquiring about a ‘support contract.’ ”
    TrueCrypt Developer “David” said: “Bitlocker is ‘good enough’ and Windows was original ‘goal of the project.’ ”
    Quoting TrueCrypt Developer David: “There is no longer interest.”

I don’t know if he's making it up (as he sometimes does) or if this is real info.

Page is at:  https://www.grc.com/misc/truecrypt/truecrypt.htm

Jim