Comment by nickysielicki | Hacker News Reader

Comment by nickysielicki | Hacker News Reader

If I was concerned about my data, I wouldn't touch TrueCrypt with a 10 foot pole. More specifically I wouldn't touch Windows.

Developers don't abruptly shut down projects. If there are problems with the code, they release statements and patches. If they lose interest in the project, they call it orphaned and ask for maintainers. If it's a mix of the two, they at least say so.

But what happened with TrueCrypt was truly bizarre. No warning. No phase-out. Telling people to move to BitLocker?

I think there's only one way to interpret that. They did something bizarre because it was all the noise they could make without telling us what really happened. AKA some of their developers got served gag orders.

But what on earth could a TrueCrypt dev be gagged for? A gag order implies that some three-letter-agency had enough foresight to know they were planning to disclose something. If it was that there was a government backdoor in TrueCrypt itself, how would NSA/FBI know that they discovered it? How would they know that it could be tied back to them? Why didn't the audit [1] catch it? Gag orders are pretty loose in terms of legality in the first place, but even still, would a gag order prevent them from releasing a statement about a security hole (without mentioning its origin) and releasing patches?

It's a total guess, but my theory is that TrueCrypt discovered something outside their codebase (EG: Windows itself) that was undermining encryption. They reached out to Microsoft, who contacted FBI/NSA, and they were served their gag orders. This is the only theory I can think of that makes a gag order possible, in other situations the FBI/NSA wouldn't have been able to know about a disclosure before it happened.

[1]: istruecryptauditedyet.com

If they discovered an issue in Windows, and it led to gag orders, why would they tell people to move to BitLocker (a Microsoft product)?

This is obviously all conjecture, but my argument is that they made their actions as bizarre as possible because it's the only way to get out a distress call. They abruptly push a release that removes all the core functionality. They abruptly say that there will be no future releases. They wanted everyone to plainly see that this isn't them just giving up on the project because they've lost interest.

Suggesting people use Bitlocker is completely against everything they stand for. Here are some quotes off the FAQ on OP's rehosted website:

> > Will TrueCrypt be open-source and free forever?

> Yes, it will. We will never create a commercial version of TrueCrypt, as we believe in open-source and free security software.

> > Why is TrueCrypt open-source? What are the advantages?

> As the source code for TrueCrypt is publicly available, independent researchers can verify that the source code does not contain any security flaw or secret ‘backdoor’. If the source code were not available, reviewers would need to reverse-engineer the executable files. However, analyzing and understanding such reverse-engineered code is so difficult that it is practically impossible to do (especially when the code is as large as the TrueCrypt code).

> Remark: A similar problem also affects cryptographic hardware (for example, a self-encrypting storage device). It is very difficult to reverse-engineer it to verify that it does not contain any security flaw or secret ‘backdoor’.

These same people who condemned closed-source crypto in their FAQ are now suggesting using a closed-source encryption suite? It is completely absurd, and that's the point.

I think a more likely scenario might be that control of the project was seized, and the final release and statements were not from the developers, or they were issued by the developers under duress. It seems more like an agency wanted to shut it down because it worked too well.

I refuse to believe we live in that unfree of a society. I know that we have FISA courts and so forth, but that's still a tier below preventing someone from continuing to publish their computer code. All the 90's cases surrounding cryptography as armaments cemented the notion that it's protected under the first amendment.

> I refuse to believe we live in that unfree of a society.

I could never believe otherwise. Not after everything I've learned in my time on this rock.

I think our society is not this unfree provided you are willing to fight. Several government agencies have the power through fear to do something like this when they deem it necessary, and a very small dev team with no resources or company lawyers to back them up would be an easy target. Sure, fighting such a seizure might yield success, but it is a lot of time and energy and money to devote to a cause. This is the same reason why many people settle lawsuits out of court instead of seeing them through.

I suspect that by recommending encryption software that is highly unreliable like Bitlocker (by virtue of being closed source and developed by Microsoft who we know cannot be trusted) they sent up a huge red flag to their user base.

Nobody would expect the TrueCrypt devs to recommend something like this, so it is immediately suspect and all anyone really needs to asusme something isn't right (like a gag order).

Occam's Razor tells us that the TrueCrypt devs were done with the project and don't share your opinions of Bitlocker and Microsoft.

Except they do share those opinions and very suspiciously changed them in their final message. So what you believe is the simplest explanation doesn't work here.

Who are you to say what opinions they share? Especially considering davts emails...

Bitlocker is by far the most audited encryption solution available...

Audited by who?

I'd imagine by several microsoft crypto experts and the countless people doing auditing for the various organizations that use it.

(Of course I can't really name and shame)

No warning? No phase-out? Are you kidding me. TrueCrypt was completely dead by the time they shut down the project.

Reply on news.ycombinator.com