Replace TrueCrypt – Candidate alternatives
tails.boum.org
tails.boum.org
Chances are, someone will either fork TrueCrypt (version 3.1 of the TrueCrypt license seems to make this a legitimate possiblity) or create a replacement, possibly using the same container format. TrueCrypt is pretty much just as good as it was before this happened. Give it a couple of months before you start switching over to some other solution (which is likely to be less "battle-hardened" than the incredibly popular TrueCrypt anyway, and thus somewhat more likely to be insecure). There's no rush.
I think the "security concerns" expressed on the truecrypt page are more-or-less for future visitors to understand the project is not maintained anymore (albeit a poor way to go about expressing that)
There's a lot of information flying around so I may have missed something. Why is the official page, which states that there are security concerns, "clearly" a joke?
For Linux, they recommend: >Use any integrated support for encryption. Search available installation packages for words encryption and crypt, install any of the packages found and follow its documentation.
Does that seem serious to you?
For Mac OSX, here is the configuration they recommend for creating an encrypted volume: http://truecrypt.sourceforge.net/OSXNewImage.png
Note where under Encryption they've selected "None".
The point is, now another entity will need to establish validity as being a trusted provider; there was no reason to rock the boat per se, and as someone who laughs at most things, it just... really isn't altogether funny, unfortunately.
edit: assuming that it turned out to be a joke, for the sake of discussion (though is there a difference at this point?)
They've changed binaries too without bumping the version number and then re-released them unannounced.
This has been known for a very long time now. I'm not sure why people are surprised at the latest developments:
Given this comment and some inspiration from tacotime in this [1] post, it dawned on me: What if this whole thing is a not-so-subtle effort by the developer(s) to renew interest in TrueCrypt and pass the torch? The license ambiguity might be an issue (in terms of whether it retroactively covers encryption support in earlier versions or not), but if that were resolved, then perhaps all of this speculation, wild conspiracies, and other noise is for naught. Maybe this is their way of stepping down and saying "Hey, look, we're not maintaining this anymore. We're changing the license, so knock yourselves out."
I'm assuming that the license changes are technically retroactive since it seems the developer(s) have decided it's time to move on (and who can blame them after 10 years?).
For example, TrueCrypt can't encrypt the system drive if your computer uses UEFI and/or your boot drive has a GPT parition table. This is a major nuisance since nearly all new PCs have UEFI enabled by default. But TrueCrypt development has all but stalled for the last couple of years, and now there's zero hope of ever getting UEFI support.
But while I once wrote for my mom a document with step-by-step instructions on how to create and use a TrueCrypt volume to keep some work documents secured, I don't see any alternative in either post that is going to be as accessible to normal folks (like her) as TrueCrypt.
[1] http://grugq.tumblr.com/post/60464139008/alternative-truecry... [2] http://www.dyne.org/software/tomb/
Needless to say, I think you can take their cryptic recommendations with a huge grain of salt.
https://twitter.com/matthew_d_green/status/47199831543788339...
The knee jerk reaction here is "omg, prism, Microsoft!". But the reality is that you have no idea who the TrueCrypt people are and their level of trustworthiness --- for all you know they work for NSA or FSB!
If you are a windows user, use the manual and use BitLocker for FDE and EFS for folder and files.
You can have the same assumption for BitLocker.
So as far as I understand, it is possible to audit Microsoft's crypto code too. I can imagine the audit of crypto code wouldn't find anything. The real problem is:
http://regmedia.co.uk/2014/05/16/0955_peter_gutmann.pdf
"Crypto won't save you either"
"Crypto Summary:
Number of attacks that broke the crypto: 0
Number of attacks that bypassed the crypto: All the rest
- No matter how strong the crypto was, or how large the keys were, the attackers walked around it"
You wouldn't trust the drunk driver who's crashed his last few vehicles to borrow your car. The intelligence agencies own Microsoft, as far as users are concerned, and when cryptosystems have to be crippled for their priorities, we can't expect them to hold up to other attacks.
And for MS there is this story: http://www.geekwire.com/2013/report-microsoft-nsa/
This is of course no evidence for the (in)security of TC/Bitlocker, but I would call it indirect evidence, and certainly more than 'blind faith'.
BitLocker is somewhat more business oriented -- thus they feature things like key recovery, more protection (or might be taken as limitation to some) when the hard drive is removed from one computer and ported to another machine, etc.
TrueCrypt seemed to be aimed more toward security than manageability, lacked those features above, which might have aligned with user demographies that these "business" requirements either they didn't want to have or not relevant.
The fact the German and recently Chinese governments have specifically banned their users from trusting windows 8 + TPM doesn't thrill me with confidence.
The fact that bitlocker kindly sends a copy of your HDD recovery key to Microsoft if you have windows 8 linked to your live account doesn't strike me as brilliant, either.
Oh, and the fact I need to upgrade to the Ultimate or Enterprise editions of Windows means it doesn't help a large majority of users.
Even if truecrypt were written as part of an NSA/FBI joint project it's still works across the three main OS's and it has the source code available for scrutiny (deterministic build issues aside).
I believe TrueCrypt was started as a student project, and was no longer worth the effort to the developer(s). For a student or young developer interesting in cryptography, the reward is in the work itself, and in other people using the software. A decade later, though, with less free time, it's much less fun. At that point, a developer could either commercialize their work, or abandon it. TrueCrypt had very little chance of commercial success, since full-disk encryption comes with all new operating systems, so it's been abandoned.
My conclusion is that only for-pay (open-source or not) FDE software can be a viable alternative to TrueCrypt, anything else will eventually be abandoned too. Consider that every project mentioned on this page is based on dm-crypt, part of the Linux kernel, which is supported financially by Intel, HP, and so on. That is a viable, long-term solution, and probably the only one.
But if we want a diversity of cryptography software, we are going to have to start paying for it.
It's entirely possible to have a good free (as in beer and freedom) full disk encryption tool. In fact, we have several which are in quite wide use today. See: dm-crypt, loop-aes, luks, tcplay, encfs, ecryptfs, etc (okay, some of these aren't FDE tools in and of themselves, but parts of a system which can be used for FDE). Anyone who uses FDE on Linux is surely using one or two of these.
It's really just a matter of someone being motivated enough to develop one for Windows. The entire reason for TrueCrypt's popularity over Bitlocker was that it was open source software. All this means is that one developer got sick and tired of it, which is completely understandable, but it can absolutely not be extrapolated to say that all have.
DiskCryptor is currently looking like the next big viable alternative for an open source Windows FDE tool. I'm hoping we see some EFI support though, so I can finally get off BIOS mode.
In my opinion, the best method is to gather a few skilled Windows driver developers to craft a driver based around existing technology, like FreeOTFE, which supports dm-crypt images.
It'll be interesting to see what happens, I certainly think the demand and interest is high enough that we can get some good people on the case. Hopefully some who won't select a ridiculous license.
That is, unless we support freely-licensed encryption software, financially, rather than just use it.
It compares them on features such as operating system, Hidden containers,, Pre-boot authentication, Single sign-on, Custom authentication, Multiple keys, Passphrase strengthening, Hardware acceleration, TPM, Filesystems, Two-factor authentication
[1] http://en.wikipedia.org/wiki/Comparison_of_disk_encryption_s...
If you're using Linux, or DragonFly, or even Tails, then sure, it should work fine (which is likely why it's being considered as a replacement in Tails), but it doesn't have stated support for OS X, Windows, etc.
TrueCrypt, on the other hand (despite whatever else ails it) is supported on all of the above.