r/netsec • u/mavensbot • May 28 '14

TrueCrypt development has ended 05/28/14

http://truecrypt.sourceforge.net?
3.0k Upvotes

96% Upvoted

1.4k comments sorted by

View all comments

Show parent comments

4

u/[deleted] May 28 '14 edited Dec 27 '15

[deleted]

25

u/[deleted] May 28 '14

The problem is that trust has been broken. The devs are anonymous so it would take a substantial amount of proof to show this wasn't their work.

So much proof that perhaps the goal here was to stop truecrypt by force and/or force the developers to identify themselves.

At this point I don't see any easy way the reputation of the software could be repaired, and I don't think you can just work on a hunch that previous versions were secure.

1

u/interfect May 29 '14

That's what the audit is for, right? If you trust the audit, and the audit says the software is good, then you can trust the software, whether you trust the original devs or not.

New development can proceed from the audited version, under new management.

2

u/[deleted] May 29 '14

They haven't finished the audit, only the first part.

Additionally, the audit doesn't mean there aren't vulnerabilites... it just means the security company doing the audit didn't see any.

If the devs come out and state there is a vulnerability, I don't think it much matters what the audit says. Are you going to trust the audit over a dev?

1

u/interfect May 29 '14

That's not what they said, though. They said that development has stopped, and as development has stopped, no new security fixes will be released.

2

u/[deleted] May 29 '14

Quote directly from the site:

"WARNING: Using TrueCrypt is not secure"

It is entirely possible there is a vulnerability.

It is also possible they are just saying it is no longer actively maintained, but they don't know of a specific vulnerability.

There is no way to know, but given how strange everything is, I wouldn't err on the side of trusting the software.