Bonum Certa Men Certa

Truecrypt Cannot be Audited Because It's Proprietary Software

Truecrypt



Summary: Why nobody should trust Truecrypt (or any other piece of proprietary software for that matter), even if it claims to have been "audited"

THE other day we alluded to Truecrypt in this post, not quite mentioning the holes in the argument that Truecrypt can be "audited" [1-3]. Unless everyone can view the code and compile it independently (or rely on others to do so independently), we must assume that Truecrypt is not secure and that it might contain back doors (either unidentified or deliberately planted). This whole Internet 'debate' about Truecrypt "audit" should remind us that Free software is vital for dodging surveillance.

The NSA has used corporations to facilitate snooping and it may not be alone [4]. This is happening at many levels [5-7] based on new leaks and revelations, so rather than look for evidence of insecurity (e.g. back door) we should pursue real assurance of security. You know what the spies like to tell us: if you have nothing to fear, you have nothing to hide, right? So come on, Truecrypt, share your source code. What have you got to hide?



Related/contextual items from the news:



  1. Should Truecrypt be audited?
    Truecrypt is a cross-platform, free disk encryption software for Windows and Unix-like operating systems. It is generally considered a good disk encryption software, and not too long ago, I wrote a tutorial that showed how to encrypt the Windows installation of a Windows-Linux dual-boot setup (see Dual-boot Fedora 18 and Windows 7, with full disk encryption configured on both OSs).


  2. New effort to fully audit TrueCrypt raises $16,000+ in a few short weeks


  3. Can you trust 'NSA-proof' TrueCrypt? Cough up some dough and find out
    The source code for the Windows, Linux and Mac OS X utility is publicly available for people to inspect and verify, but this has not been enough to convince every cryptography guru that it's entirely secure.


  4. After Snowden’s leaks, China’s Huawei calls for more transparency in the tech industry
    With all of the recent revelations about the US National Security Agency’s surveillance programs, it must be hard for the Chinese telecom equipment manufacturer Huawei not to gloat a little bit.

    After all, the leaks from former contractor Edward Snowden showed that the NSA enlisted US technology companies to enable its snooping on global telecommunications networks—which is exactly what US intelligence officials have accused Huawei of doing on behalf of the Chinese government.


  5. Europe Moves to Shield Citizens’ Data
    Lawmakers here have introduced a measure in the European Parliament that could require American companies like Google and Yahoo to seek clearance from European officials before complying with United States warrants seeking private data.


  6. Dutch Telcos Used Customer Metadata, Retained To Fight Terrorism, For Everyday Marketing Purposes


    One of the ironies of European outrage over the global surveillance conducted by the NSA and GCHQ is that in the EU, communications metadata must be kept by law anyway, although not many people there realize it.


  7. NSA Harvesting Contact Lists
    A new Snowden document shows that the NSA is harvesting contact lists -- e-mail address books, IM buddy lists, etc. -- from Google, Yahoo, Microsoft, Facebook, and others.


Recent Techrights' Posts

Writing and Coding Isn't Always Enough
Last year we had to assume a role we didn't have before: litigants
Autumn Has Come
Autumn should be exciting in all sorts of ways; it'll also mark our anniversary
 
Gemini Links 01/09/2025: News Corp. WSJ and A Month With NixOS
Links for the day
Slopfarms Already Peaked, They Will Die When Slop Companies Run Out of Money to Borrow
slopfarms will lack an actual "engine"
“Sideloading” Never Killed Anybody
There are many online discussions this week about the misnomer "sideloading"
Slopwatch: Google News as FUD Vector Against Linux and Plagiarism Enhancer, Serial Slopper (SS) Uses LLMs to Googlebomb "Linux"
Slop destroys the Web not just by screwing with search engines and helping plagiarists. It's also responsible for de facto DDoS attacks...
Links 01/09/2025: "Attacks on Science" and China's "Soft Power" Grows
Links for the day
Links 01/09/2025: Fresh Backlash Against Slop and "Norway’s Electricity Crisis is About to Hit Britain"
Links for the day
Links 01/09/2025: Catching Up (Mostly via Deutsche Welle), "Windows TCO" Effect in UK
Links for the day
Gemini Links 01/09/2025: Linguistic Barriers and "Web 1.0 Hosting"
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, August 31, 2025
IRC logs for Sunday, August 31, 2025
The UEFI 9/11 - Part IV - External Interference
They all seem to be playing a role in crushing Software Freedom and self-determination for users
Links 31/08/2025: Baggage Claim Scams, an Insurrectionist’s War on Culture, and a Sudden Robotics Hype
Links for the day
Gemini Links 31/08/2025: Reviewing Netsurf and Slightly Less Historic Ada Design
Links for the day
IBM Has Taken Control of GNOME
Don't expect a successor to be found any time soon
Links 31/08/2025: Google Gmail Data Breach and LF Puff Pieces for Pay
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, August 30, 2025
IRC logs for Saturday, August 30, 2025
This is What Google News Has Become
Moments ago
The Slopfarm WebProNews Has Turned Google News Into a Laughing Stock Full of Plagiarism by Slop
If Google News dies of neglect, that's one thing. It's starting to seem like active neglect by Google is a form of participation.
Do What is Moral, as What's Legal Isn't Always Moral
Do what's objectively moral, no matter the costs and the risks
Slopwatch: Google News Assisting Plagiarism and Anti-Linux FUD, Serial Slopper Rips Off Linux-Centric Journalists
This makes the Web a much worse place and lessens the incentive to do journalism
Links 30/08/2025: NVIDIA Fakes Results to Hide a Bubble Already in Implosion Phase, Data Breaches Galore, Important Win for Workers' Union in Canada
Links for the day
Representing and Speaking for Animals
If I ever choose to take this matter to tribunal with animals-centric NGOs on my side, it'll get some press coverage for sure
The UEFI 9/11 - Part II - Campaign of Censorship and Defamation Against Critics
In dictatorships, humour serves an important role. It's tragic.
In Kazakhstan, Yandex Estimated to be 20 Times Bigger Than Microsoft
Bing is measured as down this month
Shutterstock Not Enough? The Register MS Uses Slop Images in Articles (Seemingly More and More Over Time)
Cost-saving trajectory amid office shutdown?
Gemini Links 30/08/2025: Games, PostmarketOS, and Slop
Links for the day
Links 30/08/2025: Imgur Uproar and Many Ukraine Updates (Mediazona Reports Over 200,000 Russians Died for Putin)
Links for the day
How Not to Build Software
code forges that need a Web browser perhaps fill some 'niche' demand
GAFAM and "MATA"
The use of dark humour there hopefully helps illuminate what a lot of "modern" technology became like and how it interacts with human civilisation (to what ends and whose gain)
Birds Are Not "Pests and Vermin", Privacy is Not a Crime, and GNU/Linux is Not 'Hacking Platform'
I could not help but think of Free software analogies
The Sites Should Be Very Fast Again
That issue is now resolved
Flying in 2025
worse than ever before
Activists, Including Technical Activists, Need Not Pursue Affirmation
Techrights doesn't play or participate in a "popularity contest"
The UEFI 9/11 - Part III - Chaos is Scheduled to Happen Second Thursday of September (No Matter What the Microsofters Tell You)
The clock is ticking
Downplaying the Impact of "UEFI 9/11" is a Losing Strategy
we won't publish much whilst on holiday
Government Sites Should Run Free Software
Not proprietary bloatware with buzzwords
LLM Slopfarms Take No Breaks
When people run sites by bots they don't need to worry about "breaks"
GNOME Having a Meltdown Again
Thanks and farewell to Steven Deobald
Gemini Links 30/08/2025: Low Tech and Hunchbin 1.0.6
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, August 29, 2025
IRC logs for Friday, August 29, 2025