05.31.14

TrueCrypt Too Proprietary to be Secure and Corporate Media Should Stop Blaming Free/Open Source Software (FOSS)

Posted in Free/Libre Software, Security at 4:36 am by Dr. Roy Schestowitz

TrueCrypt was never worth trusting in the first place

Summary: Analysis of the whole TrueCrypt fiasco and response to the blaming of FOSS (where the licences are clearly not FOSS)

PROPRIETARY software should be assumed insecure by design, as it often contains back doors and one simply cannot prove otherwise. Based on experience alone, a lot of proprietary software comes with back doors, sometimes accidentally but not always. A lot has been written about this before, both here and elsewhere, so we are not going to write so much on this subject. Instead we wish to focus on the news that TrueCrypt development is moving to Switzerland (the first article we found about this is [1] and there is also some analysis [2]). The PATRIOT Act comes to mind and also the experiences of secure mail services in the United States, including Edward Snowden’s E-mail provider. When Groklaw shut down, citing concerns over NSA spying, it recommended that people adopt Kolab, which is based in Switzerland. It should be emphasised that Switzerland harbours privacy not because of humanitarian interests but because of national interests. For domestic prosperity it facilitates international crime (tax evasion from all nations) and wishes to guard the criminals.

The problems with TrueCrypt are not new to us; I very much predicted what the news insinuates and I had received flack for saying so. TrueCrypt has been thoroughly and even successfully openwashed based on some odd kind of marketing angle; those close to the project know better how it works and if an audit which is not transparent is needed for TrueCrypt, then we should quickly realise that the build process and some components are wrapped in a riddle/mystery. The very core of the problem, including its build process, are very crucial. The announcement from TrueCrypt was as vague — not transparent — as the project itself.

Now it is widely known that TrueCrypt gave an illusion of privacy, which is in many ways worse than having no privacy at all because there is impact on users’ behaviour. We may never know how many people have gone to jail or were killed because of TrueCrypt’s false promise.

FOSS-hostile sites try to spin that as an issue with FOSS even though it’s not FOSS. One source states: “The abrupt announcement that the widely used, anonymously authored disk-encryption tool Truecrypt is insecure and will no longer be maintained shocked the crypto world–after all, this was the tool Edward Snowden himself lectured on at a Cryptoparty in Hawai’i.”

Snowden uses Debian GNU/Linux (Tails) and the main reporter he worked with, Glenn Greenwald, only recently dumped Microsoft Windows and moved to GNU/Linux.

There has been a lot more coverage about it [1, 2], including the usual scaremongering by Mr. Goodin, who wrote about it not once but twice, saying: “One of the official webpages for the widely used TrueCrypt encryption program says that development has abruptly ended and warns users of the decade-old tool that it isn’t safe to use.”

Goodin’s colleague wrote about it as well. They are really milking this cow and the best known CIA-linked news site asked: “Is this the end of popular encryption tool TrueCrypt?”

The plutocrats’ press, Forbes, called it “Open Source” (in the headline), so it can’t even get its basic facts right:

Over the past 24 hours the website for TrueCrypt (a very widely used encryption solution) was updated with a rather unusually styled message stating that TrueCrypt is “considered harmful” and should not be used. If you have not come across TrueCrypt and why it has become so popular see the below section ‘why do people use TrueCrypt’.

Better coverage came from the expected sources, not playing to the tune of FOSS smears (TrueCrypt is proprietary).

Knowing that Microsoft is an NSA partner, Gordon in our IRC channels felt baffled because TrueCrypt is “now recommending bitlocker for windows”, to which Ryan replied: “Proprietary encryption from Microsoft that was designed in partnership with the NSA…”

Microsoft is talking to British police about encryption. When I wrote about this nearly a decade ago Microsoft staff were using personal insults against me, only later (much later) to realise that I was right. Sean Michael Kerner calls TrueCrypt “Open-Source” (with a dash) when he writes: “The other challenge facing TrueCrypt is the simple fact that there are many other disk-encryption technologies now available. On Microsoft’s Windows operating system in particular, which was a key target platform for TrueCrypt, versions of Windows after Windows XP include support for Bitlocker, which performs a similar function. In addition, there are multiple file-encryption technologies available, including, FileVault for Mac, DiskCryptor for Windows and Luks for Linux.”

Proprietary operating systems are not compatible with encryption for the same reason that proprietary hypervisors are not. If the NSA can infiltrate the lower layer (e.g. VM host, OS, BIOS) through back doors, then the rest (what’s above) is almost automatically compromised. No sane developer would recommend anything that’s proprietary for security and privacy. Don’t forget Microsoft's COFEE and CIPAV. Microsoft is very much in bed with spooks and police. Microsoft is an informant without conciousness. Privacy in Windows is not a goal; the contrary is true. One Linux/BSD site thinks that TrueCrypt is now “dead” and there is the following statement about the software licence:

Based on the wording of its license, there was always a question mark surrounding the open source-ness of Truecrypt. But that’s not the topic of this brief article. What prompted me to write this is an article that appeared in the Washington Post suggesting that TrueCrypt may have seen its last days as an (“open source”) software project.

Just remember that TrueCrypt is not FOSS.

There is another project whose software licence was blamed for lack of participation and oversight. The OSI’s President blamed the licence. That project was OpenSSL, which is now scrambling to get some more money. The Economist makes FUD out of it while other sites take a more objective approach [4-15]. Remember this: if the project is not quite as open or free as it wants people to believe, then it might not be worth trusting. We never trusted TrueCrypt. █

Related/contextual items from the news:

1. TrueCrypt Not Dead, Forked and Relocated to Switzerland

   The development of TrueCrypt, an open source piece of software used for on-the-fly encryption, has been terminated and users have been advised not to use it because it is not secure enough. Now, it seems that another team of developers have forked the software and rebased it in Switzerland.

2. Death (?) And Rebirth!

3. TrueCrypt, An Open-Source Whole-Disk Encryption System, Leaves Users High And Dry

4. Tough Love for the Encryption Software That Was Compromised by Heartbleed

5. CII announces 2 full-time devs and a security audit for OpenSSL

6. Heartbleed: Linux Foundation hires dynamic duo to fix OpenSSL

7. Linux Foundation throws money at OpenSSL staffing post-Heartbleed

8. The Linux Foundation’s Core Infrastructure Initiative Announces New Backers, First Projects to Receive Support and Advisory Board Members

   The Core Infrastructure Initiative (CII), a project hosted by The Linux Foundation that enables technology companies, industry stakeholders and esteemed developers to collaboratively identify and fund open source projects that are in need of assistance, today announced five new backers, the first projects to receive funding from the Initiative and the Advisory Board members who will help identify critical infrastructure projects most in need of support.

9. The Linux Foundation Assigns Two Full-Time Developers to Work on OpenSSL

10. LF Announces New Backers, Projects For Core Infrastructure

11. Linux Foundation adds more Internet protocols to its protection list

12. Everyone uses OpenSSL, but nobody’s willing to fix it — except the Linux Foundation

13. Linux Foundation flings two full-time developers at OpenSSL

    The Linux Foundation’s new elite tech repair team has named its initial areas of focus as it works to find and seal holes in widely-used open source software.

    The Linux Foundation announced on Thursday that members of the “Core Infrastructure Initiative” (CII) will dedicate resources to working on the Network Time Protocol, OpenSSH, and OpenSSL to hunt down and fix flaws in the tech that helps tie the internet together.

    “All software development requires support and funding. Open source software is no exception and warrants a level of support on par with the dominant role it plays supporting today’s global information infrastructure,” said Jim Zemlin, the executive director of the Linux Foundation.

14. Corporations put their cash where their open source security is

    OpenSSL and Open Crypto Audit Project are the first open source projects to receive funding from the Core Infrastructure Initiative.

15. The Linux Foundation Draws Backers and Funds to Tackle Tech Problems

Permalink Leave Your Comment      Send this to a friend

Manufacturing Propaganda in Microsoft-funded Circles to Belittle FOSS and Magnify Microsoft

Posted in Deception, GNU/Linux, Google, Microsoft at 3:44 am by Dr. Roy Schestowitz

Summary: Some timely examples of facts being abandoned and an alternative reality being introduced by Microsoft-funded firms and lobbyists

FOR nearly 8 years we have focused on tackling FUD and showing where the FUD came from. Public perceptions and truths (objective facts) are an abyss apart when massive PR agencies do what they’re paid to do, which is to screw with public perceptions and drive the population further away from the truth (for a profit).

In Microsoft’s parallel universe, only the desktop counts and GNU/Linux is still somewhat of an underdog with 1% market share. Microsoft relies on corruptible voices to spread such myths and it is improperly counting share in other areas, not just on desktops/laptops.

Charlie Demerjian, whom Microsoft tried to corrupt with some freebies (he declined), has published this long article titled “Microsoft is now irrelevant to computing, and they want you to know it” (highly recommended read).

To quote one portion: “With two major cave-ins in the past few weeks, Microsoft is screaming at the top of its lungs about how irrelevant it is. If you didn’t understand the fall of Microsoft from powerful monopolist to computing afterthought, let SemiAccurate explain it to you.

“For the past few decades, Microsoft has been a monopoly with one game plan, leverage what they have to exclude competition. If someone had a good idea, Microsoft would come out with a barely functional copy, give it away, and shut out the income stream of the innovator. Novell, Netscape, Pen, and countless others were crushed by this one dirty trick, and the hardware world bowed to Redmond’s whims.”

Here is more: “Competition was likewise non-existent, anyone that tried was shut out of new PCs, shut out of interoperability, had revenues devastated by free offerings from Microsoft, and many other similar monopoly games. Microsoft was the proverbial fat and lazy behemoth that was quite content to count their money and turn screws on customers whenever they needed more. If you doubt the seriousness of this stagnation, ask yourself what the last innovation Microsoft came up with was, not evolution but true innovation. I can’t think of any either.”

Here is the part about GNU/Linux: “Similarly with Linux, Microsoft just made sure that no OEM could bundle it with PCs, any that tried paid a high price. It was shut out. On the datacenter side however, Microsoft couldn’t force bundle Windows Server, customers put their own software on. For some strange reason, most large datacenters balk at paying $2000+ per two sockets for something that is vastly inferior to manage, slower, more resource hungry, and completely insecure versus the free alternative.

“Microsoft’s server market share went from 66%+ of sockets to less than 30% in five years, mostly due to datacenters and consolidation. Please don’t look for this to be reflected in the numbers from the big consulting houses, they are too afraid of revenue loss to count sockets. Instead they use the metrics that their customers want them to use, and only count sales of servers from certain vendors and sold OSes, a small fraction of the market. Microsoft didn’t just lose the server market, they were blown out of the water and have no way to recover. Other than internal services, Microsoft is just not relevant in the cloud. If you doubt this, go price a server instance from Rackspace, keep hardware constant and only vary the OS. Game over.”

Demerjian is alluding right there at the start to Gartner and IDC, two firms that create an illusion that Microsoft is relevant on servers (in top Web servers Microsoft is at around 9% and in HPC Microsoft is hardly even at 1%).

Then come mobile devices (smartphones, tablets, etc.) which basically count as computers quite comparable to laptops. Demerjian writes: “That said most people didn’t grasp how badly Microsoft had fallen, they were totally irrelevant and had no more monopoly to leverage. This played out with the Windows 8 launch, Microsoft was desperately trying to stay relevant in mobile by forcing the entire computing ecosystem to adopt their new mobile OS. In theory this would lead to software being leveraged across platforms, and between Office and Exchange, they could force people to use Microsoft mobile products.

“A funny thing happened though, an entire generation of users didn’t want to give up their beloved iPhones or Android devices for an inferior, slower, more expensive, app-free Microsoft device. Microsoft repeated their threat loudly, “Use our mobile OS or you won’t get Office or Exchange on your phone!” To their abject horror the response was almost universally, “OK, bye”.”

Microsoft is now attempting to fight Linux domination in mobile devices by taxing them. Mike Masnick becomes an accidental victim of spin and deception from Microsoft lobbyist Florian Müller, spreading another myth by naming only potential costs and making it look like patents add up to $120 on a phone. It’s a shame that Masnick fell for it. Everyone knows that many phones cost far less than $120 and the nature of this warped analysis seeks to ‘normalise’ patent extortion against the likes of Android/Linux. There is agenda there. Hopefully Masnick will recognise this error because other than that he has done great work exposing Microsoft trolls like Intellectual Ventures that still do evil every month (usually via proxies). Masnick has also covered the sham of a ‘reform’ against patent trolls, which did not happen because trolls like Intellectual Ventures lobbied Congress for years and are still doing everything to keep this broken system of endless scope in place.

In order to artificially make Android more expensive Microsoft has been passing patents to patent trolls such as MOSAID. This is how Microsoft ‘competes’. Microsoft wants taxes on phones to be seen as ‘normal’, or a status quo. █

Permalink A Single Comment      Send this to a friend