EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

05.31.14

TrueCrypt Too Proprietary to be Secure and Corporate Media Should Stop Blaming Free/Open Source Software (FOSS)

Posted in Free/Libre Software, Security at 4:36 am by Dr. Roy Schestowitz

TrueCrypt was never worth trusting in the first place

Telecommunication

Summary: Analysis of the whole TrueCrypt fiasco and response to the blaming of FOSS (where the licences are clearly not FOSS)

PROPRIETARY software should be assumed insecure by design, as it often contains back doors and one simply cannot prove otherwise. Based on experience alone, a lot of proprietary software comes with back doors, sometimes accidentally but not always. A lot has been written about this before, both here and elsewhere, so we are not going to write so much on this subject. Instead we wish to focus on the news that TrueCrypt development is moving to Switzerland (the first article we found about this is [1] and there is also some analysis [2]). The PATRIOT Act comes to mind and also the experiences of secure mail services in the United States, including Edward Snowden’s E-mail provider. When Groklaw shut down, citing concerns over NSA spying, it recommended that people adopt Kolab, which is based in Switzerland. It should be emphasised that Switzerland harbours privacy not because of humanitarian interests but because of national interests. For domestic prosperity it facilitates international crime (tax evasion from all nations) and wishes to guard the criminals.

The problems with TrueCrypt are not new to us; I very much predicted what the news insinuates and I had received flack for saying so. TrueCrypt has been thoroughly and even successfully openwashed based on some odd kind of marketing angle; those close to the project know better how it works and if an audit which is not transparent is needed for TrueCrypt, then we should quickly realise that the build process and some components are wrapped in a riddle/mystery. The very core of the problem, including its build process, are very crucial. The announcement from TrueCrypt was as vague — not transparent — as the project itself.

Now it is widely known that TrueCrypt gave an illusion of privacy, which is in many ways worse than having no privacy at all because there is impact on users’ behaviour. We may never know how many people have gone to jail or were killed because of TrueCrypt’s false promise.

FOSS-hostile sites try to spin that as an issue with FOSS even though it’s not FOSS. One source states: “The abrupt announcement that the widely used, anonymously authored disk-encryption tool Truecrypt is insecure and will no longer be maintained shocked the crypto world–after all, this was the tool Edward Snowden himself lectured on at a Cryptoparty in Hawai’i.”

Snowden uses Debian GNU/Linux (Tails) and the main reporter he worked with, Glenn Greenwald, only recently dumped Microsoft Windows and moved to GNU/Linux.

There has been a lot more coverage about it [1, 2], including the usual scaremongering by Mr. Goodin, who wrote about it not once but twice, saying: “One of the official webpages for the widely used TrueCrypt encryption program says that development has abruptly ended and warns users of the decade-old tool that it isn’t safe to use.”

Goodin’s colleague wrote about it as well. They are really milking this cow and the best known CIA-linked news site asked: “Is this the end of popular encryption tool TrueCrypt?”

The plutocrats’ press, Forbes, called it “Open Source” (in the headline), so it can’t even get its basic facts right:

Over the past 24 hours the website for TrueCrypt (a very widely used encryption solution) was updated with a rather unusually styled message stating that TrueCrypt is “considered harmful” and should not be used. If you have not come across TrueCrypt and why it has become so popular see the below section ‘why do people use TrueCrypt’.

Better coverage came from the expected sources, not playing to the tune of FOSS smears (TrueCrypt is proprietary).

Knowing that Microsoft is an NSA partner, Gordon in our IRC channels felt baffled because TrueCrypt is “now recommending bitlocker for windows”, to which Ryan replied: “Proprietary encryption from Microsoft that was designed in partnership with the NSA…”

Microsoft is talking to British police about encryption. When I wrote about this nearly a decade ago Microsoft staff were using personal insults against me, only later (much later) to realise that I was right. Sean Michael Kerner calls TrueCrypt “Open-Source” (with a dash) when he writes: “The other challenge facing TrueCrypt is the simple fact that there are many other disk-encryption technologies now available. On Microsoft’s Windows operating system in particular, which was a key target platform for TrueCrypt, versions of Windows after Windows XP include support for Bitlocker, which performs a similar function. In addition, there are multiple file-encryption technologies available, including, FileVault for Mac, DiskCryptor for Windows and Luks for Linux.”

Proprietary operating systems are not compatible with encryption for the same reason that proprietary hypervisors are not. If the NSA can infiltrate the lower layer (e.g. VM host, OS, BIOS) through back doors, then the rest (what’s above) is almost automatically compromised. No sane developer would recommend anything that’s proprietary for security and privacy. Don’t forget Microsoft's COFEE and CIPAV. Microsoft is very much in bed with spooks and police. Microsoft is an informant without conciousness. Privacy in Windows is not a goal; the contrary is true. One Linux/BSD site thinks that TrueCrypt is now “dead” and there is the following statement about the software licence:

Based on the wording of its license, there was always a question mark surrounding the open source-ness of Truecrypt. But that’s not the topic of this brief article. What prompted me to write this is an article that appeared in the Washington Post suggesting that TrueCrypt may have seen its last days as an (“open source”) software project.

Just remember that TrueCrypt is not FOSS.

There is another project whose software licence was blamed for lack of participation and oversight. The OSI’s President blamed the licence. That project was OpenSSL, which is now scrambling to get some more money. The Economist makes FUD out of it while other sites take a more objective approach [4-15]. Remember this: if the project is not quite as open or free as it wants people to believe, then it might not be worth trusting. We never trusted TrueCrypt.

Related/contextual items from the news:

  1. TrueCrypt Not Dead, Forked and Relocated to Switzerland

    The development of TrueCrypt, an open source piece of software used for on-the-fly encryption, has been terminated and users have been advised not to use it because it is not secure enough. Now, it seems that another team of developers have forked the software and rebased it in Switzerland.

  2. Death (?) And Rebirth!
  3. TrueCrypt, An Open-Source Whole-Disk Encryption System, Leaves Users High And Dry
  4. Tough Love for the Encryption Software That Was Compromised by Heartbleed
  5. CII announces 2 full-time devs and a security audit for OpenSSL
  6. Heartbleed: Linux Foundation hires dynamic duo to fix OpenSSL
  7. Linux Foundation throws money at OpenSSL staffing post-Heartbleed
  8. The Linux Foundation’s Core Infrastructure Initiative Announces New Backers, First Projects to Receive Support and Advisory Board Members

    The Core Infrastructure Initiative (CII), a project hosted by The Linux Foundation that enables technology companies, industry stakeholders and esteemed developers to collaboratively identify and fund open source projects that are in need of assistance, today announced five new backers, the first projects to receive funding from the Initiative and the Advisory Board members who will help identify critical infrastructure projects most in need of support.

  9. The Linux Foundation Assigns Two Full-Time Developers to Work on OpenSSL
  10. LF Announces New Backers, Projects For Core Infrastructure
  11. Linux Foundation adds more Internet protocols to its protection list
  12. Everyone uses OpenSSL, but nobody’s willing to fix it — except the Linux Foundation
  13. Linux Foundation flings two full-time developers at OpenSSL

    The Linux Foundation’s new elite tech repair team has named its initial areas of focus as it works to find and seal holes in widely-used open source software.

    The Linux Foundation announced on Thursday that members of the “Core Infrastructure Initiative” (CII) will dedicate resources to working on the Network Time Protocol, OpenSSH, and OpenSSL to hunt down and fix flaws in the tech that helps tie the internet together.

    “All software development requires support and funding. Open source software is no exception and warrants a level of support on par with the dominant role it plays supporting today’s global information infrastructure,” said Jim Zemlin, the executive director of the Linux Foundation.

  14. Corporations put their cash where their open source security is

    OpenSSL and Open Crypto Audit Project are the first open source projects to receive funding from the Core Infrastructure Initiative.

  15. The Linux Foundation Draws Backers and Funds to Tackle Tech Problems
Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Links 17/9/2019: CentOS 7.7 and Funtoo Linux 1.4 Released

    Links for the day



  2. EPO is Not European

    Internationalists and patent trolls are those who stand to benefit from the 'globalisation' of low-quality and law-breaking patents such as patents on algorithms, nature and life itself; the EPO isn't equipped to serve its original goals anymore



  3. The EPO's Central Staff Committee and SUEPO (Staff Union) Respond to “Fascist Bills” Supported by EPO President António Campinos

    Raw material pertaining to the latest Campinos "scandal"; what Campinos said, what the Central Staff Committee (CSC) said, and what SUEPO said



  4. Storm Brewing in the European Patent Office After a Hot Summer

    Things aren't rosy in EPOnia (to say the least); in fact, things have been getting a lot worse lately, but the public wouldn't know judging by what media tells the public (almost nothing)



  5. Why I Once Called for Richard Stallman to Step Down

    Guest post from the developer who recently authored "Getting Stallman Wrong Means Getting The 21st Century Wrong"



  6. As Richard Stallman Resigns Let's Consider Why GNU/Linux Without Stallman and Torvalds Would be a Victory to Microsoft

    Stallman has been ejected after a lot of intentionally misleading press coverage; this is a dark day for Software Freedom



  7. Links 16/9/2019: GNU Linux-libre 5.3, GNU World Order 13×38, Vista 10 Breaks Itself Again

    Links for the day



  8. Links 16/9/2019: Qt Quick on Vulkan, Metal, and Direct3D; BlackWeb 1.2 Reviewed

    Links for the day



  9. Richard Stallman's Controversial Views Are Nothing New and They Distract From Bill Gates' Vastly Worse Role

    It's easier to attack Richard Stallman (RMS) using politics (than using his views on software) and media focus on Stallman's personal views on sexuality bears some resemblance to the push against Linus Torvalds, which leans largely on the false perception that he is sexist, rude and intolerant



  10. Links 16/9/2019: Linux 5.3, EasyOS Releases, Media Backlash Against RMS

    Links for the day



  11. Openwashing Report on Open Networking Foundation (ONF): When Open Source Means Collaboration Among Giant Spying Companies

    Massive telecommunications oligopolies (telecoms) are being described as ethical and responsible by means of openwashing; they even have their own front groups for that obscene mischaracterisation and ONF is one of those



  12. 'Open Source' You Cannot Run Without Renting or 'Licensing' Windows From Microsoft

    When so-called ‘open source’ programs strictly require Vista 10 (or similar) to run, how open are they really and does that not redefine the nature of Open Source while betraying everything Free/libre software stands for?



  13. All About Control: Microsoft is Not Open Source But an Open Source Censor/Spy and GitHub/LinkedIn/Skype Are Its Proprietary Censorship/Surveillance Tools

    All the big companies which Microsoft bought in recent years are proprietary software and all of the company’s big products remain proprietary software; all that “Open Source” is to Microsoft is “something to control and censor“



  14. The Sad State of GNU/Linux News Sites

    The ‘media coup’ of corporate giants (that claim to be 'friends') means that history of GNU/Linux is being distorted and lied about; it also explains prevalent lies such as "Microsoft loves Linux" and denial of GNU/Free software



  15. EPO President Along With Bristows, Managing IP and Other Team UPC Boosters Are Lobbying for Software Patents in Clear and Direct Violation of the EPC

    A calm interpretation of the latest wave of lobbying from litigation professionals, i.e. people who profit when there are lots of patent disputes and even expensive lawsuits which may be totally frivolous (for example, based upon fake patents that aren't EPC-compliant)



  16. Links 15/9/2019: Radeon ROCm 2.7.2, KDE Frameworks 5.62.0, PineTime and Bison 3.4.2

    Links for the day



  17. Illegal/Invalid Patents (IPs) Have Become the 'Norm' in Europe

    Normalisation of invalid patents (granted by the EPO in defiance of the EPC) is a serious problem, but patent law firms continue to exploit that while this whole 'patent bubble' lasts (apparently the number of applications will continue to decrease because the perceived value of European Patents diminishes)



  18. Patent Maximalists, Orbiting the European Patent Office, Work to 'Globalise' a System of Monopolies on Everything

    Monopolies on just about everything are being granted in defiance of the EPC and there are those looking to make this violation ‘unitary’, even worldwide if not just EU-wide



  19. Unitary Patent (UPC) Promotion by Team Battistelli 'Metastasising' in Private Law Firms

    The EPO's Albert Keyack (Team Battistelli) is now in Team UPC as Vice President of Kilburn & Strode LLP; he already fills the media with lies about the UPC, as one can expect



  20. Microsoft Targets GNU/Linux Advocates With Phony Charm Offensives and Fake 'Love'

    The ways Microsoft depresses GNU/Linux advocacy and discourages enthusiasm for Software Freedom is not hard to see; it's worth considering and understanding some of these tactics (mostly assimilation-centric and love-themed), which can otherwise go unnoticed



  21. Proprietary Software Giants Tell Open Source 'Communities' That Proprietary Software Giants Are 'Friends'

    The openwashing services of the so-called 'Linux' Foundation are working; companies that are inherently against Open Source are being called "Open" and some people are willing to swallow this bait (so-called 'compromise' which is actually surrender to proprietary software regimes)



  22. Microsoft Pays the Linux Foundation for Academy Software Foundation, Which the Linux Foundation is Outsourcing to Microsoft

    Microsoft has just bought some more seats and more control over Free/Open Source software; all it had to do was shell out some 'slush funds'



  23. Links 14/9/2019: SUSE CaaS Platform, Huawei Laptops With GNU/Linux

    Links for the day



  24. Links 13/9/2019: Catfish 1.4.10, GNOME Firmware 3.34.0 Release

    Links for the day



  25. Links 12/9/2019: GNU/Linux at Huawei, GNOME 3.34 Released

    Links for the day



  26. Links 12/9/2019: Manjaro 18.1 and KaOS 2019.09 Releases

    Links for the day



  27. EPO: Give Us Low-Quality Patent Applications, Patent Trolls Have Use for Those

    What good is the EPC when the EPO feels free to ignore it and nobody holds the EPO accountable for it? At the moment we're living in a post-EPC Europe where the only thing that counts is co-called 'products' (i.e. quantity, not quality).



  28. Coverage for Sponsors: What the Linux Foundation Does is Indistinguishable From Marketing Agencies' Functions

    The marketing agency that controls the name "Linux" is hardly showing any interest in technology or in journalism; it's just buying media coverage for sponsors and this is what it boils down to for the most part (at great expense)



  29. Watch Out, Linus Torvalds: Microsoft Bought Tons of Git Repositories and Now It Goes After Linux

    Microsoft reminds us how E.E.E. tactics work; Microsoft is just hijacking its competition and misleading the market (claiming the competition to be its own, having "extended" it Microsoft's way with proprietary code)



  30. Links 11/9/2019: Acer in LVFS, RawTherapee 5.7 and Qt 5.12.5 Released

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts