Bonum Certa Men Certa

TrueCrypt Too Proprietary to be Secure and Corporate Media Should Stop Blaming Free/Open Source Software (FOSS)

TrueCrypt was never worth trusting in the first place

Telecommunication



Summary: Analysis of the whole TrueCrypt fiasco and response to the blaming of FOSS (where the licences are clearly not FOSS)

PROPRIETARY software should be assumed insecure by design, as it often contains back doors and one simply cannot prove otherwise. Based on experience alone, a lot of proprietary software comes with back doors, sometimes accidentally but not always. A lot has been written about this before, both here and elsewhere, so we are not going to write so much on this subject. Instead we wish to focus on the news that TrueCrypt development is moving to Switzerland (the first article we found about this is [1] and there is also some analysis [2]). The PATRIOT Act comes to mind and also the experiences of secure mail services in the United States, including Edward Snowden's E-mail provider. When Groklaw shut down, citing concerns over NSA spying, it recommended that people adopt Kolab, which is based in Switzerland. It should be emphasised that Switzerland harbours privacy not because of humanitarian interests but because of national interests. For domestic prosperity it facilitates international crime (tax evasion from all nations) and wishes to guard the criminals.



The problems with TrueCrypt are not new to us; I very much predicted what the news insinuates and I had received flack for saying so. TrueCrypt has been thoroughly and even successfully openwashed based on some odd kind of marketing angle; those close to the project know better how it works and if an audit which is not transparent is needed for TrueCrypt, then we should quickly realise that the build process and some components are wrapped in a riddle/mystery. The very core of the problem, including its build process, are very crucial. The announcement from TrueCrypt was as vague -- not transparent -- as the project itself.

Now it is widely known that TrueCrypt gave an illusion of privacy, which is in many ways worse than having no privacy at all because there is impact on users' behaviour. We may never know how many people have gone to jail or were killed because of TrueCrypt's false promise.

FOSS-hostile sites try to spin that as an issue with FOSS even though it's not FOSS. One source states: "The abrupt announcement that the widely used, anonymously authored disk-encryption tool Truecrypt is insecure and will no longer be maintained shocked the crypto world--after all, this was the tool Edward Snowden himself lectured on at a Cryptoparty in Hawai'i."

Snowden uses Debian GNU/Linux (Tails) and the main reporter he worked with, Glenn Greenwald, only recently dumped Microsoft Windows and moved to GNU/Linux.

There has been a lot more coverage about it [1, 2], including the usual scaremongering by Mr. Goodin, who wrote about it not once but twice, saying: "One of the official webpages for the widely used TrueCrypt encryption program says that development has abruptly ended and warns users of the decade-old tool that it isn't safe to use."

Goodin's colleague wrote about it as well. They are really milking this cow and the best known CIA-linked news site asked: "Is this the end of popular encryption tool TrueCrypt?"

The plutocrats' press, Forbes, called it "Open Source" (in the headline), so it can't even get its basic facts right:

Over the past 24 hours the website for TrueCrypt (a very widely used encryption solution) was updated with a rather unusually styled message stating that TrueCrypt is “considered harmful” and should not be used. If you have not come across TrueCrypt and why it has become so popular see the below section ‘why do people use TrueCrypt’.


Better coverage came from the expected sources, not playing to the tune of FOSS smears (TrueCrypt is proprietary).

Knowing that Microsoft is an NSA partner, Gordon in our IRC channels felt baffled because TrueCrypt is "now recommending bitlocker for windows", to which Ryan replied: "Proprietary encryption from Microsoft that was designed in partnership with the NSA..."

Microsoft is talking to British police about encryption. When I wrote about this nearly a decade ago Microsoft staff were using personal insults against me, only later (much later) to realise that I was right. Sean Michael Kerner calls TrueCrypt "Open-Source" (with a dash) when he writes: "The other challenge facing TrueCrypt is the simple fact that there are many other disk-encryption technologies now available. On Microsoft's Windows operating system in particular, which was a key target platform for TrueCrypt, versions of Windows after Windows XP include support for Bitlocker, which performs a similar function. In addition, there are multiple file-encryption technologies available, including, FileVault for Mac, DiskCryptor for Windows and Luks for Linux."

Proprietary operating systems are not compatible with encryption for the same reason that proprietary hypervisors are not. If the NSA can infiltrate the lower layer (e.g. VM host, OS, BIOS) through back doors, then the rest (what's above) is almost automatically compromised. No sane developer would recommend anything that's proprietary for security and privacy. Don't forget Microsoft's COFEE and CIPAV. Microsoft is very much in bed with spooks and police. Microsoft is an informant without conciousness. Privacy in Windows is not a goal; the contrary is true. One Linux/BSD site thinks that TrueCrypt is now "dead" and there is the following statement about the software licence:

Based on the wording of its license, there was always a question mark surrounding the open source-ness of Truecrypt. But that’s not the topic of this brief article. What prompted me to write this is an article that appeared in the Washington Post suggesting that TrueCrypt may have seen its last days as an (“open source”) software project.


Just remember that TrueCrypt is not FOSS.

There is another project whose software licence was blamed for lack of participation and oversight. The OSI's President blamed the licence. That project was OpenSSL, which is now scrambling to get some more money. The Economist makes FUD out of it while other sites take a more objective approach [4-15]. Remember this: if the project is not quite as open or free as it wants people to believe, then it might not be worth trusting. We never trusted TrueCrypt.

Related/contextual items from the news:


  1. TrueCrypt Not Dead, Forked and Relocated to Switzerland
    The development of TrueCrypt, an open source piece of software used for on-the-fly encryption, has been terminated and users have been advised not to use it because it is not secure enough. Now, it seems that another team of developers have forked the software and rebased it in Switzerland.


  2. Death (?) And Rebirth!


  3. TrueCrypt, An Open-Source Whole-Disk Encryption System, Leaves Users High And Dry


  4. Tough Love for the Encryption Software That Was Compromised by Heartbleed


  5. CII announces 2 full-time devs and a security audit for OpenSSL


  6. Heartbleed: Linux Foundation hires dynamic duo to fix OpenSSL


  7. Linux Foundation throws money at OpenSSL staffing post-Heartbleed


  8. The Linux Foundation’s Core Infrastructure Initiative Announces New Backers, First Projects to Receive Support and Advisory Board Members
    The Core Infrastructure Initiative (CII), a project hosted by The Linux Foundation that enables technology companies, industry stakeholders and esteemed developers to collaboratively identify and fund open source projects that are in need of assistance, today announced five new backers, the first projects to receive funding from the Initiative and the Advisory Board members who will help identify critical infrastructure projects most in need of support.


  9. The Linux Foundation Assigns Two Full-Time Developers to Work on OpenSSL


  10. LF Announces New Backers, Projects For Core Infrastructure


  11. Linux Foundation adds more Internet protocols to its protection list


  12. Everyone uses OpenSSL, but nobody’s willing to fix it — except the Linux Foundation


  13. Linux Foundation flings two full-time developers at OpenSSL
    The Linux Foundation's new elite tech repair team has named its initial areas of focus as it works to find and seal holes in widely-used open source software.

    The Linux Foundation announced on Thursday that members of the "Core Infrastructure Initiative" (CII) will dedicate resources to working on the Network Time Protocol, OpenSSH, and OpenSSL to hunt down and fix flaws in the tech that helps tie the internet together.

    "All software development requires support and funding. Open source software is no exception and warrants a level of support on par with the dominant role it plays supporting today's global information infrastructure," said Jim Zemlin, the executive director of the Linux Foundation.


  14. Corporations put their cash where their open source security is
    OpenSSL and Open Crypto Audit Project are the first open source projects to receive funding from the Core Infrastructure Initiative.


  15. The Linux Foundation Draws Backers and Funds to Tackle Tech Problems


Recent Techrights' Posts

Traf-O-Data, the Company That Jeffrey Epstein's BFF (Bill Gates) (Co)Founded 53 Years and Went Out of Business Due to Heavy Losses
Who will die first, Bill or Microsoft?
A Note on SimilarWeb
Or why SimilarWeb is meaningless for more than 99% of the sites on the Web
IBM Said to be Shutting Down Offices or Sites in the United States
the press can no longer avoid admitting that IBM moves many jobs to India
LLM Slop as Attack Vector on the Reputation of Linux
The attacks on Linux have escalated to information warfare
 
Techrights Has Dealt With More Potent SLAPPs Than Violent Microsofters Begging to Hide What They Did to Women
I became accustomed to SLAPPs
Links 04/04/2025: Fury in South Korea, Flight MH370 Remains Mystery
Links for the day
Gemini Links 04/04/2025: Anger and Raspberry Pi CM4
Links for the day
Links 04/04/2025: LLM Slop Bubble Bursting and Korea Music Copyright Association Bans Slop 'Music'
Links for the day
Why Microsoft's Shares Sank Almost 20% in Recent Months (the Bubble is Imploding)
verified press reports from the past 24 hours
GNU/Linux Rises to Almost 5% in Algeria While Windows Sinks to All-Time Low
GNU/Linux grew tenfold
Where to Get More Gags
A valued reader recommended that to us
Links 04/04/2025: Tech Stock (Inc. GAFAM) Fall, Google Pretends to Do End-to-End Encrypted Emails (With Google in Control)
Links for the day
To Participate in Fedora Diversity You Must Use Proprietary Software
Not for the first time either
Yandex About to Be Three Times Bigger Than Microsoft (Bing) in Asia
That's about 60% of the world's population
Gemini Links 04/04/2025: Decoupling Updates, Elaho as Gemini Client
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, April 03, 2025
IRC logs for Thursday, April 03, 2025
Microsoft's Trouble in Africa and Asia
A new all-time high for GNU/Linux
Brett Wilson LLP Reported to the Solicitors Regulation Authority (SRA)
The saddest thing in all this is that law firms can maintain high standards shall they wish to
Links 03/04/2025: Tariff Pains and C.D.C. Cuts
Links for the day
StatCounter: Microsoft is Masking a Disaster, It's Way Behind DeepSeek Already and Interest in LLMs Has Waned
it turns out the money "raised" for "Open" "AI" may not even exist at all
Links 03/04/2025: SoftBank Money for Microsoft "Open" "AI" Probably Doesn't Even Exist, Wikimedia Foundation Blasts LLM Nuisance While Microsoft Admits Demand Has Shrunk
Links for the day
Gemini Links 03/04/2025: Patch Panel and Pictures
Links for the day
Islamic Republic of Iran: GNU/Linux at All-time High This Month, Windows Falls to 12%
Vista 10 is up this month despite being "end of life" (EoL) soon
Indonesia: All-Time Highs for GNU/Linux
What's noteworthy right now is the growth of GNU/Linux
statCounter Says GNU/Linux Usage is Up Again (Internationally)
some preliminary April data
Only on April 1st Can the Free Software Foundation Associate With Microsoft's Open Source Initiative (OSI)
We saw some pranks that day linking the FSF to Microsoft (e.g. "endorsing" Windows)
Confirmed in the Mainstream Media: A Lot of Microsoft "Workloads" Were Just LLM Slop (Helping to Fake Growth for Years, as Microsoft Had Paid "Open" "AI" to Become a "Client") and Demand is Rapidly Waning, Datacentres Canceled and/or Shut Down
Anything to facilitate further accounting fraud
Taiwan's Media Covers Closure of Microsoft's "AI" Lab, It's Time to Talk About the Gradual Death of Windows and Implosion of the "AI" Bubble
Earlier this week we showed that mostly Asian media had the 'nerve' to mention Microsoft silently shutting down its 'AI' lab
IBM Gets Rid of Kelly Chambliss as Mass Layoffs Reported in IBM Consulting, IBM Loses Key Contracts/Graft
IBM Consulting has been in disarray lately
More Gains for GNU/Linux, Based on Web Surveys
the Steam site shows rapid growth for "Linux" this month
Slopwatch: Anti-Linux Articles, Not Even Written by Humans
Why aren't Web sites more vocal about this problem?
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, April 02, 2025
IRC logs for Wednesday, April 02, 2025
Links 03/04/2025: Apple Fined Over Secret Surveillance, "Elegant Writer For A More Civilized Age"
Links for the day
Gemini Links 02/04/2025: Books and Cold Tea
Links for the day
Links 02/04/2025: More Layoffs, Nokia Again Takes Advantage of Illegal and Unconstitutional Patent Court With Nokia Staff as 'Judges'
Links for the day
Links 02/04/2025: Seizures and Returns to Windows of 24 Years Ago
Links for the day
LLM Slop Helps Obscure and Distort News About Layoffs (IBM, GAFAM)
It's hard to find accurate information
Links 02/04/2025: Microsoft Developers Are Threatening to Go on Strike, World Backup Day Noted
Links for the day
Gemini Protocol Has Growing Appeal (the Web Got Too Bloated and Full of LLM Slop)
For any "data plan" with bandwidth limits or "tiers" it would be cheaper to use/browse Geminispace
The Web Can Survive LLM Slop, But Only If We Collectively Shun and Discourage Serial Sloppers
Doing nothing ought not be a possibility
Amid Secret Shut-downs and Mass Layoffs at Microsoft (4 Waves of Layoffs in 3 Months of 2025) Some Microsoft Staff Expected to Go On Strike
workers going on strike
Gemini Links 02/04/2025: No more on Mastodon and Gemini Mention Script in Go
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, April 01, 2025
IRC logs for Tuesday, April 01, 2025
My Motion Disbarring or “Striking Off” Brett Wilson LLP for Enabling Violent Americans Who Try to Crush Microsoft Critics in the United Kingdom by Multiple SLAPPs
"Guns for hire" (for Microsoft people who received Microsoft salaries)
The U.S. Patent and Trademark Office Hijacked Again by Patent Litigation Industry, as President Cheeto Prioritises Aggressors
The "mafia" has taken over the "industry" and the Federal system (justice and constitutions trampled upon)
Ubuntu Slop and FUD Manufactured With LLMs and Funded (by Oneself) 'Studies'
Slop and FUD are ruining the Web