1

Using TrueCrypt has been the answer to many questions on this site. It would appear TrueCrypt is no longer considered secure by its developers. They are saying to switch to BitLocker.

See these articles below:

Obviously, with new questions this can be taken into account and users can be steered clear of TrueCrypt.

My thought is of older questions that are found by Google searches. There are a lot of answers saying use TrueCrypt. Obviously, if they try to download it from SourceForge, they will see that it is deprecated. But perhaps they have downloaded it already and are using it, or perhaps users downloaded it from a different source...

I guess my question is, is it moral not to tell people to steer clear? Or comment answers on previous questions to state the fact TrueCrypt is no longer secure?

2
  • 11
    Given that anyone trying to download Truecrypt will see the site page which states in no uncertain terms that it is to be considered unsafe I do not really see any point in spending any serious amount of time going through old questions and making everyone aware of the risks. At the moment we don't even know if there are any risks in the first place. Sure it's worth mentioning on new questions, but at the moment we don't have any real information on what's going on.
    – Mokubai Mod
    May 29, 2014 at 17:10
  • 4
    Its too early in the morning to do it myself but maybe reflect the this in the tag wiki?
    – Journeyman Geek Mod
    May 29, 2014 at 23:04

2 Answers 2

5

The current panic over TrueCrypt is overreaction.

The statement that “TrueCrypt is no longer secure” is strongly misleading. TrueCrypt did not magically become insecure overnight. Either it was insecure before, and this has just been announced publicly, or it wasn't insecure before.

What has changed is that the manner in which the TrueCrypt project stopped casts some suspicion that TrueCrypt was insecure in the first place. However, without knowing in what way it is insecure (assuming that it is), it is impossible to know for sure what to do about it. Is there a fundamental problem such as the key being hidden in randomized parts of the disk? Or is it only some specialized feature that hardly anybody uses that is vulnerable?

What has also changed is that TrueCrypt is no longer maintained, meaning that if new security issues are found, they will not be fixed. This alone is a reason not to use a software package. However, given that TrueCrypt was pretty popular, there's a good chance that someone will take over the maintenance.

I recommend doing nothing over the next few weeks, and see how things evolve. If it looks like there is an emerging successor, gradually edit posts to switch to that successor. If TrueCrypt seems headed for abandon, comment on posts (constructively, by preference — recommend something reasonable instead). If a major vulnerability is discovered, edit posts that would make people susceptible to that vulnerability.

Note that I do not say that as a TrueCrypt enthusiast. Indeed, I do not recommend using TrueCrypt in most cases — most people should their OS's native mechanism instead (Bitlocket, FileVault, Dm-crypt/eCryptfs). But there's a difference between not being a fan and going on a crusade (I don't go commenting against Windows on every post that uses it, after all).

3
  • I am not sure I agree with doing nothing. If Truecrypt is a mission critical solution one really should look into alternatives. Its also Bitlocker not Bitlocket :-)
    – Ramhound
    Jun 2, 2014 at 13:41
  • I think the furore is actually misplaced rather than wrong as such. TrueCrypt development stopped a while ago and there is no equivalent replacement. Bitlocker CERTAINLY isn't a replacement, not only is it not available to all, it only has a small subset of TC's features. Jun 6, 2014 at 14:45
  • I'm afraid the comment to use native features is entirely wrong. TC is cross-platform allowing a single, synchronised file to act as a virtual secure drive on several different platforms. This is not possible with any other free tool in active development. Jun 6, 2014 at 14:47
3

On the issue of the security of TrueCrypt, an announcement stating that the software is not secure does not itself make the software insecure. While I certainly can't be 100% sure, I don't presently see any reason to believe TrueCrypt has any major vulnerabilities (other than unavoidable side-channel attacks which have nothing to do with the software) which would enable an attacker (without physical access to the hardware) to gain access to data in encrypted volumes by some means other than brute-forcing the encryption itself.

While I personally no longer use TrueCrypt—I switched to BitLocker when I got my new Windows 8.1 Pro system—I see no reason to edit existing answers to reflect the claim that the software is not secure. I would suggest that the tag wiki be edited to mention the controversy:

Note: TrueCrypt has been discontinued and is claimed to be insecure by its developers because of its recent lack of updates. However, a security audit of the encryption software is in progress and there are currently no major known vulnerabilities, though this may change as the audit progresses. For more information about this issue, see this TechRepublic article.

1
  • 2
    Might be easier to place that warning in the tag description itself. This way if the situation changes the description can be changed. I suggest everyone leave out any speculation in any warning, stick to the facts, Truecrypt won't be updated and any known or unknown vulerabities will not be fixed. Besides people are already thinking about forking the project in some capacity.
    – Ramhound
    Jun 3, 2014 at 12:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .