TrueCrypt no longer secure

Question

Using TrueCrypt has been the answer to many questions on this site. It would appear TrueCrypt is no longer considered secure by its developers. They are saying to switch to BitLocker.

See these articles below:

• http://truecrypt.sourceforge.net/

• http://arstechnica.com/security/2014/05/truecrypt-is-not-secure-official-sourceforge-page-abruptly-warns/#p3

Obviously, with new questions this can be taken into account and users can be steered clear of TrueCrypt.

My thought is of older questions that are found by Google searches. There are a lot of answers saying use TrueCrypt. Obviously, if they try to download it from SourceForge, they will see that it is deprecated. But perhaps they have downloaded it already and are using it, or perhaps users downloaded it from a different source...

I guess my question is, is it moral not to tell people to steer clear? Or comment answers on previous questions to state the fact TrueCrypt is no longer secure?

Answer 1

The current panic over TrueCrypt is overreaction.

The statement that “TrueCrypt is no longer secure” is strongly misleading. TrueCrypt did not magically become insecure overnight. Either it was insecure before, and this has just been announced publicly, or it wasn't insecure before.

What has changed is that the manner in which the TrueCrypt project stopped casts some suspicion that TrueCrypt was insecure in the first place. However, without knowing in what way it is insecure (assuming that it is), it is impossible to know for sure what to do about it. Is there a fundamental problem such as the key being hidden in randomized parts of the disk? Or is it only some specialized feature that hardly anybody uses that is vulnerable?

What has also changed is that TrueCrypt is no longer maintained, meaning that if new security issues are found, they will not be fixed. This alone is a reason not to use a software package. However, given that TrueCrypt was pretty popular, there's a good chance that someone will take over the maintenance.

I recommend doing nothing over the next few weeks, and see how things evolve. If it looks like there is an emerging successor, gradually edit posts to switch to that successor. If TrueCrypt seems headed for abandon, comment on posts (constructively, by preference — recommend something reasonable instead). If a major vulnerability is discovered, edit posts that would make people susceptible to that vulnerability.

Note that I do not say that as a TrueCrypt enthusiast. Indeed, I do not recommend using TrueCrypt in most cases — most people should their OS's native mechanism instead (Bitlocket, FileVault, Dm-crypt/eCryptfs). But there's a difference between not being a fan and going on a crusade (I don't go commenting against Windows on every post that uses it, after all).

Answer 2

On the issue of the security of TrueCrypt, an announcement stating that the software is not secure does not itself make the software insecure. While I certainly can't be 100% sure, I don't presently see any reason to believe TrueCrypt has any major vulnerabilities (other than unavoidable side-channel attacks which have nothing to do with the software) which would enable an attacker (without physical access to the hardware) to gain access to data in encrypted volumes by some means other than brute-forcing the encryption itself.

While I personally no longer use TrueCrypt—I switched to BitLocker when I got my new Windows 8.1 Pro system—I see no reason to edit existing answers to reflect the claim that the software is not secure. I would suggest that the truecrypt tag wiki be edited to mention the controversy:

Note: TrueCrypt has been discontinued and is claimed to be insecure by its developers because of its recent lack of updates. However, a security audit of the encryption software is in progress and there are currently no major known vulnerabilities, though this may change as the audit progresses. For more information about this issue, see this TechRepublic article.