Truecrypt Disk - No more

[JonEp]

I searched and couldn't find this on DF.

I think the Guardian has a point in their article below this.


http://truecrypt.sourceforge.net/

WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues

This page exists only to help migrate existing data encrypted by TrueCrypt.

The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP. Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images. Such integrated support is also available on other platforms (click here for more information). You should migrate any data encrypted by TrueCrypt to encrypted disks or virtual disk images supported on your platform.



Encryption software TrueCrypt closes doors in odd circumstances

TrueCrypt has shut down its site with no warning and a bizarre statement, leaving users wondering if there is something left unsaid.


Encryption tool TrueCrypt has closed its doors, removed its downloads and advised users to switch to a competitor, citing only the end of life of Windows XP as a reason.
To fans of the app, which lets users (including the Guardian) encrypt entire hard drives to ensure security and privacy, that rationale makes no sense – and many of them are casting around for other plausible reasons why the app and its development would cease so suddenly.
"The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP," is the explanation given on the software's webpage. "Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images. Such integrated support is also available on other platforms. You should migrate any data encrypted by TrueCrypt to encrypted disks or virtual disk images supported on your platform."
But many users of TrueCrypt are, and always would be, reluctant to hand control of their security over to Microsoft. That's partially because of the belief in the cryptography community that open-source software, where the code that handles the encryption systems can be read and checked by anyone, is inherently more secure. And it's partially because of general distrust of Microsoft.
Moreover, the date of Microsoft's termination of support for Windows XP has been known for two years; it makes little sense to abruptly shut down TrueCrypt without warning, owing to an event which has been in diaries since April 2012.
Has Truecrypt shut because of a government warrant?

The TrueCrypt development team has always remained anonymous, and isn't speaking about the software's death beyond the sparse advice left on its download page – leaving users who don't believe the rationale ample room to speculate about other possibilities.
One of the more popular suggestions is that the act is a version of what's known as a "warrant canary". Warrant canaries are legal tricks employed by conscientious organisations to get around the fact that certain demands from the US government cannot be disclosed publicly. For instance, a company which has received a national security letter, commanding it to turn over user data, may not tell its users that fact.
To manage that problem, firms such as Tumblr employ "canaries". Tumblr's transparency report, issued in February 2014, says that the firm has "never received a National Security Letter". If later versions of the report do not contain that phrase, users can assume that Tumblr has received such a demand between the two reports. Disclosure without disclosing.
Some TrueCrypt users wonder if the firm is taking a similar tack. "With these events, TrueCrypt jumped very high on the suspicious software list," says klti on the Reddit thread about the shut down. "Maybe that's the whole point?" If TrueCrypt had received a demand from the security services that it didn't want to comply with, closing development and warning users away from the software entirely is certainly one way to fight back.
Better to close down before a flaw is identified?

Others question whether the development team isn't fighting back, so much as giving up. Despite the software's open codebase, the secrecy behind its team means that it's never been given a full third-party review. As the example of OpenSSL's massive Heartbleed flaw demonstrated last month, merely being open doesn't help security if no one else is checking for bugs.
The security researcher Matthew Green raised $70,000 in December 2013 to do just such a check. While the first part of the code review, an analysis of the software's bootloader, came back mostly clean in February, Green tells Krebs on Security that he's "a little worried that the fact that we were doing an audit of the crypto might have made them decide to call it quits."
In other words, maybe there's a bug in the software so great that it's easier to walk away than fix it. Why do so in such an obfuscatory fashion? Because it's better to make sure that all your users have switched to a secure alternative before you reveal a flaw that renders their security moot.
Or it may be that the developers simply wanted to quit. Leaving an unmaintained piece of security software live is a dangerous thing: flaws may be found, and never fixed. Better to warn users that the software is dead before it becomes insecure, rather than after. The one user who managed to get a reply from the coders reports that that's their stated reason:

http://www.theguardian.com/technolog...t-closes-doors