Hacker News new | ask | show | jobs
by ryanlol 4078 days ago
Why would you recommend TrueCrypt? That's a terrible suggestion.
4 comments

A lot of people seem who recommend TC seem to think the same about BitLocker. To be fair, TrueCrypt has been audited and the code is freely available; BitLocker is proprietary, and the code is only available to a select few under NDA.
TCs developers told you to stop using it, BitLocker's didn't. Even the people responsible for the audit recommend that people not use TC
As always, one must consider their own threat model and make an informed decision. I personally would use BitLocker over TrueCrypt, but LUKS over BitLocker.
I wouldn't consider TrueCrypt's license to be the best example of "freely available".
In this context, what's important is source-code availability to the general public. A program which has publicly-available source code but is released under a nonfree (or at least potentially nonfree) license is leaps and bounds better than one which doesn't even provide the source code.

Yeah, software freedom is a very good thing, but - in the context of security - it's the source code availability that matters, and that doesn't necessarily require a FOSS license.

Besides the knee-jerk reaction, it all depends on what you're defending against. If the NSA went around opening Truecrypt containers for every criminal case, their cover would be blown. So if you're keeping stuff from the local PD or thieves breaking into your house, even a supposedly backdoored app is better than cleartext.

That said, TC has been audited by what I hear is a reputable group of people, who say there's no evidence of severe crypto vulnerabilities.

You're missing the bigger issues related to TC, for example the fact that it doesn't even run on new windows versions (and never will)...
Thanks for the insightful comment explaining why.
Why?
I don't know the full story, but word 'round the campfire is that it's been compromised by a certain TLA.

In any case, there's huge red letters saying "TrueCrypt is not secure" right next to their download links: http://truecrypt.sourceforge.net/

http://istruecryptauditedyet.com/

> The TL;DR is that based on this audit, Truecrypt appears to be a relatively well-designed piece of crypto software. The NCC audit found no evidence of deliberate backdoors, or any severe design flaws that will make the software insecure in most instances. Your argument is just so wrong :/

Are you seriously implying that there's never any security issues discovered after audits?