Slashdot Mirror
TrueCrypt 6.0 Released
ruphus13 writes "While most of the US was celebrating Independence Day, the true fellow geeks over at TrueCrypt released version 6.0 of TrueCrypt over the long weekend. The new version touts two major upgrades. 'First, TrueCrypt now performs parallel encryption and decryption operations on multi-core systems, giving you a phenomenal speedup if you have more than one processor available. Second, it now has the ability to hide an entire operating system, so even if you're forced to reveal your pre-boot password to an adversary, you can give them one that boots into a plausible decoy operating system, with your hidden operating system remaining completely undetectable.' The software has been released under the 'TrueCrypt License,' which is not OSI approved."
Well, I hope that it now supports more filesystems, because mucking about with FAT on MacOS X didn't appeal to me last time.
Every experiment which ends in a big bang is a good experiment.
The issue is described in full here:
Full release notes can be found here.
All this crypto stuff only works well if it's part of the default install and config.
Otherwise users get exposed to "rubberhose cryptography".
Basically if all users even Joe Sixpack get an encrypted partition by default, then people using crypto will be safe - they have plausible deniability.
It's sad. I often travel between the US and China on business ( I live on the China side ). I've always been careful with sensitive data, but now I'm absolutely fascist. Why? I have no fear of the Chinese government. Besides, I work for a Chinese company. I fear my own country illegally accessing files to which they have absolutely no rights whatsoever.
Honestly. If someone works for the US government, pulls some CEO's laptop at the boarder for "inspection" and gets free access to all the company financials, would they do the right thing? How many semi-intelligent people wouldn't be tempted to start buying stock options or call their best friend with a really good "tip"? Even if they SEC investigated, they would never find the link.
Over the last several years, I've always been treated very respectfully inside China and going to and from. It is in the US, my own country, where I'm treated as if I'm already guilty.
Back to the topic at hand. TrueCrypt is a wonderful product. Everyone should be using it.
While most of the US was celebrating Independence Day, the true fellow geeks over at TrueCrypt released version 6.0 of TrueCrypt over the long weekend.
That might not be just a coincidence.
.sig: No such file or directory
You know, if law enforcement "fucked up your volume" as you so nicely put it, they have just destroyed whatever evidence you where trying to hide. So why would anyone using true crypt have a problem with that?
AFAIK, yes, if you fill the decoy volume it will kill your hidden volume.
which makes you wonder how long it'll be until a tool is developed for law enforcement specifically designed to fuck up these volumes.
They can only do that if they've confiscated your laptop *and* acquired your 'decoy' password. At that point, your only concerns are they not getting your data and you being able to deny the data is there in the first place.
Somebody deleting all your sensitive files is not a bad thing to happen at that point.
True, a lot of comments here refer to hypothetical situations using over-generalized terminology. But worrying about being forced to give out your password is indeed a legitimate concern.
ebonum describes one example in his "Sad" comment, although his specific concerns probably don't apply to very many of us. A more likely example, however, is if you become the target of a civil suit or a suspect in a criminal case; if (in the US) your computer equipment is seized by law enforcement and they ask for your encryption password, you could face additional criminal charges if you don't give it to them. Now, suppose that you're innocent, or don't feel like rolling over for a tort claim made with malicious intent. Do you really want to hand over all your private data to some cop or investigator who has no business accessing it? It's not as unlikely as you may think.
So yeah, "adversary" is probably a bad word choice, and those who made references to waterboarding are probably fair targets for sarcasm, but the geeks out there are putting together solutions to meet the valid and reasonable needs of the community.
I have started using TrueCrypt a few months back after my laptop got stolen. I keep two encrypted files on my laptop, one contains my personal stuff like passport scan, bank information etc. and the other the work related important documents such as internal&confidential documents, client information etc. I have buried those files in the system folder and given them name that could pass for system temp files.
I keep a copy of both on a USB key drive and on an external hard drive which never leave my home. As well as a non-encrypted copy because I'm still wondering what happens to that encrypted file if I happen to have a fucked up cluster on the drive at some point.
The rational for using encryption is not that I am afraid of the local authorities, there is nothing on my computer that would cause me any long lasting trouble, despite the fact that I live and work in a limited freedom area (Middle East), but simply to avoid opportunity theft.
For example I can't recall how many time one of my clients or partner handed me a usb key drive containing all his companies financial statement, bank account number, internal price list with profit margin, internal memo, personal info and the wifey's naked picture so that I could copy them a few documents and then forgot about the keydrive because we kept chatting.
Sometime I too need to get some files from them and I don't want to look like I'm watching them while they dig around my keydrive. I now know that everything a casual observer should not see is encrypted so I don't mind throwing my key drive over the table to someone I don't know.
I don't understand the paranoid people here who believes in plausible deniability, decoy drive and other such thing. I also wonder if the same people only use their computers in safe room with controlled EM environment and bullet proof shade.
I didn't know either that so many people carried state secrets around international airports. To those I will say that if the NSA/FSB/Interpol/MI4/Mossad/Mafia or even the local police wants the content of your drive they will get it. period. It doesn't matter what you do. Unless of course you also work for one of the aforementioned in which case you might have been trained to accept that your life is worth less than the content of said drive.
I have never been subjected to physical or psychological torture (aside from clients and some ex-gf of course) but I am not Jack Bauer and I would "come clean" very quickly. I would give the real password, not the decoy, because I believe consequences would certainly worsen my situation if my interrogators were not convinced.
I am also pretty sure that the simple sentence: "The accused has so far always refused to give his encrypted drive password." would certainly help convincing a jury beyond "reasonable doubt" (In countries where such thing even exists).
Some people here should start to seriously look at themselves and wonder if what they are trying to hide is really worth it or if it's just about mommy not finding their downloadable girlfriend picture collection.
I'm not very geeky, but I can use this program. The instructions, which are 117 pages, are pretty straightforward. With hackers (they type I don't respect) becoming more sophisticated by the day, it's nice to know it will take them many years to break my financial information. If they have that type of time, they're probably behind bars.
If you have to worry about it being torture-proof, you're almost certainly dead anyway.
All it needs to be, for most people, is audit-proof.
And for that you need a business case for having it. Porn is probably not a good choice.
No one seems to be commenting about the new features of this release but simply on TrueCrypt in general. Am I the only one excited about the multi-core/processor support? Finally a piece of systems level software that scales with the number of cores! Makes getting a multi-core processor all the more worthwhile.
Dear paranoid freaks,
if you are so concerned about getting captured and tortured for normal/hidden/hidden(hidden)/hidden(hidden(hidden)))/ad naseum passphrases, then quit having digital copies of your stuff in the first place.
99% of the TrueCrypt userbase is just fine using it on jump drives to keep stuff secure from the guy who finds it when you lose it on the train/plane/whatever.
Quit making up impossible "movie scenarios" (there, I used a Schneierism, you HAVE to respect me now!) about how gov't agents are going to come in black helicopters for your fetish vids and the 200 page backstory you wrote for a character you rolled in middle school. No one cares.
Yours truly,
-Reality.
In Soviet Russia jokes are formulaic and decidedly non-humorous.
Not a replacement cipher - Caesar cipher with a shift of 13.
Since I didn't understand anything you just said, and I'm a C# Programmer who has Ubuntu installed on a few machines, I highly doubt the $10/hour lunk at the airport is going to notice...
Peter predicted that you would "deliberately forget" creation 2000 years ago...