TrueCrypt
Latest
TrueCrypt Windows encryption app has critical security flaws
If you're still using TrueCrypt to protect your Windows disks, even though its developers abandoned it and said it was "not secure" last year, you may want to stop that. Google Project Zero researcher James Forshaw found two "privilege elevation" holes in the popular software that would give attackers full access to your data. Worse yet, TrueCrypt was audited earlier this by a crowdfunded team of iSec security researchers and found to be error-free. Google's James Forshaw said on Twitter that the miss was understandable, though: "iSec phase 1 audit reviewed this specific code but Windows drivers are complex beasts (and) easy to miss."
TrueCrypt development stopped amid a cloud of mystery
Last Wednesday the SourceForge page for popular open-source disk encryption software TrueCrypt started recommending the use of BitLocker on Windows instead. Visitors were told that the application was "not secure" anymore. Of course, social networks exploded with speculation, with people claiming the page was hacked or that the government, using a National Security Letter, might be requesting "changes" on the software. The truth is much more mundane: a developer of TrueCrypt confirmed to Reuters that it had been shut down out of boredom. Security researcher Steve Gibson said that after 10 years of work, the developers simply got tired of the project.
Court upholds Fifth Amendment, prevents forced decryption of data
When our forefathers were amending the constitution for the fifth time, they probably didn't have TrueCrypt-locked hard drives in mind. However, a ruling from the 11th Circuit Appeals Court has upheld the right of an anonymous testifier to not forcibly decrypt their data. The case relates to a Jon Doe giving evidence in exchange for immunity. The protection afforded to them under this case wouldn't extend to any other incriminating data that might be found, and as such Doe felt this could lead to violation of the fifth amendment. The validity of the prosecution's demands for the data decryption lies in what they already know, and how they knew it -- to prevent acting on hopeful hunches. The prosecutors were unable to demonstrate any knowledge of the data in question, leading the 11th Circuit to deem the request unlawful, adding that the immunity should have extended beyond just the current case. This isn't the first time we've seen this part of the constitution under the digital spotlight, and we're betting it won't be the last, either.
Ask TUAW: Syncing iCal, Mouse Keys, encrypted flash drives and more
This time in Ask TUAW we're tackling questions about syncing iCal between two Macs, using an encrypted flash drive in a cross-platform environment, changing default applications, using the keyboard instead of the mouse, and more.As always, your suggestions are welcome. Questions for next week should be left in the comments. When asking a question please include which machine you're running and which version of Mac OS X (we'll assume you're running Leopard on an Intel Mac if you don't specify). And now, on to the questions!
TrueCrypt released for OS X
A new OS X version of the well-known open-source disk encryption software TrueCrypt has been released. Basically, TrueCrypt creates a virtual encrypted disk that mounts in the Finder and which provides on-the-fly 256-bit encryption. This virtual disk can reside on your hard drive or a flash drive and can even be hidden. The new version relies on MacFUSE to bring its magic to the fairer platform.Unfortunately, the interface is not terribly Mac-like, through this is probably not surprising given its roots. Each virtual disk has to be created and mounted through the TrueCrypt application. Nonetheless, once mounted you can interact with the virtual disk like any other volume mounted in the Finder.TrueCrypt is a free download from sourceforge.Thanks to everyone who sent this in!
