Why a Three Letter Agency must be involved

TLA = Three Letter Agency
TPLA = Three Plus Letter Agency

* This is nothing but a hoax
* This is nothing but a defacement

If that were the case, then the authors would come out and say so.

The newly released code containing the “hoax” was signed with the authentic signing key.

So a hoax seems unlikely.

If this is a hoax or defacement, then someone went to an awful lot of work to build a new software release — and obtain the capability to sign it!

If someone had obtained the secret signing keys, then there are lot more valuable things that could be done with them than a mere hoax / defacement.

* Mabye the authors just want to retire from long work on this program

Then why not just come out and say so?

Why not pass the torch to others to continue to work?

Why use the excuse of discontinuing it because of discontinued support for Windows XP, which is so lame of an excuse as to be unbelievable. (Hint: not to be believed.)

* A security vulnerability was discovered
* The program was hacked by the NSA, Chinese, Aliens, etc
* A weakness was discovered in the encryption

If this were the case, then why wouldn’t the authors just come out and say so? The only reason would be if they were constrained from saying so by a secret order from a secret court under the authority of a secret interpretation of a secret law, or something like that.

Consider that the newly released program, authentic according to its digital signature, has the warnings embedded. So the warnings must be genuine. Yet the same release with the warnings also removes the encryption capability the retains the decryption capability. This would imply that the author’s motives are to allow you continue to decrypt previously encrypted data, and would imply that the authors believe it currently is and will continue to be secure — but that *encryption* will not continue to be secure in the future.

* Maybe the authors merely lost control of their credentials, signing key, etc.

The same arguments apply.
* Why wouldn’t authors just say so?
* Why then release a new version with warnings, and removing future encryption capability, but keeping decryption capability?

This argument would imply that the authors still care about your security but were merely hacked or lost control of their key. If the authors continue to care about your security, then why suggest switching to BitLocker which is (a) closed source, (b) cannot be analyzed for vulnerabilities or back doors, and (c) is from Microsoft.

* This situatiion is nothing like LavaBit’s poor choice of response strategy

Nobody is arguing that it is similar. I am only arguing that the authors forced to compromise *future* security, and not disclose this, had no other choice but to find a way to get people to stop using the program.

My conclusion.

The only thing that seems to fit all of the facts is that a TLA/TPLA ordered them to hand over their digital signing keys and keep this fact a secret.

* This would mean that the authors have lost control of their keys
* The authors may have been forced to suggest switching to BitLocker, also for the benefit of TLAs/TPLAs.
* The authors cannot disclose this fact
* The TLAs/TPLAs want to make new insecure releases, that are digitally signed as authentic — even if only intended for release to selected parties.
* The authors still care about your security
* The authors still control their website and can still make new software releases
* The authors are not forbidden from abandoning the project or saying that it is now insecure
* The authors know that the past security of the program is not compromised, only the future security
* Therefore authors remove encryption but retian decryption capability, and then fall on their sword to protect everyone. Similar motives to Lavabit response, but not similar in other ways.