Why does TrueCrypt need require incoming connections?

Question

I use TrueCrypt on OSX and get firewall popups asking whether to allow incoming connections by TrueCrypt.app. I can't fathom a reason why such an application would need this.

Can anyone explain?

Answer 1

I couldn't find any documentation that suggested TrueCrypt ever uses networking, unless you're mounting on a network drive or require files stored elsewhere on a network (e.g.: keyfile). It doesn't even have an auto-update.

According to a site-specific Google search, no page in TrueCrypt specifically refers to an internet connection, and the only two that referred to a network connection are the Sharing Over Network FAQ page and the TPM Attack FAQ item.

If it's neither of these cases and you can't see why TrueCrypt's involved in network activity, I would act with extreme suspicion and at the very least block the traffic.

If you've got any knowledge of network packets, you could always take a peek with Wireshark to see what's going on exactly.

Edit:

Okay based on your comments the situation's clear and not dangerous. You have network drives and the Firewall message opens up when the Open dialogue appears: coincidences and computers don't go well together. Here's what happens.

1. You want to open an image so you click browse.
2. TrueCrypt launches the system default Open dialogue so you can find your file.
3. The system default Open dialogue requires some basic information to function, such as an overview of your drives.
4. Some of your drives are network drives, therefore to get basic information on them, a program must access the network.
5. TrueCrypt owns the Open dialogue requesting network access to get basic information on your network drives, therefore TrueCrypt is the program trying to access the network.
6. Firewall pops up because TrueCrypt requires information about your network drives.

Pretty harmless. Allow the traffic if you want it to see your network drives; disallow if you don't and either way it probably doesn't matter or affect anything unless your image file is on the network - in which case being unable to see its drive will make it pretty hard to locate!