4 ms·

I have logs on my site showing many users who enter their passwords from memory regularly only to forget them months later after not using them. Since the user

by danjoc 10y ago

I have logs on my site showing many users who enter their passwords from memory regularly only to forget them months later after not using them. Since the user hasn't been made to recall the password for months, it's plausible that he forgot it. I know I have personally forgotten passwords to accounts after months of disuse. For instance, I had an old yahoo email account for many years. I didn't use it for about six months before they announced they would start re-purposing accounts that went unused for more than a year. I was unable to remember the password as well as the email account I had associated with that account for password reset. I ended up losing the account.

tptacek 10y ago
My point is just this: the notion that you have or haven't forgotten your password is something that gets argued in court, just like everything else. Tech people have a bad habit of pretending that the uncertainties that our work generates are the first uncertainties the court system has ever dealt with. But most of criminal law turns in large part --- mens rea --- over a court making decisions about what's in the head of the accused!
- nickff 10y ago
  Mens rea used to be a key part of the law, but most new legislation is now strict liability.
  - tptacek 10y ago
    I don't know whether that's true or not (it's certainly a libertarian talking point I'm familiar with), but most criminal statutes are not strict liability. This argument is besides the point, though. I'm not saying that contempt rules are OK because the underlying crimes require the state to prove mens rea. I'm saying, the court has for centuries been charged with ascertaining truths that are in some sense unknowable, because they depend on determining what someone was thinking. This isn't a new challenge for the court.
- kbenson 10y ago
  That is decided during a trial, and the decision is the outcome of the trial. The 6th amendment says "In all criminal prosecutions, the accused shall enjoy the right to a speedy and public trial", the 7th amendment says "the right of trial by jury shall be preserved", and the 5th amendment says "nor be deprived of life, liberty, or property, without due process of law". I would interpret what is happening as a de-facto trial by judge, not peers, and thus a deprivation of liberty without due process of law, which must include a trial by peers.
  - nickff 10y ago
    This is a good point, and someone should appeal this type of punishment without jury trial.
    - tptacek 10y ago
      This is a very old legal debate. It can be resolved politically by passing statutes limiting the application of contempt rules, but that seems unlikely to happen soon.
  - tptacek 10y ago
    The good news is: a judge can't hold you in contempt for relying on your Constitutional rights. So either it's going to be Constitutional for the state to demand encryption to be unlocked, or "indefinite" contempt detentions will be overturned by a superior court.
    - kbenson 10y ago
      I have no problem with the state punishing someone for failing to provide something that has been deemed lawful to solicit, but failure to comply should result in another trial of some sort (possibly after a set period, so it's not immediate and abused). Based on the bill of rights, I believe you should not be detained indefinitely without a trial for the charges you are being held for, full stop. That the offense happened during a trial, and a judge was present is irrelevant. Otherwise, the charges you are being detained for have not had a trial by peer. Not to mention, you've now been denied a speedy and public trial. You could try to make a case that you've prevented your own speedy and public trial, but until there's been a conviction on whether you need to comply, I don't see how that reasoning is sustainable.
- coldtea 10y ago
  >But most of criminal law turns in large part --- mens rea --- over a court making decisions about what's in the head of the accused! That doesn't stop all these uncertainties affecting the outcome ("and the prosecution would like to note that the accused didn't provide the password, pretending that he doesn't remember it/know it" can turn jurors against someone, even if its BS). How many people were accused and convicted with BS technical certainties (but actual scientific uncertainties) like the bogus "hair matching"?
  - tptacek 10y ago
    Of course uncertainty affects the outcome. Of course the system makes the wrong decision on occasion. It's a human institution.
    - coldtea 10y ago
      Yes, but it has grown a little too inhuman in practice in a country that's 5% of the world's population but has 25% of the world's inmates. (Plus practices like the death penalty, private prisons, abuse of solitary confinement for long periods, down to contractors overcharging 10x for prison phone calls. One would compare that with the 3rd world, not the modern Western world). If anything it needs more limitations to prosecution and uncertainties that work in favor of the state, not less.
      - tptacek 10y ago
        I agree that sentences in the US are across the board too long but am not sure what that has to do with compelled decryption of hard drives. The court system didn't make sentences too long. They were dragged there, kicking and screaming, by a polity that overwhelmingly demanded tough-on-crime statutes and tough-on-crime prosecutors, and passed laws to ensure that the courts complied.
- marssaxman 10y ago
  Most of criminal law is therefore undecidable and insane, so far as I can see, amounting to little more than a thin coat of gloss over a clumsy, ignorant, violent, and almost entirely unaccountable iron fist.
akerro 10y ago
> I have logs on my site showing many users who enter their passwords from memory regularly only to forget them months later after not using them. I just had to reset passwords to gitlab root and root on docker image after other admin went on holiday for 3 weeks and forgot both...

by danjoc 10y ago

tptacek 10y ago

My point is just this: the notion that you have or haven't forgotten your password is something that gets argued in court, just like everything else. Tech people have a bad habit of pretending that the uncertainties that our work generates are the first uncertainties the court system has ever dealt with. But most of criminal law turns in large part --- mens rea --- over a court making decisions about what's in the head of the accused!

nickff 10y ago
Mens rea used to be a key part of the law, but most new legislation is now strict liability.
- tptacek 10y ago
  I don't know whether that's true or not (it's certainly a libertarian talking point I'm familiar with), but most criminal statutes are not strict liability. This argument is besides the point, though. I'm not saying that contempt rules are OK because the underlying crimes require the state to prove mens rea. I'm saying, the court has for centuries been charged with ascertaining truths that are in some sense unknowable, because they depend on determining what someone was thinking. This isn't a new challenge for the court.
kbenson 10y ago
That is decided during a trial, and the decision is the outcome of the trial. The 6th amendment says "In all criminal prosecutions, the accused shall enjoy the right to a speedy and public trial", the 7th amendment says "the right of trial by jury shall be preserved", and the 5th amendment says "nor be deprived of life, liberty, or property, without due process of law". I would interpret what is happening as a de-facto trial by judge, not peers, and thus a deprivation of liberty without due process of law, which must include a trial by peers.
- nickff 10y ago
  This is a good point, and someone should appeal this type of punishment without jury trial.
  - tptacek 10y ago
    This is a very old legal debate. It can be resolved politically by passing statutes limiting the application of contempt rules, but that seems unlikely to happen soon.
- tptacek 10y ago
  The good news is: a judge can't hold you in contempt for relying on your Constitutional rights. So either it's going to be Constitutional for the state to demand encryption to be unlocked, or "indefinite" contempt detentions will be overturned by a superior court.
  - kbenson 10y ago
    I have no problem with the state punishing someone for failing to provide something that has been deemed lawful to solicit, but failure to comply should result in another trial of some sort (possibly after a set period, so it's not immediate and abused). Based on the bill of rights, I believe you should not be detained indefinitely without a trial for the charges you are being held for, full stop. That the offense happened during a trial, and a judge was present is irrelevant. Otherwise, the charges you are being detained for have not had a trial by peer. Not to mention, you've now been denied a speedy and public trial. You could try to make a case that you've prevented your own speedy and public trial, but until there's been a conviction on whether you need to comply, I don't see how that reasoning is sustainable.
coldtea 10y ago
>But most of criminal law turns in large part --- mens rea --- over a court making decisions about what's in the head of the accused! That doesn't stop all these uncertainties affecting the outcome ("and the prosecution would like to note that the accused didn't provide the password, pretending that he doesn't remember it/know it" can turn jurors against someone, even if its BS). How many people were accused and convicted with BS technical certainties (but actual scientific uncertainties) like the bogus "hair matching"?
- tptacek 10y ago
  Of course uncertainty affects the outcome. Of course the system makes the wrong decision on occasion. It's a human institution.
  - coldtea 10y ago
    Yes, but it has grown a little too inhuman in practice in a country that's 5% of the world's population but has 25% of the world's inmates. (Plus practices like the death penalty, private prisons, abuse of solitary confinement for long periods, down to contractors overcharging 10x for prison phone calls. One would compare that with the 3rd world, not the modern Western world). If anything it needs more limitations to prosecution and uncertainties that work in favor of the state, not less.
    - tptacek 10y ago
      I agree that sentences in the US are across the board too long but am not sure what that has to do with compelled decryption of hard drives. The court system didn't make sentences too long. They were dragged there, kicking and screaming, by a polity that overwhelmingly demanded tough-on-crime statutes and tough-on-crime prosecutors, and passed laws to ensure that the courts complied.
marssaxman 10y ago
Most of criminal law is therefore undecidable and insane, so far as I can see, amounting to little more than a thin coat of gloss over a clumsy, ignorant, violent, and almost entirely unaccountable iron fist.

akerro 10y ago

> I have logs on my site showing many users who enter their passwords from memory regularly only to forget them months later after not using them. I just had to reset passwords to gitlab root and root on docker image after other admin went on holiday for 3 weeks and forgot both...