4 ms·

This might have been suggested before, but I think it's novel enough to repeat: You should be able to create two passwords for all devices. One, your password,

This might have been suggested before, but I think it's novel enough to repeat: You should be able to create two passwords for all devices. One, your password, would allow you to use the device normally, the other, your lastword, would start a silent erasure of the device. The device could even present a fake successful authentication, like dumping you to some fake desktop, while it erases your data. While in this case it would not really benefit someone in situations like US border crossings who have almost no rights, I think it would be very effective at discouraging attempts to force people to divulge their passwords, as the person entering the lastword would effectively be informing the device that it was under attack. With something like this I would think that questioning people for their passwords would be pointless.

outworlder 10y ago
And then you get prosecuted for destruction of evidence, obstruction of justice and whatever else they can come up with. As said in other threads, the solution is not technology.
- colemannugent 10y ago
  This assumes that law enforcement actually knows you will have evidence. If the technology could remove everything that would be incriminating and leave benign data you would just be another non-techie traveler.
  - eridius 10y ago
    They don't need to know you have evidence. All they need to know is that you deliberately caused them to erase your device under the guise of unlocking it. Which means your device could have had evidence, and now you've made it impossible to prove that it didn't.
    - idbehold 10y ago
      The burden of proof is still on them, no?
      - eridius 10y ago
        IANAL, but I don't think so. They don't have to prove that the data you just wiped contained evidence of wrongdoing, they just have to prove that you wiped the data after they asked for it. That's kind of the point of "destruction of evidence". If they already knew the contents of the data, they wouldn't actually need it, now would they?
maxerickson 10y ago
There are lots of situations now where using such a duress password would be a crime. If it became commonplace, providing such a password to law enforcement would likely be criminalized. The simpler way to deal with it that doesn't involve the potential of breaking laws is to carry a travel device and straightforwardly identify it as such if asked. Or don't carry any device at all.
6t6t6t6 10y ago
With a laptop, this seems trivial: just create a second user in the system with some data (so it does not look empty). Then create a login script that deletes the data of you primary user and deletes itself. Nobody would ever realize what happened (except with forensic tools).

outworlder 10y ago

And then you get prosecuted for destruction of evidence, obstruction of justice and whatever else they can come up with. As said in other threads, the solution is not technology.

colemannugent 10y ago
This assumes that law enforcement actually knows you will have evidence. If the technology could remove everything that would be incriminating and leave benign data you would just be another non-techie traveler.
- eridius 10y ago
  They don't need to know you have evidence. All they need to know is that you deliberately caused them to erase your device under the guise of unlocking it. Which means your device could have had evidence, and now you've made it impossible to prove that it didn't.
  - idbehold 10y ago
    The burden of proof is still on them, no?
    - eridius 10y ago
      IANAL, but I don't think so. They don't have to prove that the data you just wiped contained evidence of wrongdoing, they just have to prove that you wiped the data after they asked for it. That's kind of the point of "destruction of evidence". If they already knew the contents of the data, they wouldn't actually need it, now would they?

maxerickson 10y ago

There are lots of situations now where using such a duress password would be a crime. If it became commonplace, providing such a password to law enforcement would likely be criminalized. The simpler way to deal with it that doesn't involve the potential of breaking laws is to carry a travel device and straightforwardly identify it as such if asked. Or don't carry any device at all.

6t6t6t6 10y ago

With a laptop, this seems trivial: just create a second user in the system with some data (so it does not look empty). Then create a login script that deletes the data of you primary user and deletes itself. Nobody would ever realize what happened (except with forensic tools).