6 ms·

Just thought of a feature idea for TrueCrypt and other similar packages: encrypted files or partitions can have multiple passwords, which reveal different thing

Just thought of a feature idea for TrueCrypt and other similar packages: encrypted files or partitions can have multiple passwords, which reveal different things. So you could have a password that reveals something embarrassing but not incriminating. If the police or border nazis threaten you with prosecution unless you reveal your password, you give them this one. Meanwhile, you hide anything really confidential behind a password that you never give out. Or maybe they already have this?

tynan 16y ago
They already have this, It's called plausible deniability. What are the laws in the US on this?
- pilom 16y ago
  In the US the current rules for personal hard drives are bound by the 5th amendment which has been interpreted as "a reasonable expectation for privacy." What happens is the police say "Give us your password and we'll drop whatever sentence by 75% for helping the investigation." You don't have to give your password but the NSA works pretty extensively with law enforcement and the FBI (most US cases that require password cracks are federal cases but thats a separate issue). Anything that ever touches an ISP is a totally separate issue though. In that case, in the US, any information stored by an ISP can be retrieved without a warrant 6 months (I'd need to confirm its not 120 days) after the incident. Those cases fall under the interpretation of a message overheard. In 5th Amendment cases, if you say a message in a crowded room, you don't have a reasonable expectation of privacy and this is how any message on the internet is interpreted legally. There was also a court case this spring where the DoD sued an ISP to give over IP addresses sooner than the 6 month (120 days?) limit (anyone got a link?). The DoD dropped the case though.
  - jrockway 16y ago
    Do you think the NSA is going to reveal to foreign governments that they've broken AES by going after some guy with child porn on his laptop? I personally doubt it. Could the NSA cooperate with the FBI? Yes. Will they? Not if it means they can't spy on Russia anymore.
    - alextgordon 16y ago
      "Breaking AES" is not at all necessary. All it takes is one implementation hole, or some plaintext unknowingly cached by a program. The NSA don't merely employ scores of cryptanalysts to sit around all day to try to break ciphers (though I expect they do this too). Exploiting mistakes is their bread and butter.
      - jrockway 16y ago
        And "hey guys, stop using that broken software" is not what they want to tell the people they are spying on. Can anyone name one case where the NSA has ever testified for the prosecution?
    - pilom 16y ago
      It has nothing to do with holes in AES, NSA just has better brute force capabilities than the FBI or any other law enforcement. And while you sit in jail awaiting trial, they take the months it takes to brute force a key.
    - rdtsc 16y ago
      They could just provide the password without divulging how they did it. The best way would be for them to get the drive, if they crack the password, and the password looks like it could have been guessed or generated from some contextual info about the subject or the case, then they return it the police. If they do crack it but the password is actually a random string and disclosing it would betray NSA's abilities, they they simply refuse to disclose it. On the other hand maybe it would be better to create disinformation that they have cracked all kinds of ciphers or at least their popular implementations? Maybe it will lead enemies to try to implement their own or use alternate implementations that are actually less secure. This will be similar to Airforce's disinformation related to captured UFO tech in the 50s and 60s...
digitallogic 16y ago
TrueCrypt already has this feature: http://www.truecrypt.org/hiddenvolume http://www.truecrypt.org/hiddenvolume
- ryanwaggoner 16y ago
  Ah well...at least I thought of something worth doing :)
  - edanm 16y ago
    More people should learn from this attitude. This is what I say every time I have an idea, and I later found out someone already built a startup around it (happens quite a lot, since I spend half my waking time thinking of startups).
    - InclinedPlane 16y ago
      Indeed. It means you possibly have a head for good ideas. You should be far, far more worried if nobody else has beaten you to the punch on any of your ideas, because that would tend to indicate that your ideas are either impractical or of low quality.
- omh 16y ago
  Presumably the UK police are aware of this feature, which could lead to a more interesting situation when you can't prove that you've really unlocked to the deepest level.
  - ryanwaggoner 16y ago
    Seems like you're giving the police a lot of credit, but maybe not. Regardless, there's really no way to prove anything either way, is there?
    - dagw 16y ago
      I've met a couple of people who actually deal with computer forensics for the police and they are seriously smart people and totally on top of their game. So while you're average cop might not understand the details, they have forensics guy who certainly do. As to proving anything, my understanding is that it is theoretically impossible to prove, but sometimes bugs in the implementation or various user mistakes mean that you can, in practice, sometimes get a good indication that something is hidden,
kiba 16y ago
The police will just beat you up until the secret come out. They're not going to say "Drats! Our evil plans are foiled!" http://xkcd.com/538/ http://xkcd.com/538/
- camiller 16y ago
  nah, the police can't torture you for your password. Only the evil criminals can do that. The courts can incarcerate you for not revealing a password, it's is up to you the criminal to decide if the punishment for not revealing the password is more/less severe than the punishment for whatever crime your hiding the evidence of with the password. Edit: OK now I have found evidence to prove myself wrong. At some point in the past I though I had read of a court case where a judge ruled that a defendant had to reveal a password. But a more recent case says otherwise: http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encrypted-laptop-child-porn_N.htm http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encr...
  - rdtsc 16y ago
    > Only the evil criminals can do that. Depending on the country, the symmetric set difference between the police and "evil criminals" is quite small. And even then when the police can't torture your officially, they can have ways of torturing you un-officially. They can lock you up with a group of gang members who are on the un-official "payroll" of the police. They rape and torture you until you reveal the password. The case in the media will come out as "my cellmate confessed in a moment of weakness and here is the password".
    - nandemo 16y ago
      It's even easier than that. You don't need actual torture to extract confessions: Pressed by Police, Even Innocent Confess in Japan http://www.nytimes.com/2007/05/11/world/asia/11japan.html http://www.nytimes.com/2007/05/11/world/asia/11japan.html Also: Japan is unique among democratic countries in that confessions are obtained from 95% of all people arrested, and that its courts convict 99.9% of all the suspects brought before them. (...) It is how the police obtain these confessions that troubles human-rights activists. A suspect can be held for 48 hours without legal counsel or contact with the outside world. After that, he or she is turned over to the public prosecutor for another 24 hours of grilling. A judge can then grant a further ten days of detention, which can be renewed for another ten days. http://www.debito.org/?p=217 http://www.debito.org/?p=217

tynan 16y ago

They already have this, It's called plausible deniability. What are the laws in the US on this?

pilom 16y ago
In the US the current rules for personal hard drives are bound by the 5th amendment which has been interpreted as "a reasonable expectation for privacy." What happens is the police say "Give us your password and we'll drop whatever sentence by 75% for helping the investigation." You don't have to give your password but the NSA works pretty extensively with law enforcement and the FBI (most US cases that require password cracks are federal cases but thats a separate issue). Anything that ever touches an ISP is a totally separate issue though. In that case, in the US, any information stored by an ISP can be retrieved without a warrant 6 months (I'd need to confirm its not 120 days) after the incident. Those cases fall under the interpretation of a message overheard. In 5th Amendment cases, if you say a message in a crowded room, you don't have a reasonable expectation of privacy and this is how any message on the internet is interpreted legally. There was also a court case this spring where the DoD sued an ISP to give over IP addresses sooner than the 6 month (120 days?) limit (anyone got a link?). The DoD dropped the case though.
- jrockway 16y ago
  Do you think the NSA is going to reveal to foreign governments that they've broken AES by going after some guy with child porn on his laptop? I personally doubt it. Could the NSA cooperate with the FBI? Yes. Will they? Not if it means they can't spy on Russia anymore.
  - alextgordon 16y ago
    "Breaking AES" is not at all necessary. All it takes is one implementation hole, or some plaintext unknowingly cached by a program. The NSA don't merely employ scores of cryptanalysts to sit around all day to try to break ciphers (though I expect they do this too). Exploiting mistakes is their bread and butter.
    - jrockway 16y ago
      And "hey guys, stop using that broken software" is not what they want to tell the people they are spying on. Can anyone name one case where the NSA has ever testified for the prosecution?
  - pilom 16y ago
    It has nothing to do with holes in AES, NSA just has better brute force capabilities than the FBI or any other law enforcement. And while you sit in jail awaiting trial, they take the months it takes to brute force a key.
  - rdtsc 16y ago
    They could just provide the password without divulging how they did it. The best way would be for them to get the drive, if they crack the password, and the password looks like it could have been guessed or generated from some contextual info about the subject or the case, then they return it the police. If they do crack it but the password is actually a random string and disclosing it would betray NSA's abilities, they they simply refuse to disclose it. On the other hand maybe it would be better to create disinformation that they have cracked all kinds of ciphers or at least their popular implementations? Maybe it will lead enemies to try to implement their own or use alternate implementations that are actually less secure. This will be similar to Airforce's disinformation related to captured UFO tech in the 50s and 60s...

digitallogic 16y ago

TrueCrypt already has this feature: http://www.truecrypt.org/hiddenvolume http://www.truecrypt.org/hiddenvolume

ryanwaggoner 16y ago
Ah well...at least I thought of something worth doing :)
- edanm 16y ago
  More people should learn from this attitude. This is what I say every time I have an idea, and I later found out someone already built a startup around it (happens quite a lot, since I spend half my waking time thinking of startups).
  - InclinedPlane 16y ago
    Indeed. It means you possibly have a head for good ideas. You should be far, far more worried if nobody else has beaten you to the punch on any of your ideas, because that would tend to indicate that your ideas are either impractical or of low quality.
omh 16y ago
Presumably the UK police are aware of this feature, which could lead to a more interesting situation when you can't prove that you've really unlocked to the deepest level.
- ryanwaggoner 16y ago
  Seems like you're giving the police a lot of credit, but maybe not. Regardless, there's really no way to prove anything either way, is there?
  - dagw 16y ago
    I've met a couple of people who actually deal with computer forensics for the police and they are seriously smart people and totally on top of their game. So while you're average cop might not understand the details, they have forensics guy who certainly do. As to proving anything, my understanding is that it is theoretically impossible to prove, but sometimes bugs in the implementation or various user mistakes mean that you can, in practice, sometimes get a good indication that something is hidden,

kiba 16y ago

The police will just beat you up until the secret come out. They're not going to say "Drats! Our evil plans are foiled!" http://xkcd.com/538/ http://xkcd.com/538/

camiller 16y ago
nah, the police can't torture you for your password. Only the evil criminals can do that. The courts can incarcerate you for not revealing a password, it's is up to you the criminal to decide if the punishment for not revealing the password is more/less severe than the punishment for whatever crime your hiding the evidence of with the password. Edit: OK now I have found evidence to prove myself wrong. At some point in the past I though I had read of a court case where a judge ruled that a defendant had to reveal a password. But a more recent case says otherwise: http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encrypted-laptop-child-porn_N.htm http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encr...
- rdtsc 16y ago
  > Only the evil criminals can do that. Depending on the country, the symmetric set difference between the police and "evil criminals" is quite small. And even then when the police can't torture your officially, they can have ways of torturing you un-officially. They can lock you up with a group of gang members who are on the un-official "payroll" of the police. They rape and torture you until you reveal the password. The case in the media will come out as "my cellmate confessed in a moment of weakness and here is the password".
  - nandemo 16y ago
    It's even easier than that. You don't need actual torture to extract confessions: Pressed by Police, Even Innocent Confess in Japan http://www.nytimes.com/2007/05/11/world/asia/11japan.html http://www.nytimes.com/2007/05/11/world/asia/11japan.html Also: Japan is unique among democratic countries in that confessions are obtained from 95% of all people arrested, and that its courts convict 99.9% of all the suspects brought before them. (...) It is how the police obtain these confessions that troubles human-rights activists. A suspect can be held for 48 hours without legal counsel or contact with the outside world. After that, he or she is turned over to the public prosecutor for another 24 hours of grilling. A judge can then grant a further ten days of detention, which can be renewed for another ten days. http://www.debito.org/?p=217 http://www.debito.org/?p=217