5 ms·

Plausible deniability systems are pretty amazing but didn't seem to catch on. Truecrypt was awesome, it had hidden drives. Edit: "didn't seem to catch on" I me

Plausible deniability systems are pretty amazing but didn't seem to catch on. Truecrypt was awesome, it had hidden drives. Edit: "didn't seem to catch on" I mean you can't do this with popular products like FileVault. https://www.truecrypt71a.com/documentation/plausible-deniability/ https://www.truecrypt71a.com/documentation/plausible-deniabi...

cryptonector 8y ago
If LEO find you're using Truecrypt, do you think they'll not realize that you might have a hidden drive and ask for that password too??
- ransom1538 8y ago
  That is where LEO is screwed. They can't prove if you do or you don't have hidden data. EG. There isn't a /hidden_stuff_here/ directory. Its somehow baked into the encryption blocks.
- stale2002 8y ago
  Well, then you give them your second password, and it is fine, because you actually have 3 passwords. The police can't just keep saying "we didn't find anything, therefore you MUST have ANOTHER double secret password!". At that point you are indistinguishable from someone who is innocent.
  - cryptonector 8y ago
    The device is rated 1TB. Given all of the passwords you gave us we can account for .5TB and we cannot find a free-space map. Ergo there is at least one more password that you're not sharing with us. Seriously, other people aren't dumb.
    - stale2002 8y ago
      That's not how partions work for these things. And the people who wrote these security systems thought of exactly this attack vector. If you create a passworded partion, it adds a bunch of extra unused space, that MIGHT be another passworded partion, or might just be random empty space. IE, maybe you have 3 passwords and 200 GB of extra space, or maybe it is actually 4 passwords and 150 GB of extra space that is random bytes. These 2 situations are identical and cannot be differentiated. The police tell you to access that 150GB of extra space, and it is impossible. Because it's random bytes, and there really isn't an extra partition.
      - cryptonector 8y ago
        You're missing the point, which is that LEO and courts will (reasonably!) make the following inference: "MIGHT be another password-protected partition" -> "is a password-protected partition" You can disagree with that thinking all you want, but it won't do you any good if the people thinking that are in control of your destiny.
        stale2002 8y ago
        Sure, but then nothing you do matters. Imagine the situation where you really ARE innocent. Jail for life? Possible, but whether you are innocent or not doesn't change anything. Yes, the police could just jail you for life or kill you. But that's ALWAYS the case. They'd do that to you anyway of you are innocent
        cryptonector 8y ago
        Well, there is something you can do: don't use software that gives you plausible deniability. BTW, someone posted this fascinating link in this thread: https://web.archive.org/web/20100820175505/http://iq.org:80/~proff/rubberhose.org/current/src/doc/beatings.txt https://web.archive.org/web/20100820175505/http://iq.org:80/...
    - goblin89 8y ago
      Partition will report it’s 1TB large[0]. You should perhaps read about the software before continuing to post comments claiming it’s unfit for purpose. There is a list of considerations that a TrueCrypt/VeraCrypt user with stricter security requirements would have to keep in mind, following all of it makes it fairly difficult to discover hidden partitions. The people who wrote and maintain the software aren’t dumb either. [0] https://security.stackexchange.com/a/58150 https://security.stackexchange.com/a/58150
  - DanBC 8y ago
    > The police can't just keep saying "we didn't find anything, therefore you MUST have ANOTHER double secret password!" You might want to watch "Making a Murderer". Or, for the UK equivalent, have a look at the Cleveland Child Abuse Scandal (where social workers were asking children questions like "Tell us the truth, you're not going home until you tell us what Daddy did to you"). The police can, and do, subject people to coercive interrogation techniques. These techniques have been designed to extract a confession, whether you're guilty or not.
    - stale2002 8y ago
      Sure, but are that point you are already screwed, and it doesn't matter what you do. Even if you ARE innocent, it doesn't matter. The point of security measures is to make you indistinguishable from someone who's innocent. Yes, you can counter this by saying "well they'll jail you anyway, even if you ARE innocent". But that's a different discussion entirely.

cryptonector 8y ago

If LEO find you're using Truecrypt, do you think they'll not realize that you might have a hidden drive and ask for that password too??

ransom1538 8y ago
That is where LEO is screwed. They can't prove if you do or you don't have hidden data. EG. There isn't a /hidden_stuff_here/ directory. Its somehow baked into the encryption blocks.
stale2002 8y ago
Well, then you give them your second password, and it is fine, because you actually have 3 passwords. The police can't just keep saying "we didn't find anything, therefore you MUST have ANOTHER double secret password!". At that point you are indistinguishable from someone who is innocent.
- cryptonector 8y ago
  The device is rated 1TB. Given all of the passwords you gave us we can account for .5TB and we cannot find a free-space map. Ergo there is at least one more password that you're not sharing with us. Seriously, other people aren't dumb.
  - stale2002 8y ago
    That's not how partions work for these things. And the people who wrote these security systems thought of exactly this attack vector. If you create a passworded partion, it adds a bunch of extra unused space, that MIGHT be another passworded partion, or might just be random empty space. IE, maybe you have 3 passwords and 200 GB of extra space, or maybe it is actually 4 passwords and 150 GB of extra space that is random bytes. These 2 situations are identical and cannot be differentiated. The police tell you to access that 150GB of extra space, and it is impossible. Because it's random bytes, and there really isn't an extra partition.
    - cryptonector 8y ago
      You're missing the point, which is that LEO and courts will (reasonably!) make the following inference: "MIGHT be another password-protected partition" -> "is a password-protected partition" You can disagree with that thinking all you want, but it won't do you any good if the people thinking that are in control of your destiny.
      - stale2002 8y ago
        Sure, but then nothing you do matters. Imagine the situation where you really ARE innocent. Jail for life? Possible, but whether you are innocent or not doesn't change anything. Yes, the police could just jail you for life or kill you. But that's ALWAYS the case. They'd do that to you anyway of you are innocent
        cryptonector 8y ago
        Well, there is something you can do: don't use software that gives you plausible deniability. BTW, someone posted this fascinating link in this thread: https://web.archive.org/web/20100820175505/http://iq.org:80/~proff/rubberhose.org/current/src/doc/beatings.txt https://web.archive.org/web/20100820175505/http://iq.org:80/...
  - goblin89 8y ago
    Partition will report it’s 1TB large[0]. You should perhaps read about the software before continuing to post comments claiming it’s unfit for purpose. There is a list of considerations that a TrueCrypt/VeraCrypt user with stricter security requirements would have to keep in mind, following all of it makes it fairly difficult to discover hidden partitions. The people who wrote and maintain the software aren’t dumb either. [0] https://security.stackexchange.com/a/58150 https://security.stackexchange.com/a/58150
- DanBC 8y ago
  > The police can't just keep saying "we didn't find anything, therefore you MUST have ANOTHER double secret password!" You might want to watch "Making a Murderer". Or, for the UK equivalent, have a look at the Cleveland Child Abuse Scandal (where social workers were asking children questions like "Tell us the truth, you're not going home until you tell us what Daddy did to you"). The police can, and do, subject people to coercive interrogation techniques. These techniques have been designed to extract a confession, whether you're guilty or not.
  - stale2002 8y ago
    Sure, but are that point you are already screwed, and it doesn't matter what you do. Even if you ARE innocent, it doesn't matter. The point of security measures is to make you indistinguishable from someone who's innocent. Yes, you can counter this by saying "well they'll jail you anyway, even if you ARE innocent". But that's a different discussion entirely.