3 ms·

Solving the rubber pipe solution

by celticninja 8y ago

saalweachter 8y ago
Not really.
- egwynn 8y ago
  My intuition makes me agree that it does address the rubber-hose scenario. Could you elaborate on why you think it doesn’t?
  - csydas 8y ago
    Because we've seen studies on what torture does to people and how most people respond to torture. Once a person breaks, they try their best to appease their torturer. An adversary rubber hosing isn't just going to stop when they login and dont get what they want. In some rather narrow cases it might help avoid random searches from a non-malicious threat. (e.g., border guard just proving a point for whatever reason) If there is a purpose to recover something from your machine, an invested adversary that is willing to rubber hose is going to keep going. And the numbers seem to show that most people will not have the will and calm to use their duress password when they've been tortured into logging in.
    - daveFNbuck 8y ago
      The whole point of login_duress is that you say "there's nothing you want on this machine" and give them the duress credential knowing that the thing they want will be deleted. Once it's deleted, you can't break and give it to them.
      - egwynn 8y ago
        Yeah, I think this is where the meat is. csydas’s points have merit. Namely: 1. torturers will keep torturing until they get what they want, and 2. victims will eventually tell the torturer whatever the torturer wants to hear in order to stop the torturing. However, if you can employ your duress code, then you might be able to defeat the torturer (by preventing them from gaining access — they could still very well kill you) or by alerting the outside world about the duress scenario.
  - saalweachter 8y ago
    The rubber hose scenario is that someone is willing to hurt you to access the data you have on your device. You trick them into entering a password that either wipes the data, alerts someone to the attempt, or dumps them into a sandbox that appears normal but doesn't provide the access they want. What do you think happens next?
- zbentley 8y ago
  Well, it improves on risk (to the data, not the user) in torture situations, but I wouldn't say it "solves" the rubber-hose problem. And it only helps when a copy of the data has not been made. Torture works (in situations in which it actually works, which are vanishingly few--in no way should this be taken as in favor of torture) by creating expectations of future suffering. Torture victims are made compliant over time, so it's more likely that a victim would have the wherewithal to enter a duress code early in the process than it is that they would not crack after prolonged torture.
  - ufmace 8y ago
    Somewhat different perspective - torture works great, at what it's actually for. It's actually for oppressing a population you have control over, not specifically getting information. The getting information part is just a moderately useful byproduct. The torturers purpose is to terrify you, and your friends and family, out of having anything to do with the anti-regime forces. Considering that, whether you are actually guilty of anything may not matter, and whether any information you cough up is true doesn't matter that much either. Getting actionable intelligence against actual organized anti-regime forces is just a bonus. If you're thinking that way, and the forces you're up against are too, then the only thing this really accomplishes is potentially protecting the information that reveals your actual comrades. And if you're actually in a situation where protecting information about your comrades and operations is more important than potentially avoiding torture, then you're braver than most of the people on the planet, and good luck - you'll need it.

Solving the rubber pipe solution

saalweachter 8y ago

Not really.

egwynn 8y ago
My intuition makes me agree that it does address the rubber-hose scenario. Could you elaborate on why you think it doesn’t?
- csydas 8y ago
  Because we've seen studies on what torture does to people and how most people respond to torture. Once a person breaks, they try their best to appease their torturer. An adversary rubber hosing isn't just going to stop when they login and dont get what they want. In some rather narrow cases it might help avoid random searches from a non-malicious threat. (e.g., border guard just proving a point for whatever reason) If there is a purpose to recover something from your machine, an invested adversary that is willing to rubber hose is going to keep going. And the numbers seem to show that most people will not have the will and calm to use their duress password when they've been tortured into logging in.
  - daveFNbuck 8y ago
    The whole point of login_duress is that you say "there's nothing you want on this machine" and give them the duress credential knowing that the thing they want will be deleted. Once it's deleted, you can't break and give it to them.
    - egwynn 8y ago
      Yeah, I think this is where the meat is. csydas’s points have merit. Namely: 1. torturers will keep torturing until they get what they want, and 2. victims will eventually tell the torturer whatever the torturer wants to hear in order to stop the torturing. However, if you can employ your duress code, then you might be able to defeat the torturer (by preventing them from gaining access — they could still very well kill you) or by alerting the outside world about the duress scenario.
- saalweachter 8y ago
  The rubber hose scenario is that someone is willing to hurt you to access the data you have on your device. You trick them into entering a password that either wipes the data, alerts someone to the attempt, or dumps them into a sandbox that appears normal but doesn't provide the access they want. What do you think happens next?
zbentley 8y ago
Well, it improves on risk (to the data, not the user) in torture situations, but I wouldn't say it "solves" the rubber-hose problem. And it only helps when a copy of the data has not been made. Torture works (in situations in which it actually works, which are vanishingly few--in no way should this be taken as in favor of torture) by creating expectations of future suffering. Torture victims are made compliant over time, so it's more likely that a victim would have the wherewithal to enter a duress code early in the process than it is that they would not crack after prolonged torture.
- ufmace 8y ago
  Somewhat different perspective - torture works great, at what it's actually for. It's actually for oppressing a population you have control over, not specifically getting information. The getting information part is just a moderately useful byproduct. The torturers purpose is to terrify you, and your friends and family, out of having anything to do with the anti-regime forces. Considering that, whether you are actually guilty of anything may not matter, and whether any information you cough up is true doesn't matter that much either. Getting actionable intelligence against actual organized anti-regime forces is just a bonus. If you're thinking that way, and the forces you're up against are too, then the only thing this really accomplishes is potentially protecting the information that reveals your actual comrades. And if you're actually in a situation where protecting information about your comrades and operations is more important than potentially avoiding torture, then you're braver than most of the people on the planet, and good luck - you'll need it.