6 ms·

A natural extension of this idea is the concept of multiple duress passwords that do different things - i.e., the concept of a password as a command, an unstopp

by dTal 8y ago

A natural extension of this idea is the concept of multiple duress passwords that do different things - i.e., the concept of a password as a command, an unstoppable last chance to make changes to your system. If this becomes popular I imagine authorities will start making images of devices before demanding login, so they can check that the act of logging in hasn't substantially changed the system.

codetrotter 8y ago
> I imagine authorities will start making images of devices before demanding login, so they can check that the act of logging in hasn't substantially changed the system. I think that’s standard procedure already. Also, note that destructing or concealing evidence that is relevant to a court case or legal investigation is a criminal offense in many jurisdictions. For sure you will face charges just for trying even if you are not successful (e.g. because they’ve imaged the system).
- LeifCarrotson 8y ago
  How does having an image of the encrypted drive allow them to determine whether the system has 'significantly' changed? Just generating a login in the event log should make the image completely different.
  - kkarakk 8y ago
    i think the idea is that their(govt/shady entity - what's the difference?) forensic scientists would be able to tell whether the very act of entering a password started changing a system significantly which would count as refusing to comply
    - eeZah7Ux 8y ago
      > entering a password started changing a system significantly When different passwords (for the same user) simply decrypt and access different parts of the filesystem it's not the case.
    - ethagnawl 8y ago
      > changing a system significantly I'm rehashing your parent's comment, but: Unless the command wiped the entire disk or the entity gained access to the unencrypted versions of the disk before/after the duress command, an outsider wouldn't be able to tell if a log had been updated or if an entire partition had been wiped.
      - yorwba 8y ago
        Disk encryption prevents revealing the plaintext of files on disk, but you can still observe their ciphertext changing when the file changes. If the duress command causes different files to be modified compared to a normal login, then that can be detected by comparing to the original disk image, even though the actual modifications performed are hidden by the encryption. On the other hand, it's possible to delete an encrypted partition by only overwriting the encryption key, which might be a small-enough change to go undetected.
        lev99 8y ago
        If at least 98% of your drive isn't partitioned out its going to cause some questions by a curious observer.
        vageli 8y ago
        > Disk encryption prevents revealing the plaintext of files on disk, but you can still observe their ciphertext changing when the file changes. If the duress command causes different files to be modified compared to a normal login, then that can be detected by comparing to the original disk image, even though the actual modifications performed are hidden by the encryption. How would they even be able to determine which files are modified? If we're talking full disk encryption here, you can't tell which files are being accessed/modified, just locations on disk. Without metadata to map blocks to objects they're flying blind.
        loeg 8y ago
        E.g., If every block on the device changes, that's a pretty big flag. If only a few change, that's expected. So the magnitude of change is both observable and conveys information to the attacker.
  - dTal 8y ago
    If the root drive is encrypted then what good does this software do? By the time login_duress has a chance to run, you've already had to type in a decryption password.
  - loeg 8y ago
    That isn't how any full-disk encryption scheme works. A login event entry probably changes a single block.
- cesarb 8y ago
  > I think that’s standard procedure already. It can still be useful when they don't have physical access to make an image, for instance when the system in question is being remotely accessed via ssh. > Also, note that destructing or concealing evidence that is relevant to a court case or legal investigation is a criminal offense in many jurisdictions. It can still be useful when there's no court case or legal investigation. For instance, when you're being illegally threatened to reveal your password.
  - Kalium 8y ago
    > It can still be useful when they don't have physical access to make an image, for instance when the system in question is being remotely accessed via ssh. Bear in mind that law enforcement generally has the ability to go get those too. > It can still be useful when there's no court case or legal investigation. For instance, when you're being illegally threatened to reveal your password. You're absolutely right! One caveat worth considering is that this might not be a typical security threat that most people are likely to face.
- dfee 8y ago
  You’re not referring to America, right? I could be behind on certain policies but that’d seem to fly in the face of the fifth amendment (or is concealment not covered?).
  - CGamesPlay 8y ago
    The fifth amendment says you cannot be forced to incriminate yourself. Actively destroying evidence that could incriminate you is not covered by that.
  - krastanov 8y ago
    The 5th and 4th have a rather weird status at border crossings. You can be denied entry to the country if you refuse to share passwords, for instance. Or have your equipment be confiscated. Some of this has even been upheld in court.
    - harshreality 8y ago
      While everyone, including U.S. citizens and permanent residents, can have their electronics confiscated (stolen) for refusal to cooperate... Citizens and permanent residents cannot generally be refused entry for flexing their rights. There are a few ways permanent residents can be denied entry, but the main one is having been out of the country for over 180 days. Temporary residents and visitors are the ones who can be denied entry for looking at an immigration agent wrong, or trying to flex their right against absurd digital searches. However much we might wish for things to be different. Europe and Oceana may have a less intrusive policy about digital searches, but everywhere else is either worse than the USA, or isn't developed enough to have paranoid security services that want to search everything.
  - loeg 8y ago
    The 4th and 5th amendments have been severely degraded since 9/11: https://www.aclu.org/other/constitution-100-mile-border-zone https://www.aclu.org/other/constitution-100-mile-border-zone
- RidingPegasus 8y ago
  > I think that’s standard procedure already. Simply transferring everything off a 2TB HDD at 100MB/s will take over 5 hours, and that's ignoring any hashing.
  - dharmab 8y ago
    I can absolutely confirm that standard procedure is to seize storage media as evidence, send them to a lab and clone the images as the very first step.
    - codetrotter 8y ago
      Another thing I came to think of as well is that they often employ write-blockers, don’t they? Pieces of hardware that go between the computer and the storage media. So by the time decryption is demanded, it will be done with the system in a read-only state right?
      - dharmab 8y ago
        They don't run forensics on the actual device if at all possible, only a read-only cloned image.
dsr_ 8y ago
pam_duress, linked from the article, offers this feature. Each user can have multiple duress passwords that do different things.
deleted 8y ago
[deleted]
seanalltogether 8y ago
Do authorities actually log in to peoples systems right now? I assumed password demands were just for decrypting existing hard drives contents, not for physically logging in to their computers.
- dharmab 8y ago
  They usually clone the images, but may ask for passwords, e.g. devices where the media is soldered to the board. I do not know if they compel you to provide the password; I believe that varies by jurisdiction.

by dTal 8y ago

codetrotter 8y ago

> I imagine authorities will start making images of devices before demanding login, so they can check that the act of logging in hasn't substantially changed the system. I think that’s standard procedure already. Also, note that destructing or concealing evidence that is relevant to a court case or legal investigation is a criminal offense in many jurisdictions. For sure you will face charges just for trying even if you are not successful (e.g. because they’ve imaged the system).

LeifCarrotson 8y ago
How does having an image of the encrypted drive allow them to determine whether the system has 'significantly' changed? Just generating a login in the event log should make the image completely different.
- kkarakk 8y ago
  i think the idea is that their(govt/shady entity - what's the difference?) forensic scientists would be able to tell whether the very act of entering a password started changing a system significantly which would count as refusing to comply
  - eeZah7Ux 8y ago
    > entering a password started changing a system significantly When different passwords (for the same user) simply decrypt and access different parts of the filesystem it's not the case.
  - ethagnawl 8y ago
    > changing a system significantly I'm rehashing your parent's comment, but: Unless the command wiped the entire disk or the entity gained access to the unencrypted versions of the disk before/after the duress command, an outsider wouldn't be able to tell if a log had been updated or if an entire partition had been wiped.
    - yorwba 8y ago
      Disk encryption prevents revealing the plaintext of files on disk, but you can still observe their ciphertext changing when the file changes. If the duress command causes different files to be modified compared to a normal login, then that can be detected by comparing to the original disk image, even though the actual modifications performed are hidden by the encryption. On the other hand, it's possible to delete an encrypted partition by only overwriting the encryption key, which might be a small-enough change to go undetected.
      - lev99 8y ago
        If at least 98% of your drive isn't partitioned out its going to cause some questions by a curious observer.
      - vageli 8y ago
        > Disk encryption prevents revealing the plaintext of files on disk, but you can still observe their ciphertext changing when the file changes. If the duress command causes different files to be modified compared to a normal login, then that can be detected by comparing to the original disk image, even though the actual modifications performed are hidden by the encryption. How would they even be able to determine which files are modified? If we're talking full disk encryption here, you can't tell which files are being accessed/modified, just locations on disk. Without metadata to map blocks to objects they're flying blind.
        loeg 8y ago
        E.g., If every block on the device changes, that's a pretty big flag. If only a few change, that's expected. So the magnitude of change is both observable and conveys information to the attacker.
- dTal 8y ago
  If the root drive is encrypted then what good does this software do? By the time login_duress has a chance to run, you've already had to type in a decryption password.
- loeg 8y ago
  That isn't how any full-disk encryption scheme works. A login event entry probably changes a single block.
cesarb 8y ago
> I think that’s standard procedure already. It can still be useful when they don't have physical access to make an image, for instance when the system in question is being remotely accessed via ssh. > Also, note that destructing or concealing evidence that is relevant to a court case or legal investigation is a criminal offense in many jurisdictions. It can still be useful when there's no court case or legal investigation. For instance, when you're being illegally threatened to reveal your password.
- Kalium 8y ago
  > It can still be useful when they don't have physical access to make an image, for instance when the system in question is being remotely accessed via ssh. Bear in mind that law enforcement generally has the ability to go get those too. > It can still be useful when there's no court case or legal investigation. For instance, when you're being illegally threatened to reveal your password. You're absolutely right! One caveat worth considering is that this might not be a typical security threat that most people are likely to face.
dfee 8y ago
You’re not referring to America, right? I could be behind on certain policies but that’d seem to fly in the face of the fifth amendment (or is concealment not covered?).
- CGamesPlay 8y ago
  The fifth amendment says you cannot be forced to incriminate yourself. Actively destroying evidence that could incriminate you is not covered by that.
- krastanov 8y ago
  The 5th and 4th have a rather weird status at border crossings. You can be denied entry to the country if you refuse to share passwords, for instance. Or have your equipment be confiscated. Some of this has even been upheld in court.
  - harshreality 8y ago
    While everyone, including U.S. citizens and permanent residents, can have their electronics confiscated (stolen) for refusal to cooperate... Citizens and permanent residents cannot generally be refused entry for flexing their rights. There are a few ways permanent residents can be denied entry, but the main one is having been out of the country for over 180 days. Temporary residents and visitors are the ones who can be denied entry for looking at an immigration agent wrong, or trying to flex their right against absurd digital searches. However much we might wish for things to be different. Europe and Oceana may have a less intrusive policy about digital searches, but everywhere else is either worse than the USA, or isn't developed enough to have paranoid security services that want to search everything.
- loeg 8y ago
  The 4th and 5th amendments have been severely degraded since 9/11: https://www.aclu.org/other/constitution-100-mile-border-zone https://www.aclu.org/other/constitution-100-mile-border-zone
RidingPegasus 8y ago
> I think that’s standard procedure already. Simply transferring everything off a 2TB HDD at 100MB/s will take over 5 hours, and that's ignoring any hashing.
- dharmab 8y ago
  I can absolutely confirm that standard procedure is to seize storage media as evidence, send them to a lab and clone the images as the very first step.
  - codetrotter 8y ago
    Another thing I came to think of as well is that they often employ write-blockers, don’t they? Pieces of hardware that go between the computer and the storage media. So by the time decryption is demanded, it will be done with the system in a read-only state right?
    - dharmab 8y ago
      They don't run forensics on the actual device if at all possible, only a read-only cloned image.

dsr_ 8y ago

pam_duress, linked from the article, offers this feature. Each user can have multiple duress passwords that do different things.

deleted 8y ago

[deleted]

seanalltogether 8y ago

Do authorities actually log in to peoples systems right now? I assumed password demands were just for decrypting existing hard drives contents, not for physically logging in to their computers.

dharmab 8y ago
They usually clone the images, but may ask for passwords, e.g. devices where the media is soldered to the board. I do not know if they compel you to provide the password; I believe that varies by jurisdiction.