11 ms·

> An assertion of privilege should be sustained unless the government can independently show that the suspect knows the password. I strongly disagree with this

by ohazi 8y ago

> An assertion of privilege should be sustained unless the government can independently show that the suspect knows the password. I strongly disagree with this interpretation. It's an old argument, I follow the reasoning behind it (I actually think the author does a good job arguing in favor of this position), but at the end of the day I'm just too uncomfortable with how this would work in practice. During a normal search, they get a warrant, tell you to produce some documents, and if you don't comply then they go get the documents themselves. If they can't find the documents, then they can come back to you with obstruction or contempt charges, but this is the rare case. With passwords, the rare case becomes the common case. Enough people are going to suddenly "forget" their passwords that law enforcement and judges are going to roll their eyes and throw the book at anyone who actually forgets a password. I don't believe it's possible for anyone to prove that someone knows a password. People can forget at any time, for any number of reasons, including trauma. What's going to happen when police have evidence that I did, at one point, know the extra-super-secret password to some old confidential document that I set up a pgp key to encrypt and promptly forgot about? What about when my harebrained DIY deniable encryption scheme means that I genuinely don't know which of the following hundred-thousand files I know the password to, even though I obviously must know, because I set it up in the first place? There's no law against being a paranoid doofus.

mirimir 8y ago
Indeed, the article doesn't address the question of forgetting. And generally, it over-complicates things. Let's say that you don't know the password, and never did, because it's not your device. If ordered to decrypt, you just say: "I don't know the password." You don't plead the Fifth. Because you simply don't know the password, and the thought of self-incrimination would never occur to you. Now let's say that it's your device, and that you did know the password, at one time. But maybe only for a few seconds after you set it, and then forgot to write it down. Or maybe you did that intentionally, to nuke a device before resale. Or maybe you have honestly just forgotten it. I have one or two old drives around like that, so hey ;) Anyway, in that situation, you'd just say: "I've forgotten the password." But now, let's say that it's your device, and that you do in fact know the password. What do you say? If you plead the Fifth, that's basically an admission that you know the password. Because, as I've said, the thought of self-incrimination would have never occurred to you, if you didn't know it. So you don't do that. You just say that you've forgotten it. There are, I admit, some concerns with that approach. First, you're lying to an agent, and penalties for that can be extremely severe. So it's your call to make. Also, if an agent testifies that you were using the device when swatted, that claim may seem iffy. But if pleading the Fifth is no longer an option, what are the alternatives? You can at least claim trauma. And if you're old like me, a ministroke.
- pif 8y ago
  > But if pleading the Fifth is no longer an option, what are the alternatives? Simple: just give the password!
  - bepvte 8y ago
    But then the state has access to my linux iso collection....
  - Jotra7 8y ago
    Hey guy, do you like the taste of boots or are you naturally a lickspittle?
  - mirimir 8y ago
    That'd open up quite the can of worms, for me ;) And I'm just a punter.
- deleted 8y ago
  [deleted]
- tertius 8y ago
  > If you plead the Fifth, that's basically an admission that you know the password. Is this your opinion or from the article?
  - ams6110 8y ago
    Remaining silent is (in the USA) evidence of nothing. The burden of proof is on the prosecution. Actually pleading the fifth, to a specific question, may have different implications. IANAL.
    - mirimir 8y ago
      Yes, "[r]emaining silent is (in the USA) evidence of nothing", but only regarding the facts of the case. But it can be evidence of contempt, and that can put you in jail. And because each refusal to answer is an additional act of contempt, there's effectively no limit to jail time. You're stuck in a contempt-of-court loop.
asah 8y ago
legitimate forgetting will rarely arise: law enforcement just captures the defendant entering the password (e.g. surveillance video). Face ID is also hard to "forget" :-)
- seandhi 8y ago
  Say, “hey Siri, whose phone is this?” It will require that your password be entered to unlock the phone; Face ID won’t work. You can also hold the power and volume up buttons for five seconds on the iPhone X.
- Retric 8y ago
  Having old devices/HDD sitting around seems to be common in tech and non tech circles. So, I suspect 10+% of people already have an encrypted device in their home where they forgot the password. Now, given a few dozen tries they might be able to recall it, but it’s not something they can just hand out.
  - SiempreViernes 8y ago
    I'd be surprised if more than 10% of the population actually ever owned an external drive... (excepting diskettes)
    - Retric 8y ago
      That 10% is including old phones, tablets, computers, USB sticks, and external backup drives. I suspect old tablets and phones are going to make up the bulk of forgotten passwords, but the government is going to request every password for every device.
- ricree 8y ago
  I personally have at least one Truecrypt volume whose password I've forgotten. It contains a year or so's worth of journal entries, so I keep it around in case inspiration strikes, but so far I've had no luck opening it. Were I investigated for a crime, it's not implausible that the police might take my hard drive and come back saying something like "here's a list of encrypted volumes we found, open them", and in at least that one case, I simply cannot.
onetimemanytime 8y ago
The idea is to to go to jail for refusing the court order you can follow. I've personally forgotten quite a few complicated passwords over the years. Try it, set a password, it makes perfect sense, but if you don't use it for weeks, it's gone! Jail? Nope, I knew it but I really don't now. And since, I really may not know, and no one can be sure...jail should not be an option.
ataturk 8y ago
Bullcrap. You all wanted this police state madness and you are getting what you voted for good and hard. And now you will find out what every Soviet citizen already told you: Your silence and your cooperation in the face of horrifying evil will not protect you. You know what will protect you? Fighting back. They understand force, it's all they do understand.
14 8y ago
I had an iPhone that I forgot the password to and it was a real pain in the ass. I ended up locked out of my phone and could never get past it. I have also played around with pgp and made an account and tried sending a couple encrypted emails to no one in particular. Now I forget how to even log into pgp. I also have several email address I have forgotten the passwords to. A device I used for years when the screen broke I used another phone for a month then forgot the password with out many tries. So I feel this is a concern. It is easy to forget a password. I don't use cat123, my password is like 20 characters long with capitals and special punctuation marks. Though I suspect many people would conveniently forget their password I have no doubt some would legitimately forget.
- ams6110 8y ago
  I use a password manager, and I genuinely do not know the password for most of my accounts.
  - reshie 8y ago
    there could be language in a warrant to include that scenario.
  - kabdib 8y ago
    I use a very long, static password baked into a YubiKey (with some other measures), and I honestly don't know what the password is. Q: What's your password? A: I have no idea. Q: How do you log into computers then? A: I'm going to invoke my right to remain silent now, thanks. [I am under no illusion that this actually helps the compelled decryption situation]
    - staticautomatic 8y ago
      IRL you should be invoking your right by simply not answering the first question or any other.
      - kabdib 8y ago
13415 8y ago
Fun story. Back when I was a bit younger, I once forgot the 4-digit PIN of a cash card after a heavy night of drinking, even though I had used the card for many, many years almost daily. It was just gone, no matter how much I tried to remember it. (Then, getting a new card took 3 weeks or more, so I tried a lot.) My guess is that some information is stored in the brain chemically in few brain cells, and when they're gong, it's gone.
paulgrant999 8y ago
No. What they're going to do, is say that the courts have a right to whatever evidence they want (public interest); that your forgotten poassword is a "fraudulent" attempt not to comply and is actually an attempt to cover up the evidence; that you now have the burden to prove how you forgot your password (good luck!). ...that immediately opens you up to contempt, obstruction, and worse, now they can comment on "how you refused to help law enforcement with their perfectly lawful request" because (intro whatever bullshit they want to make stick). And it sure as shit isn't rare. Theres actual language (I blanked on it just now) thats positively orwellian. In, binding precedent, caselaw. -- Look up "compelled testimonial production absent gaurantees of immunity"; "civil subpoenas" (where the fifth doesn't apply i.e. the Cosby headshot), "cruel trilemma", "star-oath chamber" (used frequently). ...and it happens, every day. If you don't think you are living in "burn-the-witch" English times with zero civil protections ;) You aren't reading caselaw. And you are DEFINITELY, not paranoid enough.
eneveu 8y ago
I'm actually one of those paranoid doofus. I have a few 2 TB backup hard drives encrypted with Truecrypt (before the Truecrypt devs decided to abandon the project), and I can't remember the password... I tried to brute-force it using John The Ripper, but after a few hours trying to configure it with a dictionary, I just gave up. I'll need to get back to it some day !

by ohazi 8y ago

mirimir 8y ago

Indeed, the article doesn't address the question of forgetting. And generally, it over-complicates things. Let's say that you don't know the password, and never did, because it's not your device. If ordered to decrypt, you just say: "I don't know the password." You don't plead the Fifth. Because you simply don't know the password, and the thought of self-incrimination would never occur to you. Now let's say that it's your device, and that you did know the password, at one time. But maybe only for a few seconds after you set it, and then forgot to write it down. Or maybe you did that intentionally, to nuke a device before resale. Or maybe you have honestly just forgotten it. I have one or two old drives around like that, so hey ;) Anyway, in that situation, you'd just say: "I've forgotten the password." But now, let's say that it's your device, and that you do in fact know the password. What do you say? If you plead the Fifth, that's basically an admission that you know the password. Because, as I've said, the thought of self-incrimination would have never occurred to you, if you didn't know it. So you don't do that. You just say that you've forgotten it. There are, I admit, some concerns with that approach. First, you're lying to an agent, and penalties for that can be extremely severe. So it's your call to make. Also, if an agent testifies that you were using the device when swatted, that claim may seem iffy. But if pleading the Fifth is no longer an option, what are the alternatives? You can at least claim trauma. And if you're old like me, a ministroke.

pif 8y ago
> But if pleading the Fifth is no longer an option, what are the alternatives? Simple: just give the password!
- bepvte 8y ago
  But then the state has access to my linux iso collection....
- Jotra7 8y ago
  Hey guy, do you like the taste of boots or are you naturally a lickspittle?
- mirimir 8y ago
  That'd open up quite the can of worms, for me ;) And I'm just a punter.
deleted 8y ago
[deleted]
tertius 8y ago
> If you plead the Fifth, that's basically an admission that you know the password. Is this your opinion or from the article?
- ams6110 8y ago
  Remaining silent is (in the USA) evidence of nothing. The burden of proof is on the prosecution. Actually pleading the fifth, to a specific question, may have different implications. IANAL.
  - mirimir 8y ago
    Yes, "[r]emaining silent is (in the USA) evidence of nothing", but only regarding the facts of the case. But it can be evidence of contempt, and that can put you in jail. And because each refusal to answer is an additional act of contempt, there's effectively no limit to jail time. You're stuck in a contempt-of-court loop.

asah 8y ago

legitimate forgetting will rarely arise: law enforcement just captures the defendant entering the password (e.g. surveillance video). Face ID is also hard to "forget" :-)

seandhi 8y ago
Say, “hey Siri, whose phone is this?” It will require that your password be entered to unlock the phone; Face ID won’t work. You can also hold the power and volume up buttons for five seconds on the iPhone X.
Retric 8y ago
Having old devices/HDD sitting around seems to be common in tech and non tech circles. So, I suspect 10+% of people already have an encrypted device in their home where they forgot the password. Now, given a few dozen tries they might be able to recall it, but it’s not something they can just hand out.
- SiempreViernes 8y ago
  I'd be surprised if more than 10% of the population actually ever owned an external drive... (excepting diskettes)
  - Retric 8y ago
    That 10% is including old phones, tablets, computers, USB sticks, and external backup drives. I suspect old tablets and phones are going to make up the bulk of forgotten passwords, but the government is going to request every password for every device.
ricree 8y ago
I personally have at least one Truecrypt volume whose password I've forgotten. It contains a year or so's worth of journal entries, so I keep it around in case inspiration strikes, but so far I've had no luck opening it. Were I investigated for a crime, it's not implausible that the police might take my hard drive and come back saying something like "here's a list of encrypted volumes we found, open them", and in at least that one case, I simply cannot.

onetimemanytime 8y ago

The idea is to to go to jail for refusing the court order you can follow. I've personally forgotten quite a few complicated passwords over the years. Try it, set a password, it makes perfect sense, but if you don't use it for weeks, it's gone! Jail? Nope, I knew it but I really don't now. And since, I really may not know, and no one can be sure...jail should not be an option.

ataturk 8y ago

Bullcrap. You all wanted this police state madness and you are getting what you voted for good and hard. And now you will find out what every Soviet citizen already told you: Your silence and your cooperation in the face of horrifying evil will not protect you. You know what will protect you? Fighting back. They understand force, it's all they do understand.

14 8y ago

I had an iPhone that I forgot the password to and it was a real pain in the ass. I ended up locked out of my phone and could never get past it. I have also played around with pgp and made an account and tried sending a couple encrypted emails to no one in particular. Now I forget how to even log into pgp. I also have several email address I have forgotten the passwords to. A device I used for years when the screen broke I used another phone for a month then forgot the password with out many tries. So I feel this is a concern. It is easy to forget a password. I don't use cat123, my password is like 20 characters long with capitals and special punctuation marks. Though I suspect many people would conveniently forget their password I have no doubt some would legitimately forget.

ams6110 8y ago
I use a password manager, and I genuinely do not know the password for most of my accounts.
- reshie 8y ago
  there could be language in a warrant to include that scenario.
- kabdib 8y ago
  I use a very long, static password baked into a YubiKey (with some other measures), and I honestly don't know what the password is. Q: What's your password? A: I have no idea. Q: How do you log into computers then? A: I'm going to invoke my right to remain silent now, thanks. [I am under no illusion that this actually helps the compelled decryption situation]
  - staticautomatic 8y ago
    IRL you should be invoking your right by simply not answering the first question or any other.
    - kabdib 8y ago

13415 8y ago

Fun story. Back when I was a bit younger, I once forgot the 4-digit PIN of a cash card after a heavy night of drinking, even though I had used the card for many, many years almost daily. It was just gone, no matter how much I tried to remember it. (Then, getting a new card took 3 weeks or more, so I tried a lot.) My guess is that some information is stored in the brain chemically in few brain cells, and when they're gong, it's gone.

paulgrant999 8y ago

No. What they're going to do, is say that the courts have a right to whatever evidence they want (public interest); that your forgotten poassword is a "fraudulent" attempt not to comply and is actually an attempt to cover up the evidence; that you now have the burden to prove how you forgot your password (good luck!). ...that immediately opens you up to contempt, obstruction, and worse, now they can comment on "how you refused to help law enforcement with their perfectly lawful request" because (intro whatever bullshit they want to make stick). And it sure as shit isn't rare. Theres actual language (I blanked on it just now) thats positively orwellian. In, binding precedent, caselaw. -- Look up "compelled testimonial production absent gaurantees of immunity"; "civil subpoenas" (where the fifth doesn't apply i.e. the Cosby headshot), "cruel trilemma", "star-oath chamber" (used frequently). ...and it happens, every day. If you don't think you are living in "burn-the-witch" English times with zero civil protections ;) You aren't reading caselaw. And you are DEFINITELY, not paranoid enough.

eneveu 8y ago

I'm actually one of those paranoid doofus. I have a few 2 TB backup hard drives encrypted with Truecrypt (before the Truecrypt devs decided to abandon the project), and I can't remember the password... I tried to brute-force it using John The Ripper, but after a few hours trying to configure it with a dictionary, I just gave up. I'll need to get back to it some day !