6 ms·

I had an iPhone that I forgot the password to and it was a real pain in the ass. I ended up locked out of my phone and could never get past it. I have also play

by 14 8y ago

I had an iPhone that I forgot the password to and it was a real pain in the ass. I ended up locked out of my phone and could never get past it. I have also played around with pgp and made an account and tried sending a couple encrypted emails to no one in particular. Now I forget how to even log into pgp. I also have several email address I have forgotten the passwords to. A device I used for years when the screen broke I used another phone for a month then forgot the password with out many tries. So I feel this is a concern. It is easy to forget a password. I don't use cat123, my password is like 20 characters long with capitals and special punctuation marks. Though I suspect many people would conveniently forget their password I have no doubt some would legitimately forget.

ams6110 8y ago
I use a password manager, and I genuinely do not know the password for most of my accounts.
- reshie 8y ago
  there could be language in a warrant to include that scenario.
- kabdib 8y ago
  I use a very long, static password baked into a YubiKey (with some other measures), and I honestly don't know what the password is. Q: What's your password? A: I have no idea. Q: How do you log into computers then? A: I'm going to invoke my right to remain silent now, thanks. [I am under no illusion that this actually helps the compelled decryption situation]
  - staticautomatic 8y ago
    IRL you should be invoking your right by simply not answering the first question or any other.
    - kabdib 8y ago
      You are correct.
  - Analemma_ 8y ago
    If you ever actually get arrested, do not do this. Once you start answering questions, you forfeit your right to silence, and refusing to answer questions later can and will be taken as evidence against you. Just be silent from the beginning.
    - kabdib 8y ago
      You can shut up any time; there's no "Oh, you were talking, now you can't stop talking." Of course you cannot take back what escaped your mouth prior to asserting for right to remain silent.
  - ThrustVectoring 8y ago
    This hurts the compelled decryption situation immensely. You have a physical key that you can be forced to turn over, and then they basically have everything.
    - kabdib 8y ago
      There are other measures, such as a prefix or suffix ("PIN") that you can supply, so the physical key doesn't have the entire password. Otherwise, you're right. It's also useful to be able to leave the physical key at home, or with another party. ... and if you hand it to your attorney, does that count as privileged communication?
- bensonn 8y ago
  Warrants have to be specific, correct? If they asked for your Xyz password and you didn't know it, you explained you used a password manager- would they have to get an expanded warrant to compel you to disclose that password? Would that be considered an overly broad warrant? I use my password manager to save things that are not passwords too- padlock combos, combo to my safe, medical info, parents wills, banking, all my dirty secrets... Seems wrong they could get access to all my info if the warrant is just for Xyz.
AlexCoventry 8y ago
Speaking of which, I have a computer with a locked screensaver which I've forgotten the password for. If anyone in the vicinity of Boston knows how to do a cold-boot attack and is interested in practicing on it, please get in touch. :-) It doesn't really matter if the process fails, it would just be nice to regain access, and it would be interesting to learn how to do it.
- eximius 8y ago
  Is the hard drive encrypted? If not, just take it out and... You're done.
  - AlexCoventry 8y ago
    Yes, otherwise it would be simple.
- Filligree 8y ago
  Does it have memory encryption enabled? Or even an IOMMU? Does it boot on its own, without entering a password? I'm on the wrong side of the ocean, alas, but I'm betting this won't be too hard to crack.
  - AlexCoventry 8y ago
    Regarding the hardware questions, I don't know. FWIW, it's a Dell Inspiron i3531-1200BK. It does have FDE, and requires a password on boot for that.
    - Filligree 8y ago
      So, hang on. Do you know the FDE password? If so, just take the disk out and plop it in another machine and-- you're done. If not, then no cold-boot attack can possibly work.
      - AlexCoventry 8y ago
octosphere 8y ago
> I had an iPhone that I forgot the password to and it was a real pain in the ass. I know this doesn't address your comment head-on (i.e lost password) - but it does address the issue of stolen phones which are apparently impossible to restore back to their factory settings. Most people who rob iPhones are not technically savvy, but they know people who are, and they get those people to debrick the phones. The real question is: who are these people who can unbrick iPhones?. Well it turns out: all you need to do is look on your town noticeboard and there are a slew of people who claim to 'unlock' or otherwise debrick iPhones. Typically the tech they use to debrick the phones is readily available on the web, and god knows what other things they do to the phones once they are 'market ready' and ready to be sold (malware implants, either accidental or deliberate can be found on these devices). I know from experience and know a few people in those circles who deal with stolen phones all day, everyday. There are also firms who demand proof-of-ID so that stolen phones can be tracked and tied back to an individual. The firms that don't require ID have something to hide (they typically ask for no ID and happily sell you a stolen phone for a cut price).
- wyldfire 8y ago
  You can also use stolen phones for spare parts, though I suppose they're much less valuable as such.
  - 14 8y ago
    Absolutely this. I had someone say "well my phone would be worthless anyways since it would be locked" I laughed at them. I said so your perfectly good screen has no value to me if mine is cracked? Your speaker in the phone worthless? And so on. I am typing this on an iPhone 4s that has had more donor parts then I can even fathom. You can buy unlocked motherboards as well, though with Apple locking things like the home button to the board not entirely sure how that would work but the point stands the phones are definitely with something locked or not.

by 14 8y ago

ams6110 8y ago

I use a password manager, and I genuinely do not know the password for most of my accounts.

reshie 8y ago
there could be language in a warrant to include that scenario.
kabdib 8y ago
I use a very long, static password baked into a YubiKey (with some other measures), and I honestly don't know what the password is. Q: What's your password? A: I have no idea. Q: How do you log into computers then? A: I'm going to invoke my right to remain silent now, thanks. [I am under no illusion that this actually helps the compelled decryption situation]
- staticautomatic 8y ago
  IRL you should be invoking your right by simply not answering the first question or any other.
  - kabdib 8y ago
    You are correct.
- Analemma_ 8y ago
  If you ever actually get arrested, do not do this. Once you start answering questions, you forfeit your right to silence, and refusing to answer questions later can and will be taken as evidence against you. Just be silent from the beginning.
  - kabdib 8y ago
    You can shut up any time; there's no "Oh, you were talking, now you can't stop talking." Of course you cannot take back what escaped your mouth prior to asserting for right to remain silent.
- ThrustVectoring 8y ago
  This hurts the compelled decryption situation immensely. You have a physical key that you can be forced to turn over, and then they basically have everything.
  - kabdib 8y ago
    There are other measures, such as a prefix or suffix ("PIN") that you can supply, so the physical key doesn't have the entire password. Otherwise, you're right. It's also useful to be able to leave the physical key at home, or with another party. ... and if you hand it to your attorney, does that count as privileged communication?
bensonn 8y ago
Warrants have to be specific, correct? If they asked for your Xyz password and you didn't know it, you explained you used a password manager- would they have to get an expanded warrant to compel you to disclose that password? Would that be considered an overly broad warrant? I use my password manager to save things that are not passwords too- padlock combos, combo to my safe, medical info, parents wills, banking, all my dirty secrets... Seems wrong they could get access to all my info if the warrant is just for Xyz.

AlexCoventry 8y ago

Speaking of which, I have a computer with a locked screensaver which I've forgotten the password for. If anyone in the vicinity of Boston knows how to do a cold-boot attack and is interested in practicing on it, please get in touch. :-) It doesn't really matter if the process fails, it would just be nice to regain access, and it would be interesting to learn how to do it.

eximius 8y ago
Is the hard drive encrypted? If not, just take it out and... You're done.
- AlexCoventry 8y ago
  Yes, otherwise it would be simple.
Filligree 8y ago
Does it have memory encryption enabled? Or even an IOMMU? Does it boot on its own, without entering a password? I'm on the wrong side of the ocean, alas, but I'm betting this won't be too hard to crack.
- AlexCoventry 8y ago
  Regarding the hardware questions, I don't know. FWIW, it's a Dell Inspiron i3531-1200BK. It does have FDE, and requires a password on boot for that.
  - Filligree 8y ago
    So, hang on. Do you know the FDE password? If so, just take the disk out and plop it in another machine and-- you're done. If not, then no cold-boot attack can possibly work.
    - AlexCoventry 8y ago

octosphere 8y ago

> I had an iPhone that I forgot the password to and it was a real pain in the ass. I know this doesn't address your comment head-on (i.e lost password) - but it does address the issue of stolen phones which are apparently impossible to restore back to their factory settings. Most people who rob iPhones are not technically savvy, but they know people who are, and they get those people to debrick the phones. The real question is: who are these people who can unbrick iPhones?. Well it turns out: all you need to do is look on your town noticeboard and there are a slew of people who claim to 'unlock' or otherwise debrick iPhones. Typically the tech they use to debrick the phones is readily available on the web, and god knows what other things they do to the phones once they are 'market ready' and ready to be sold (malware implants, either accidental or deliberate can be found on these devices). I know from experience and know a few people in those circles who deal with stolen phones all day, everyday. There are also firms who demand proof-of-ID so that stolen phones can be tracked and tied back to an individual. The firms that don't require ID have something to hide (they typically ask for no ID and happily sell you a stolen phone for a cut price).

wyldfire 8y ago
You can also use stolen phones for spare parts, though I suppose they're much less valuable as such.
- 14 8y ago
  Absolutely this. I had someone say "well my phone would be worthless anyways since it would be locked" I laughed at them. I said so your perfectly good screen has no value to me if mine is cracked? Your speaker in the phone worthless? And so on. I am typing this on an iPhone 4s that has had more donor parts then I can even fathom. You can buy unlocked motherboards as well, though with Apple locking things like the home button to the board not entirely sure how that would work but the point stands the phones are definitely with something locked or not.