11 ms·

What would happen in the case where the perpetrator does not know the password? For example, I don't know the passwords to most of my accounts because they are

What would happen in the case where the perpetrator does not know the password? For example, I don't know the passwords to most of my accounts because they are random and stored in my password store. If I lost access to my password store, what would happen if the court demanded I provide the password to one of my accounts or encrypted files on my computer?

djsumdog 7y ago
Held in contempt indefinitely?
- busterarm 7y ago
  https://news.ycombinator.com/item?id=18907924 https://news.ycombinator.com/item?id=18907924 Francis Rawls has been for years now.
wehrkeoruw 7y ago
They'd get you access to your password store, I assume.
- newguy1234 7y ago
  They are talking about in situations where the password is so strong it cannot be bruteforced.
  - celeritascelery 7y ago
    Though it does make me wonder if online password managers like lastpass or 1Password could hand that info over if authorities demanded it.
    - Mirioron 7y ago
      I hope not. If they demonstrate that capability and word gets out then that will end their business. If they can give law enforcement access to your passwords then the employees of the company have access to the passwords too.
      - ojilles 7y ago
        I appreciate the “hope”, and I sympathize with the general view but I think the probability of a law abiding corporation to divulge this info to the American government approaches 100% across a few years, provided said corporation actually has the data (cf iPhone access codes).
    - atoav 7y ago
      I really don’t want to have to ask myself that question, which is why I’d rather use Keepass and sync the store myself.
    - bfred_it 7y ago
      That’s why you should put a pass phrase on it. Firefox syncs my passwords but has to ask for my master password at launch. Same goes for Google Chrome’s passwords: they’re encrypted at rest and can’t be displayed online for that reason, you have to sync with Chrome.
    - snuxoll 7y ago
      1Password publicly documents their security model, if you want to verify it inspecting the HTTP requests is fairly straightforward. I assume Lastpass does the same, but as I don’t use it I haven’t bothered checking.
  - wehrkeoruw 7y ago
    Brute force? Nothing brute force about bringing you your laptop/phone so you can unlock your password store.
Gustomaximus 7y ago
Or say authorities demanded access to a long lost forum account you haven't used nor remember the password from many years ago. Can they use this to detain people as a loophole... just find accounts you don't use anymore and demand access to all. Seems a dangerous law to allow.
- newguy1234 7y ago
  Yes, it can be used against you. I agree it is a "slippery slope" type of law.
  - javajosh 7y ago
    This is part of why democratic norms are as important as law: it norms as a kind of cartilage leaving the law to be relatively simple and strong. If you lose the cartilage, it's painful bone-on-bone (that is, you are forced to try to pass unambigous laws with norms baked in which tries to replace norms with laws, and the downside is in a complex, slow system, which is it's own sort of peculiar horrible injustice). There are too many examples in the US and Australia where LEOs ignore all norms, seeing them as an unjust limit on just power, and manipulate the (asymmetrically well-known) law to retroactively justify any action. Even when LEOs are legally challenged (a rare enough act of courage, and risks further victimization) and time and again get away with it anyway. And yet, the people who should be clamoring for stricter, fairer justice against LEOs are LEOs, because every time they get away with it, they win the battle but lose the war for legitimacy. When LEOs lose legitimacy, it leads to a cynical world where laws like this password one are expected to be pushed to their absolute limit by LEOs, and it will be, once again, up to the courts to enforce the norm. I fear that the modern smartphone is just too big of a temptation for centralized authority, because of their universal appeal and potential for as close to a (retroactive AND realtime!) panopticon as we can get without the palantírs from the Tolkien universe. Why don't we force people to put cameras in every room of their home with full access given to the law enforcement? And if you resist this, do you have something to hide? I think it's interesting how strong this argument is, even in it's most obviously oppressive form. Coming up with an equally satisfying counter-argument is our #1 priority as privacy advocates.
- 7y ago
saagarjha 7y ago
What happens if the police ask you to turn over the key to a safe and you’ve lost it?
- lstodd 7y ago
  They can apply an angle grinder to a safe. The whole point is that they can not be allowed to apply it to your head.
newguy1234 7y ago
You get charged with obstruction of justice or contempt of court and you will be found guilty of that crime and you will be sentenced for it. This is the slippery slope of law where basically if they want to get you then they will get you for something. Of course there is a simple solution. If you have "super secret" type files then you need to encrypt those files then upload them through TOR to a cloud hosting service. Of course per standard opsec protocol make sure you don't use a e-mail that is connected to you (make the e-mail account through TOR). This is how you prevent from being put in a situation where you are compelled to basically release a password.
- AYBABTME 7y ago
  That simple solution is basically impossible to pull off. I can't think of any cloud provider that'll let you sign off without having any identifying details about you. They'll need a payment method to begin with, and unless you usurp someone's identity and use stolen cards, you won't be able to anonymously pay for the hosting. Just getting an email account via Tor without providing any identification is hard. Every step along the path of doing something anonymously online is difficult. There's nothing simple about it.
  - TomMarius 7y ago
    You don't know any because you did not try to google any. There are many. But yeah, it's not simple for everyone, I agree.
  - syshum 7y ago
    >They'll need a payment method to begin with, Cryptocurrency, Visa/Master Card Gift Cards, "Free" Hosting (things like GitHub Pages), Free Cloud Storage Accounts....
    - AYBABTME 7y ago
      Most of these free things will still require some ID before letting you store any data. Using gift cards will flag and probably lock your account for further review before you can publish anything or use any resources. Same if you created your account or logged in from a known Tor or VPN IP address. Same if you pay in cryptocurrency. There's probably ways to do it, but I wager they're not "simple" at all. All these companies usually are required by law to make sure they can trace their customers in one way or another (Know Your Customer) and are further incentivized to prevent anonymous usage because such usage is usually done by abusive actors who'll cause problems to the platform. I'd be very curious to see someone who did it, write up the steps they took (that anyone else could take) to actually host anything online in a truly anonymous and _simple_ manner.
DarthGhandi 7y ago
This exists in Australia as law, you are considered just as guilty as not providing it. Max penalty is 10 years jail from memory. No other crime needs to be committed. We are the electoral proving grounds for US/UK/CA laws. It's totally coming for you if you think this is some silly Australian thing. I deleted a bunch a of old veracrypt drives that I've lost the passwords for and clung onto hoping I'd work it out one day after the laws came in, they've done incredibly well to make encryption seem criminal, it's terrifying and China-esque.
- 6c696e7578 7y ago
  So if I wanted a relative in jail, just ensure they use a password manager then do something from their wifi, or plant a keypass database on their computer.
  - lugg 7y ago
    Going to have to raise the bar a bit. This is Australia, we all do things on wifi.
    - fragmede 7y ago
      From their wifi. eg go to your enemy's house, connect to their WiFi, frame them with an encrypted file that they don't have the password to.
      - Red_Leaves_Flyy 7y ago
        If only reasonable doubt still got bad cases tossed.
- syshum 7y ago
  The problem for that is in the US, such laws would be unconstitutional under the 4th, 5th and 1st amendments Just like Australia's Gun Ban is unconstitutional under the 2nd Amendment
SoylentYellow 7y ago
It depends on whether or not the court believes you. If not, you could be held in contempt of court for a very long time, similarly to Beatty Chadwick: https://en.wikipedia.org/wiki/H._Beatty_Chadwick https://en.wikipedia.org/wiki/H._Beatty_Chadwick.
Reelin 7y ago
I probably have some holes in my understanding, but most of the responses here seem to miss a few key distinctions. This very much depends on the jurisdiction. Outside the US, some require you to provide electronic keys unconditionally in which case "I forgot" isn't a valid defense. Some let you off the hook if you forgot, but only if you can convince them that it's really true. Then there's the US. Here, AFAIU the court can require you to hand over physical objects which it is certain actually exist. Failure to comply is contempt, and most states don't have a maximum for that (https://psmag.com/news/a-most-uncivil-contempt-3464 https://psmag.com/news/a-most-uncivil-contempt-3464). For a password that's not written down, "I forgot" is indeed a valid defense here last I checked. Note that it doesn't apply if the court has a convincing reason to believe you were lying, which they would have in this case obviously. However! It's more complicated that that here. Whether the court can demand things you know (ex passwords) as opposed to physical objects has historically been contentious. The trouble is that the fifth amendment protects you from being required to testify against yourself, and verbally providing a password seems an awful lot like testimony as it will presumably be used to incriminate you. It's gone both ways, and at some point the Supreme Court stated that a password was roughly equivalent to a physical key and so didn't qualify for protection. This ruling goes against (?) that, stating that it's equivalent to incriminating testimony and so can't be compelled.
- sjy 7y ago
  In what jurisdiction is “I forgot” not a valid defence? If you’ve forgotten the password, you can’t comply with a disclosure order any more than if you were unconscious. The law doesn’t normally need to expressly state that it’s not a crime to fail to do something impossible. Of course, if there was evidence that satisfied the judge or jury beyond reasonable doubt that you were lying about forgotting, the defence would fail.
  - Reelin 7y ago
    Well now I'm not sure. I'm certain I saw a few reported years ago as assuming you had the key if they could show that you had encrypted something. I looked just now and couldn't find record of such key disclosure laws though.
kevincox 7y ago
I always thought this is why things in your mind are safe. The reason never seemed philosophical to me, simply that there is no way to prove the difference between not knowing and not telling.
- vageli 7y ago
  > I always thought this is why things in your mind are safe. The reason never seemed philosophical to me, simply that there is no way to prove the difference between not knowing and not telling. This seems like a natural but dangerous argument to make in a world where we are attempting to determine the states of people's minds externally. Even if we could tell the difference between lying and ignorance, is nothing sacred?
  - Nasrudith 7y ago
    I see it more as not letting constraints stay because they simply weren't possible in the past. Previously surgeons considered chest cavity surgeries forever out of reach because of the foregone infection risk even with clean tools - antibiotics changed that. There are still good reasons to object. Not going mind diving willy nilly has many other reasons, said invasiveness is both horrifyingly abusable and unduly stressful to the subject.
foogazi 7y ago
Can you be “convinced” to click on the forgot password link?
Shivetya 7y ago
what would be interesting to me see in a court of law is instances where there is a recovery option. if the challenge/responses are not freely given would the courts permit guessing based upon known information about the accused in order to reset the password? second, how many recovery processes actually protect the challenge/response information and even require it to generate a new password? now this won't work for devices secured by password that don't have an outside reset but for online accounts want prevents law enforcement from spoofing the system?
- vageli 7y ago
  > now this won't work for devices secured by password that don't have an outside reset but for online accounts want prevents law enforcement from spoofing the system? The power to subpoena evidence from the service is powerful and the tool likely to be reached for in such a case. Unless you mean an online account storing encrypted info?
qrbLPHiKpiux 7y ago
Don’t forget about that Philadelphia police officer still in jail not wanting to provide a password for some Mac encrypted drives.

djsumdog 7y ago

Held in contempt indefinitely?

busterarm 7y ago
https://news.ycombinator.com/item?id=18907924 https://news.ycombinator.com/item?id=18907924 Francis Rawls has been for years now.

wehrkeoruw 7y ago

They'd get you access to your password store, I assume.

newguy1234 7y ago
They are talking about in situations where the password is so strong it cannot be bruteforced.
- celeritascelery 7y ago
  Though it does make me wonder if online password managers like lastpass or 1Password could hand that info over if authorities demanded it.
  - Mirioron 7y ago
    I hope not. If they demonstrate that capability and word gets out then that will end their business. If they can give law enforcement access to your passwords then the employees of the company have access to the passwords too.
    - ojilles 7y ago
      I appreciate the “hope”, and I sympathize with the general view but I think the probability of a law abiding corporation to divulge this info to the American government approaches 100% across a few years, provided said corporation actually has the data (cf iPhone access codes).
  - atoav 7y ago
    I really don’t want to have to ask myself that question, which is why I’d rather use Keepass and sync the store myself.
  - bfred_it 7y ago
    That’s why you should put a pass phrase on it. Firefox syncs my passwords but has to ask for my master password at launch. Same goes for Google Chrome’s passwords: they’re encrypted at rest and can’t be displayed online for that reason, you have to sync with Chrome.
  - snuxoll 7y ago
    1Password publicly documents their security model, if you want to verify it inspecting the HTTP requests is fairly straightforward. I assume Lastpass does the same, but as I don’t use it I haven’t bothered checking.
- wehrkeoruw 7y ago
  Brute force? Nothing brute force about bringing you your laptop/phone so you can unlock your password store.

Gustomaximus 7y ago

Or say authorities demanded access to a long lost forum account you haven't used nor remember the password from many years ago. Can they use this to detain people as a loophole... just find accounts you don't use anymore and demand access to all. Seems a dangerous law to allow.

newguy1234 7y ago
Yes, it can be used against you. I agree it is a "slippery slope" type of law.
- javajosh 7y ago
  This is part of why democratic norms are as important as law: it norms as a kind of cartilage leaving the law to be relatively simple and strong. If you lose the cartilage, it's painful bone-on-bone (that is, you are forced to try to pass unambigous laws with norms baked in which tries to replace norms with laws, and the downside is in a complex, slow system, which is it's own sort of peculiar horrible injustice). There are too many examples in the US and Australia where LEOs ignore all norms, seeing them as an unjust limit on just power, and manipulate the (asymmetrically well-known) law to retroactively justify any action. Even when LEOs are legally challenged (a rare enough act of courage, and risks further victimization) and time and again get away with it anyway. And yet, the people who should be clamoring for stricter, fairer justice against LEOs are LEOs, because every time they get away with it, they win the battle but lose the war for legitimacy. When LEOs lose legitimacy, it leads to a cynical world where laws like this password one are expected to be pushed to their absolute limit by LEOs, and it will be, once again, up to the courts to enforce the norm. I fear that the modern smartphone is just too big of a temptation for centralized authority, because of their universal appeal and potential for as close to a (retroactive AND realtime!) panopticon as we can get without the palantírs from the Tolkien universe. Why don't we force people to put cameras in every room of their home with full access given to the law enforcement? And if you resist this, do you have something to hide? I think it's interesting how strong this argument is, even in it's most obviously oppressive form. Coming up with an equally satisfying counter-argument is our #1 priority as privacy advocates.
7y ago

saagarjha 7y ago

What happens if the police ask you to turn over the key to a safe and you’ve lost it?

lstodd 7y ago
They can apply an angle grinder to a safe. The whole point is that they can not be allowed to apply it to your head.

newguy1234 7y ago

You get charged with obstruction of justice or contempt of court and you will be found guilty of that crime and you will be sentenced for it. This is the slippery slope of law where basically if they want to get you then they will get you for something. Of course there is a simple solution. If you have "super secret" type files then you need to encrypt those files then upload them through TOR to a cloud hosting service. Of course per standard opsec protocol make sure you don't use a e-mail that is connected to you (make the e-mail account through TOR). This is how you prevent from being put in a situation where you are compelled to basically release a password.

AYBABTME 7y ago
That simple solution is basically impossible to pull off. I can't think of any cloud provider that'll let you sign off without having any identifying details about you. They'll need a payment method to begin with, and unless you usurp someone's identity and use stolen cards, you won't be able to anonymously pay for the hosting. Just getting an email account via Tor without providing any identification is hard. Every step along the path of doing something anonymously online is difficult. There's nothing simple about it.
- TomMarius 7y ago
  You don't know any because you did not try to google any. There are many. But yeah, it's not simple for everyone, I agree.
- syshum 7y ago
  >They'll need a payment method to begin with, Cryptocurrency, Visa/Master Card Gift Cards, "Free" Hosting (things like GitHub Pages), Free Cloud Storage Accounts....
  - AYBABTME 7y ago
    Most of these free things will still require some ID before letting you store any data. Using gift cards will flag and probably lock your account for further review before you can publish anything or use any resources. Same if you created your account or logged in from a known Tor or VPN IP address. Same if you pay in cryptocurrency. There's probably ways to do it, but I wager they're not "simple" at all. All these companies usually are required by law to make sure they can trace their customers in one way or another (Know Your Customer) and are further incentivized to prevent anonymous usage because such usage is usually done by abusive actors who'll cause problems to the platform. I'd be very curious to see someone who did it, write up the steps they took (that anyone else could take) to actually host anything online in a truly anonymous and _simple_ manner.

DarthGhandi 7y ago

This exists in Australia as law, you are considered just as guilty as not providing it. Max penalty is 10 years jail from memory. No other crime needs to be committed. We are the electoral proving grounds for US/UK/CA laws. It's totally coming for you if you think this is some silly Australian thing. I deleted a bunch a of old veracrypt drives that I've lost the passwords for and clung onto hoping I'd work it out one day after the laws came in, they've done incredibly well to make encryption seem criminal, it's terrifying and China-esque.

6c696e7578 7y ago
So if I wanted a relative in jail, just ensure they use a password manager then do something from their wifi, or plant a keypass database on their computer.
- lugg 7y ago
  Going to have to raise the bar a bit. This is Australia, we all do things on wifi.
  - fragmede 7y ago
    From their wifi. eg go to your enemy's house, connect to their WiFi, frame them with an encrypted file that they don't have the password to.
    - Red_Leaves_Flyy 7y ago
      If only reasonable doubt still got bad cases tossed.
syshum 7y ago
The problem for that is in the US, such laws would be unconstitutional under the 4th, 5th and 1st amendments Just like Australia's Gun Ban is unconstitutional under the 2nd Amendment

SoylentYellow 7y ago

It depends on whether or not the court believes you. If not, you could be held in contempt of court for a very long time, similarly to Beatty Chadwick: https://en.wikipedia.org/wiki/H._Beatty_Chadwick https://en.wikipedia.org/wiki/H._Beatty_Chadwick.

Reelin 7y ago

I probably have some holes in my understanding, but most of the responses here seem to miss a few key distinctions. This very much depends on the jurisdiction. Outside the US, some require you to provide electronic keys unconditionally in which case "I forgot" isn't a valid defense. Some let you off the hook if you forgot, but only if you can convince them that it's really true. Then there's the US. Here, AFAIU the court can require you to hand over physical objects which it is certain actually exist. Failure to comply is contempt, and most states don't have a maximum for that (https://psmag.com/news/a-most-uncivil-contempt-3464 https://psmag.com/news/a-most-uncivil-contempt-3464). For a password that's not written down, "I forgot" is indeed a valid defense here last I checked. Note that it doesn't apply if the court has a convincing reason to believe you were lying, which they would have in this case obviously. However! It's more complicated that that here. Whether the court can demand things you know (ex passwords) as opposed to physical objects has historically been contentious. The trouble is that the fifth amendment protects you from being required to testify against yourself, and verbally providing a password seems an awful lot like testimony as it will presumably be used to incriminate you. It's gone both ways, and at some point the Supreme Court stated that a password was roughly equivalent to a physical key and so didn't qualify for protection. This ruling goes against (?) that, stating that it's equivalent to incriminating testimony and so can't be compelled.

sjy 7y ago
In what jurisdiction is “I forgot” not a valid defence? If you’ve forgotten the password, you can’t comply with a disclosure order any more than if you were unconscious. The law doesn’t normally need to expressly state that it’s not a crime to fail to do something impossible. Of course, if there was evidence that satisfied the judge or jury beyond reasonable doubt that you were lying about forgotting, the defence would fail.
- Reelin 7y ago
  Well now I'm not sure. I'm certain I saw a few reported years ago as assuming you had the key if they could show that you had encrypted something. I looked just now and couldn't find record of such key disclosure laws though.

kevincox 7y ago

I always thought this is why things in your mind are safe. The reason never seemed philosophical to me, simply that there is no way to prove the difference between not knowing and not telling.

vageli 7y ago
> I always thought this is why things in your mind are safe. The reason never seemed philosophical to me, simply that there is no way to prove the difference between not knowing and not telling. This seems like a natural but dangerous argument to make in a world where we are attempting to determine the states of people's minds externally. Even if we could tell the difference between lying and ignorance, is nothing sacred?
- Nasrudith 7y ago
  I see it more as not letting constraints stay because they simply weren't possible in the past. Previously surgeons considered chest cavity surgeries forever out of reach because of the foregone infection risk even with clean tools - antibiotics changed that. There are still good reasons to object. Not going mind diving willy nilly has many other reasons, said invasiveness is both horrifyingly abusable and unduly stressful to the subject.

foogazi 7y ago

Can you be “convinced” to click on the forgot password link?

Shivetya 7y ago

what would be interesting to me see in a court of law is instances where there is a recovery option. if the challenge/responses are not freely given would the courts permit guessing based upon known information about the accused in order to reset the password? second, how many recovery processes actually protect the challenge/response information and even require it to generate a new password? now this won't work for devices secured by password that don't have an outside reset but for online accounts want prevents law enforcement from spoofing the system?

vageli 7y ago
> now this won't work for devices secured by password that don't have an outside reset but for online accounts want prevents law enforcement from spoofing the system? The power to subpoena evidence from the service is powerful and the tool likely to be reached for in such a case. Unless you mean an online account storing encrypted info?

qrbLPHiKpiux 7y ago

Don’t forget about that Philadelphia police officer still in jail not wanting to provide a password for some Mac encrypted drives.