6 ms·

Obligatory $5 wrench comment: https://xkcd.com/538/ https://xkcd.com/538/ Something like this is probably good when you - as a person - are not around when you

Obligatory $5 wrench comment: https://xkcd.com/538/ https://xkcd.com/538/ Something like this is probably good when you - as a person - are not around when your hardware gets extracted from your place. But then again, why would it be running openly and unattended in the first place?

ex_amazon_sde 6y ago
Can we please stop endlessly repeating this? Life is much more complex than that. A small laptop, a phone or a tablet can be stolen from you while powered on and unlocked by a simple thief that has no intention, nor ability, to capture and torture you. The thief could then quickly hand the device to other people that flash it and sell it in a different country. But first they might extract any valuable data.
- numlock86 6y ago
  > Life is much more complex than that. > [...] a simple thief that has no intention, nor ability, to capture and torture you By your comment I assume you live in a developed country and/or are not within a regularly oppressed minority, which of course, is a nice privilege. Sadly not everyone is that lucky and torture over something simple as $1 online transactions is pretty real.
  - Nasrudith 6y ago
    That isn't priveledge but a matter of the threat model to protect against - stop with the irrelevant pseudomoralist privledge shaming shit. If they wanted protection against that they would recommended a gun or several mercenary bodyguards. Which would require money and connections. But the topic isn't "How to quickly kill or incapacitate three or more men with only your barehands while having legal cover".
dividedbyzero 6y ago
In many places, law enforcement will pressure but not torture you to provide decryption keys, maybe imprison you for a while, fine you, ... But that may be preferable than them knowing about all those highly illegal nuclear doomsday space arms technology knowledge deals you've brokered, or that collection of child porn, or those detailed assassination plans, or whatever. Maybe the authorities suspect something, maybe a SWAT team will snatch your laptop, but if all evidence is in there and encrypted, you may get off with a lot less than otherwise.
- kwhitefoot 6y ago
  In the UK you might well be in prison for five years for refusing to hand over the keys. https://www.schneier.com/blog/archives/2007/10/uk_police_can_n.html https://www.schneier.com/blog/archives/2007/10/uk_police_can... Not sure what the situation is now.
  - DanBC 6y ago
    Section 49 to force key disclosure should only happen if: + The person being given the notice has the key + Investigators need the key to prevent or detect crime + Disclosure is proportionate + They can't get the encrypted material by other means Not complying with the is a criminal offence. The maximum sentence is 2 years, unless it's a case involving child sexual exploitation or national security where the maximum sentence is 5 years. There is a code of practice for use of these powers here: https://www.gov.uk/government/publications/code-of-practice-for-investigation-of-protected-electronic-information https://www.gov.uk/government/publications/code-of-practice-... I think that properly regulated key disclosure powers are important. I'm not sure we're (the UK) are getting it right with RIPA. I'd want to see stronger audit and oversight of the S49 notices, and better advice given to people who are served S49 notices. For example: I have no idea how many people are served S49 notices, and I don't really know how to find out. I don't know how many people have been imprisoned for not disclosing keys; I don't know what sentences they've been given; and I'm not clear on how to find that out. I feel that it should be easier for citizens to have clear data about these really intrusive powers. EDIT: I just found this page, and it seems like it's small numbers of people. But still, it's a bit worrying. https://wiki.openrightsgroup.org/wiki/Regulation_of_Investigatory_Powers_Act_2000/Part_III#Cases https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...
    - Jaruzel 6y ago
      > Investigators need the key to prevent or detect crime That's a bit scary. 'Detect crime' could be pure speculation on the polices' part. "We think you've done something bad, let us see the contents of your phone. No we don't have any evidence already as we're detecting the crime right now."
berkas1 6y ago
This (link) is actually referred to as a Rubber-hose cryptanalysis -> https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis

ex_amazon_sde 6y ago

Can we please stop endlessly repeating this? Life is much more complex than that. A small laptop, a phone or a tablet can be stolen from you while powered on and unlocked by a simple thief that has no intention, nor ability, to capture and torture you. The thief could then quickly hand the device to other people that flash it and sell it in a different country. But first they might extract any valuable data.

numlock86 6y ago
> Life is much more complex than that. > [...] a simple thief that has no intention, nor ability, to capture and torture you By your comment I assume you live in a developed country and/or are not within a regularly oppressed minority, which of course, is a nice privilege. Sadly not everyone is that lucky and torture over something simple as $1 online transactions is pretty real.
- Nasrudith 6y ago
  That isn't priveledge but a matter of the threat model to protect against - stop with the irrelevant pseudomoralist privledge shaming shit. If they wanted protection against that they would recommended a gun or several mercenary bodyguards. Which would require money and connections. But the topic isn't "How to quickly kill or incapacitate three or more men with only your barehands while having legal cover".

dividedbyzero 6y ago

In many places, law enforcement will pressure but not torture you to provide decryption keys, maybe imprison you for a while, fine you, ... But that may be preferable than them knowing about all those highly illegal nuclear doomsday space arms technology knowledge deals you've brokered, or that collection of child porn, or those detailed assassination plans, or whatever. Maybe the authorities suspect something, maybe a SWAT team will snatch your laptop, but if all evidence is in there and encrypted, you may get off with a lot less than otherwise.

kwhitefoot 6y ago
In the UK you might well be in prison for five years for refusing to hand over the keys. https://www.schneier.com/blog/archives/2007/10/uk_police_can_n.html https://www.schneier.com/blog/archives/2007/10/uk_police_can... Not sure what the situation is now.
- DanBC 6y ago
  Section 49 to force key disclosure should only happen if: + The person being given the notice has the key + Investigators need the key to prevent or detect crime + Disclosure is proportionate + They can't get the encrypted material by other means Not complying with the is a criminal offence. The maximum sentence is 2 years, unless it's a case involving child sexual exploitation or national security where the maximum sentence is 5 years. There is a code of practice for use of these powers here: https://www.gov.uk/government/publications/code-of-practice-for-investigation-of-protected-electronic-information https://www.gov.uk/government/publications/code-of-practice-... I think that properly regulated key disclosure powers are important. I'm not sure we're (the UK) are getting it right with RIPA. I'd want to see stronger audit and oversight of the S49 notices, and better advice given to people who are served S49 notices. For example: I have no idea how many people are served S49 notices, and I don't really know how to find out. I don't know how many people have been imprisoned for not disclosing keys; I don't know what sentences they've been given; and I'm not clear on how to find that out. I feel that it should be easier for citizens to have clear data about these really intrusive powers. EDIT: I just found this page, and it seems like it's small numbers of people. But still, it's a bit worrying. https://wiki.openrightsgroup.org/wiki/Regulation_of_Investigatory_Powers_Act_2000/Part_III#Cases https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...
  - Jaruzel 6y ago
    > Investigators need the key to prevent or detect crime That's a bit scary. 'Detect crime' could be pure speculation on the polices' part. "We think you've done something bad, let us see the contents of your phone. No we don't have any evidence already as we're detecting the crime right now."

berkas1 6y ago

This (link) is actually referred to as a Rubber-hose cryptanalysis -> https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis