4 ms·

I like the idea of this, however I do not like that you are expected to keep the master key in your drawer somewhere. It’s like writing your master password on

I like the idea of this, however I do not like that you are expected to keep the master key in your drawer somewhere. It’s like writing your master password on a sticky note and putting it in a drawer. I know there is always a risk of forgetting your master password but keeping it only in your brain gives you the most protection. I suspect law enforcement would have an easier time compelling you to give up your DiceKey object than forcing you to repeat your brain key. However I am not a lawyer and would be interested to hear more from those who know more about this kind of situation.

MrLeap 6y ago
If you spill it on accident on your way to surrender it, it would be really unfortunate.
- doctoboggan 6y ago
  Unfortunately destruction of evidence is a crime which could aid the prosecutions arguments for consciousness of guilt and in the worth case tack on a new charge. I believe the jury could also be instructed to assume the worst in cases where evidence is destroyed.
  - MrLeap 6y ago
    Most unfortunate. :(
- dicekeys 6y ago
  The current DiceKeys box has latches to make sure it's very very hard to open accidentally or if dropped from human heights. We have thought about designing a box that's intentionally very easy to open for people who want to encrypt their laptop when traveling into a jurisdiction that may want to steal IP or compromise their journalistic sources. We'd want the user to be able to slip their hand into their pocket and release the dice from the box before anyone knows to ask for their DiceKey.
TimTheTinker 6y ago
> I suspect law enforcement would have an easier time compelling you to give up your DiceKey object than forcing you to repeat your brain key. Yes, at least in the US. There's good case law backing up the legal doctrine that the 5th amendment applies concerning anything known or memorized -- but that with a warrant, law enforcement can search a premises and seize items described by the warrant.
- mthoms 6y ago
  IANAL, but one can still serve time (up to 18 months) for contempt of court as I understand it - https://arstechnica.com/tech-policy/2020/02/man-who-refused-to-decrypt-hard-drives-is-free-after-four-years-in-jail/ https://arstechnica.com/tech-policy/2020/02/man-who-refused-...
ocdtrekkie 6y ago
> It’s like writing your master password on a sticky note and putting it in a drawer. People should do this, and people should stop telling other people it's bad security to do this. And then people should stop using password managers. The idea that the sticky note is bad is hilariously old school, and the result has been everyone putting their passwords in cloud-stored apps instead, which is 10,000% worse than a sticky note. Remember: If it's on the Internet, your potential attacker is "every human on earth". If it's on a sticky note, your potential attacker is "everyone who can get access to the physical place you keep it". The former will always be an increasing number of billions of Internet users. The latter can be reduced to one or two if you store your sticky note somewhere very secure, like a safe or security deposit box. Also, for added security... just lie on your sticky note. It doesn't have to be a high entropy lie to befuddle people.
- doctoboggan 6y ago
  But you have to agree that memorizing your password is more secure than writing it down.
  - ocdtrekkie 6y ago
    Of course. But not everyone is good at that.
    - codetrotter 6y ago
      correct battery horse staple, but longer and sensible but still unique, and optionally without space. Make up a sentence that makes sense to you, and remove all the spaces, use all lowercase and no special characters. Forgettable: 5uP3r53kr17P455w00r[)!!11One Memorable: ilikestartrekandhamandbeans I used to have full-disk encryption on one of my machines using a password of the forgettable kind. But then the machine had an uptime of months until a power outage, and I realized that while I was fairly sure of the sentence I had no possibility of remembering all of the uppercase and lowercase and symbol and number substitutions. I lost quite a bit of data that day. After that I began using a sentence that makes sense to me but which is not from a book or anything like that for the FDE on my desktop and external hard drives, and I use the pass phrase frequently. Simplicity and repetition is the key to remember your master password. As for websites I use a password manager, and I sometimes generate passwords with my own diceware software https://github.com/ctsrc/Pgen https://github.com/ctsrc/Pgen but most often I am on my phone or on my laptop and then I use the password generator of the password manager that comes with those Apple devices. I haven’t lost any more data since switching to managing my data encryption and my passwords this way.

MrLeap 6y ago

If you spill it on accident on your way to surrender it, it would be really unfortunate.

doctoboggan 6y ago
Unfortunately destruction of evidence is a crime which could aid the prosecutions arguments for consciousness of guilt and in the worth case tack on a new charge. I believe the jury could also be instructed to assume the worst in cases where evidence is destroyed.
- MrLeap 6y ago
  Most unfortunate. :(
dicekeys 6y ago
The current DiceKeys box has latches to make sure it's very very hard to open accidentally or if dropped from human heights. We have thought about designing a box that's intentionally very easy to open for people who want to encrypt their laptop when traveling into a jurisdiction that may want to steal IP or compromise their journalistic sources. We'd want the user to be able to slip their hand into their pocket and release the dice from the box before anyone knows to ask for their DiceKey.

TimTheTinker 6y ago

> I suspect law enforcement would have an easier time compelling you to give up your DiceKey object than forcing you to repeat your brain key. Yes, at least in the US. There's good case law backing up the legal doctrine that the 5th amendment applies concerning anything known or memorized -- but that with a warrant, law enforcement can search a premises and seize items described by the warrant.

mthoms 6y ago
IANAL, but one can still serve time (up to 18 months) for contempt of court as I understand it - https://arstechnica.com/tech-policy/2020/02/man-who-refused-to-decrypt-hard-drives-is-free-after-four-years-in-jail/ https://arstechnica.com/tech-policy/2020/02/man-who-refused-...

ocdtrekkie 6y ago

> It’s like writing your master password on a sticky note and putting it in a drawer. People should do this, and people should stop telling other people it's bad security to do this. And then people should stop using password managers. The idea that the sticky note is bad is hilariously old school, and the result has been everyone putting their passwords in cloud-stored apps instead, which is 10,000% worse than a sticky note. Remember: If it's on the Internet, your potential attacker is "every human on earth". If it's on a sticky note, your potential attacker is "everyone who can get access to the physical place you keep it". The former will always be an increasing number of billions of Internet users. The latter can be reduced to one or two if you store your sticky note somewhere very secure, like a safe or security deposit box. Also, for added security... just lie on your sticky note. It doesn't have to be a high entropy lie to befuddle people.

doctoboggan 6y ago
But you have to agree that memorizing your password is more secure than writing it down.
- ocdtrekkie 6y ago
  Of course. But not everyone is good at that.
  - codetrotter 6y ago
    correct battery horse staple, but longer and sensible but still unique, and optionally without space. Make up a sentence that makes sense to you, and remove all the spaces, use all lowercase and no special characters. Forgettable: 5uP3r53kr17P455w00r[)!!11One Memorable: ilikestartrekandhamandbeans I used to have full-disk encryption on one of my machines using a password of the forgettable kind. But then the machine had an uptime of months until a power outage, and I realized that while I was fairly sure of the sentence I had no possibility of remembering all of the uppercase and lowercase and symbol and number substitutions. I lost quite a bit of data that day. After that I began using a sentence that makes sense to me but which is not from a book or anything like that for the FDE on my desktop and external hard drives, and I use the pass phrase frequently. Simplicity and repetition is the key to remember your master password. As for websites I use a password manager, and I sometimes generate passwords with my own diceware software https://github.com/ctsrc/Pgen https://github.com/ctsrc/Pgen but most often I am on my phone or on my laptop and then I use the password generator of the password manager that comes with those Apple devices. I haven’t lost any more data since switching to managing my data encryption and my passwords this way.