4 ms·

I understand how "clever law hacks" like warrant canaries are not clever when faced against actual law enforcement practices. I say this to try to explain that

I understand how "clever law hacks" like warrant canaries are not clever when faced against actual law enforcement practices. I say this to try to explain that the following isn't meant to be a clever trick and instead is meant as a reason why I worry about these kinds of law. I have a very long passphrase that I only have to enter at machine boot up time. After entering the pw once the password manager remains open in cache and can be opened with a much shorter and easier to remember password. Because I do not restart my phone or devices frequently I don't need to enter my password often and so my very long complicated password isn't used often. My practice has been to automatically restart my phone whenever I am approached by a police officer. This has happened maybe once in the last year or 2. If I live in Ireland, am I screwed when the stress of being detained causes me to forget my very long, complicated, and infrequently entered password?

fragbait65 5y ago
Yes, I honestly think you are screwed.
jfoutz 5y ago
Sometime during quarantine I had an evening thought excercise about clever password choices in this context. It was a fun game, and would be a cute scene in a movie or a book. Ultimately the password `fuck you cop I'll never tell` is a fun idea, but little value. Complying without appearing to comply might change up the game a bit, but you're still screwed. _edit_ it is kind of fun to think of a password so offensive that it doesn't matter who asks you, they won't believe that's your password. Technically might buy you some time before they figure it out.
- cge 5y ago
  The way the law is worded (see my other comment), the police can force you to do whatever is necessary to unlock the device by any means at your disposal, not just disclose your password. While this would be technically a terrible idea on their part for a number of reasons, having a clever password would not be helpful.
- dane-pgp 5y ago
  > a password so offensive that it doesn't matter who asks you, they won't believe that's your password. If they don't believe it's your password, then you haven't really avoided the punishment for not disclosing your password (although you might take some comfort from a kind of moral victory, having told the truth and complied with the letter of the law). Instead of coming up with a password that offends the police, a better approach is to come up with one that interests them, specifically a detailed admission of a crime. For example, the password could be of the form "I killed John Doe, and buried the body in my garden". Assuming your jurisdiction has protections against self-incrimination, and you can convince a judge that your password really does contain such information, they may have to choose between not learning your password, and giving you some sort of immunity deal. Of course, if this approach leads to innocent citizens routinely committing crimes just to come up with a unique password (or worse, criminals baiting police into giving them immunity in return for access to dummy encrypted data) then the only law that will be followed is the Law of Unintended Consequences.
  - garblegarble 5y ago
    >Assuming your jurisdiction has protections against self-incrimination, and you can convince a judge that your password really does contain such information, they may have to choose between not learning your password, and giving you some sort of immunity deal. I think it's quite unlikely they'd give immunity, especially when they could just instruct you to unlock the device and hand it over without telling them the password
  - pbhjpbhj 5y ago
    I'm assuming the offensive password works in a situation where you have a deadman's handle. So then a month later you can say "I told you my password was '$offensive-phrase' and can prove it was, now you need to release me" (presumably after your lawyer acquires the audio from the interview to back up your assertion).
version_five 5y ago
I wonder if its possible to easily set up a phone or other device with a multiple password/ login system that depending on the credentials could either show something benign or wipe the device. I'd expect such systems to become more popular (and make the main result of these new powers be that police have a new tool to harass unsophisticated and already downtrodden folks, rather than actually to disrupt any serious crime)
- noman-land 5y ago
  Check out the rubberhose file system. https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29 https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29
  - RealStickman_ 5y ago
    Is there some more modern version of this?
TameAntelope 5y ago
Okay, I know it's very keyboard-warrior-eqsue, and I don't know how I'd really react if actually faced with this situation, but I think this is something I'd be proud to sit in jail over. Ask me after a month/week/day/hour of course, but I hope I'd be strong enough to deal with this appropriately.
XorNot 5y ago
We're going to start needing "burn the battery on demand" mods.
- CoastalCoder 5y ago
  Please don't bring these on airplanes.
BitwiseFool 5y ago
I'm genuinely wondering how someone could implement a system that functions like a dead man's hand where the key to recovery (despite entering the valid password as required by law) which lies outside of the jurisdiction of that government, or relies on the data being unavailable for a long stretch of time. >"If I live in Ireland, am I screwed when the stress of being detained causes me to forget my very long, complicated, and infrequently entered password? " As for this part, I've become a cynic after learning so much about how courts actually function on a daily basis. There really isn't anything stopping a judge from simply finding you in contempt of court - even if you legitimately did lose your password. Ultimately, if the judge wants to, they can easily drag you through the mud and you have virtually no recourse. Edit: I know Apple has a feature that disables FaceID that acts like a 'panic' button. How do the courts deal with that?
varispeed 5y ago
You can use TC hidden volumes that will log you into different volume depending on entered password. It is not possible to detect that a volume has hidden volumes. Something like this should exist natively in Android and other operating systems, but obviously there would be a push back from governments.
themolecularman 5y ago
> My practice has been to automatically restart my phone whenever I am approached by a police officer. This has happened maybe once in the last year or 2. In the United States (where I live) this seems risky. I think most here would prefer their phone to be on and readily available for filming in case they need to film the police encounter. We have a lot of cops spazzing out on people.

fragbait65 5y ago

Yes, I honestly think you are screwed.

jfoutz 5y ago

Sometime during quarantine I had an evening thought excercise about clever password choices in this context. It was a fun game, and would be a cute scene in a movie or a book. Ultimately the password `fuck you cop I'll never tell` is a fun idea, but little value. Complying without appearing to comply might change up the game a bit, but you're still screwed. _edit_ it is kind of fun to think of a password so offensive that it doesn't matter who asks you, they won't believe that's your password. Technically might buy you some time before they figure it out.

cge 5y ago
The way the law is worded (see my other comment), the police can force you to do whatever is necessary to unlock the device by any means at your disposal, not just disclose your password. While this would be technically a terrible idea on their part for a number of reasons, having a clever password would not be helpful.
dane-pgp 5y ago
> a password so offensive that it doesn't matter who asks you, they won't believe that's your password. If they don't believe it's your password, then you haven't really avoided the punishment for not disclosing your password (although you might take some comfort from a kind of moral victory, having told the truth and complied with the letter of the law). Instead of coming up with a password that offends the police, a better approach is to come up with one that interests them, specifically a detailed admission of a crime. For example, the password could be of the form "I killed John Doe, and buried the body in my garden". Assuming your jurisdiction has protections against self-incrimination, and you can convince a judge that your password really does contain such information, they may have to choose between not learning your password, and giving you some sort of immunity deal. Of course, if this approach leads to innocent citizens routinely committing crimes just to come up with a unique password (or worse, criminals baiting police into giving them immunity in return for access to dummy encrypted data) then the only law that will be followed is the Law of Unintended Consequences.
- garblegarble 5y ago
  >Assuming your jurisdiction has protections against self-incrimination, and you can convince a judge that your password really does contain such information, they may have to choose between not learning your password, and giving you some sort of immunity deal. I think it's quite unlikely they'd give immunity, especially when they could just instruct you to unlock the device and hand it over without telling them the password
- pbhjpbhj 5y ago
  I'm assuming the offensive password works in a situation where you have a deadman's handle. So then a month later you can say "I told you my password was '$offensive-phrase' and can prove it was, now you need to release me" (presumably after your lawyer acquires the audio from the interview to back up your assertion).

version_five 5y ago

I wonder if its possible to easily set up a phone or other device with a multiple password/ login system that depending on the credentials could either show something benign or wipe the device. I'd expect such systems to become more popular (and make the main result of these new powers be that police have a new tool to harass unsophisticated and already downtrodden folks, rather than actually to disrupt any serious crime)

noman-land 5y ago
Check out the rubberhose file system. https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29 https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29
- RealStickman_ 5y ago
  Is there some more modern version of this?

TameAntelope 5y ago

Okay, I know it's very keyboard-warrior-eqsue, and I don't know how I'd really react if actually faced with this situation, but I think this is something I'd be proud to sit in jail over. Ask me after a month/week/day/hour of course, but I hope I'd be strong enough to deal with this appropriately.

XorNot 5y ago

We're going to start needing "burn the battery on demand" mods.

CoastalCoder 5y ago
Please don't bring these on airplanes.

BitwiseFool 5y ago

I'm genuinely wondering how someone could implement a system that functions like a dead man's hand where the key to recovery (despite entering the valid password as required by law) which lies outside of the jurisdiction of that government, or relies on the data being unavailable for a long stretch of time. >"If I live in Ireland, am I screwed when the stress of being detained causes me to forget my very long, complicated, and infrequently entered password? " As for this part, I've become a cynic after learning so much about how courts actually function on a daily basis. There really isn't anything stopping a judge from simply finding you in contempt of court - even if you legitimately did lose your password. Ultimately, if the judge wants to, they can easily drag you through the mud and you have virtually no recourse. Edit: I know Apple has a feature that disables FaceID that acts like a 'panic' button. How do the courts deal with that?

varispeed 5y ago

You can use TC hidden volumes that will log you into different volume depending on entered password. It is not possible to detect that a volume has hidden volumes. Something like this should exist natively in Android and other operating systems, but obviously there would be a push back from governments.

themolecularman 5y ago

> My practice has been to automatically restart my phone whenever I am approached by a police officer. This has happened maybe once in the last year or 2. In the United States (where I live) this seems risky. I think most here would prefer their phone to be on and readily available for filming in case they need to film the police encounter. We have a lot of cops spazzing out on people.