10 ms·

Deleting probably wouldn't be the best approach, because (a) the drive could just be duplicated before-hand, (b) they'd know you'd done it. Better just to buy

by bccdee 5y ago

Deleting probably wouldn't be the best approach, because (a) the drive could just be duplicated before-hand, (b) they'd know you'd done it. Better just to buy a bunch of USB sticks, wipe 'em all with random noise, use a couple for mundane files, and use a couple for sensitive files — deniably encrypted so as to look like random noise. Then, you can plausibly deny that they contain any sensitive files. The real issue here is that we shouldn't need to use these sorts of measures. No one will do this unless they're a software professional with something to hide, and "having nothing to hide" doesn't mean you're not still entitled to privacy.

DistressedDrone 5y ago
> (b) they'd know you'd done it. That depends entirely on how exactly you do it. And knowing something and being able to prove it are two very different things.
- philipov 5y ago
  It's fine, just have the legislature pass a Bill of Attainder that declares the thing you know is a proven fact, and you're peachy. It worked great in the Trial of Thomas Wentworth.
tablespoon 5y ago
> Better just to buy a bunch of USB sticks, wipe 'em all with random noise, use a couple for mundane files, and use a couple for sensitive files — deniably encrypted so as to look like random noise. Then, you can plausibly deny that they contain any sensitive files. You're creating a situation where you have a set of encrypted and non-encrypted devices that are indistinguishable, and expecting the police to let you off. But there's nothing stopping someone with only encrypted devices to claim the same thing. I'd be worried that approach would fail either by 1) the police calling your bluff, or 2) indefinitely holding you in jail for contempt of court until you decrypt a drive that has un-decryptable random data.
- dorgo 5y ago
  Eventually it will become illigal to have randomly generated data stored somewhere.
- bccdee 5y ago
  An unreasonable adversary, such as a terrorist group or something, could plausibly do that. But the legal system has things like the "beyond reasonable doubt" standard of guilt. If the court finds encryption headers on your disk, they've got evidence beyond reasonable doubt that there's encrypted data on it. If there's only noise, it's totally plausible that it's just a spare usb stick, especially if you consistently wipe your unused disks and don't just have one conspicuous disk full of noise.
  - brokenmachine 5y ago
    >If the court finds encryption headers on your disk Encryption with plausible deniability will not have readable headers. It will appear to be completely random data.
    - bccdee 5y ago
      Yeah, that's my point. A proper plausibly-deniable system will be indistinguishable from a disk which has been wiped, to the point that no court can reasonably accuse you of hiding files on it.
dTal 5y ago
>you can plausibly deny that they contain any sensitive files. "Don't worry about my large collection of seemingly encrypted USB sticks officer, it's actually just random noise I filled them with for the lulz! No sensitive files here." I see no flaws with this plan.
- bccdee 5y ago
  "Yeah, when I'm done with a USB stick I wipe it with random noise, so that I know that the data I'm finished with is properly deleted." Usually when you encrypt a drive there's a telltale header, so the disks wouldn't be "seemingly encrypted" at all — and wiping disks clean with noise isn't especially uncommon. It's as plausibly-deniable as it gets, and it'd certainly fly in court.
  - brokenmachine 5y ago
    >Usually when you encrypt a drive there's a telltale header Not necessarily. https://www.truecrypt71a.com/documentation/plausible-deniability/ https://www.truecrypt71a.com/documentation/plausible-deniabi... 2. Until decrypted, a TrueCrypt partition/device appears to consist of nothing more than random data (it does not contain any kind of “signature”).
    - bccdee 5y ago
      Huh — I was unaware that TrueCrypt has plausible deniability by default. I know it's possible to set up plausible deniability, but with LUKS that takes extra steps, and I assumed the same was true of other disk encryption schemes.

by bccdee 5y ago

DistressedDrone 5y ago

> (b) they'd know you'd done it. That depends entirely on how exactly you do it. And knowing something and being able to prove it are two very different things.

philipov 5y ago
It's fine, just have the legislature pass a Bill of Attainder that declares the thing you know is a proven fact, and you're peachy. It worked great in the Trial of Thomas Wentworth.

tablespoon 5y ago

> Better just to buy a bunch of USB sticks, wipe 'em all with random noise, use a couple for mundane files, and use a couple for sensitive files — deniably encrypted so as to look like random noise. Then, you can plausibly deny that they contain any sensitive files. You're creating a situation where you have a set of encrypted and non-encrypted devices that are indistinguishable, and expecting the police to let you off. But there's nothing stopping someone with only encrypted devices to claim the same thing. I'd be worried that approach would fail either by 1) the police calling your bluff, or 2) indefinitely holding you in jail for contempt of court until you decrypt a drive that has un-decryptable random data.

dorgo 5y ago
Eventually it will become illigal to have randomly generated data stored somewhere.
bccdee 5y ago
An unreasonable adversary, such as a terrorist group or something, could plausibly do that. But the legal system has things like the "beyond reasonable doubt" standard of guilt. If the court finds encryption headers on your disk, they've got evidence beyond reasonable doubt that there's encrypted data on it. If there's only noise, it's totally plausible that it's just a spare usb stick, especially if you consistently wipe your unused disks and don't just have one conspicuous disk full of noise.
- brokenmachine 5y ago
  >If the court finds encryption headers on your disk Encryption with plausible deniability will not have readable headers. It will appear to be completely random data.
  - bccdee 5y ago
    Yeah, that's my point. A proper plausibly-deniable system will be indistinguishable from a disk which has been wiped, to the point that no court can reasonably accuse you of hiding files on it.

dTal 5y ago

>you can plausibly deny that they contain any sensitive files. "Don't worry about my large collection of seemingly encrypted USB sticks officer, it's actually just random noise I filled them with for the lulz! No sensitive files here." I see no flaws with this plan.

bccdee 5y ago
"Yeah, when I'm done with a USB stick I wipe it with random noise, so that I know that the data I'm finished with is properly deleted." Usually when you encrypt a drive there's a telltale header, so the disks wouldn't be "seemingly encrypted" at all — and wiping disks clean with noise isn't especially uncommon. It's as plausibly-deniable as it gets, and it'd certainly fly in court.
- brokenmachine 5y ago
  >Usually when you encrypt a drive there's a telltale header Not necessarily. https://www.truecrypt71a.com/documentation/plausible-deniability/ https://www.truecrypt71a.com/documentation/plausible-deniabi... 2. Until decrypted, a TrueCrypt partition/device appears to consist of nothing more than random data (it does not contain any kind of “signature”).
  - bccdee 5y ago
    Huh — I was unaware that TrueCrypt has plausible deniability by default. I know it's possible to set up plausible deniability, but with LUKS that takes extra steps, and I assumed the same was true of other disk encryption schemes.