4 ms·

You could set this up with three possible passwords, #1 for normal login, #2 for what looks like normal login but deletes most sensitive things and #3 that wipe

You could set this up with three possible passwords, #1 for normal login, #2 for what looks like normal login but deletes most sensitive things and #3 that wipes the disk encryption keys and reboots. If forced by criminals or a not so free government enter #2 and pretend everything is normal. If pressured by the US or EU government with your lawyer present enter #3, see it fail and claim you forgot the encryption keys to make it boot (which is technically true, just never admit you made it delete them since that's illegal in most places)

loup-vaillant 5y ago
Using #3 could land you in jail indefinitely in the UK I believe: if they don’t believe you forgot the password, they can interpret that as a refusal to give them the password (or unlock the computer), and jail you for this… until you give them the password. Which you can’t, because there is no password at this point. So either you admit that you just wiped your computer with the panic password, or you can shut up and rot in jail until you die. You need a way to make them believe you. Covertly wiping your computer is probably not going to end well.
- jrockway 5y ago
  Depends on the crime, I guess. If you face execution for murder or treason because of the data on your hard drive, life in prison is an upgrade.
  - akerl_ 5y ago
    This is why I don’t keep evidence of committing murder/treason on my computer.
    - dredmorbius 5y ago
      Evidentiary tests may change.
- drexlspivey 5y ago
  So in the UK they can put you in prison for life without being charged or found guilty of any crime unless “they believe you”? Any source on that?
  - macintux 5y ago
    A story from the US: https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont-decrypt-hard-drives-jailed-indefinitely/ https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont...
  - zelse 5y ago
    It's a theoretical thing under the Regulation of Investigatory Powers Act, IIR. It hasn't been tested. In practice under the law it'd probably be a stretch under a sensible judiciary since you can't prove a negative and thus can't prove you don't know something. In a number of countries there is a defined offense, like in Australia if they don't believe you they can jail you for six months under the Cybercrime Act, 2001, or possibly 2 years (failure to obey a court order under the Crimes Act, 1914).
- nuvious 5y ago
  Author here; #3 also defies the use-case for a duress word. The attacker is supposed to be presented with what appears to be a normal login scenario while in the background sensitive data is being scrubbed or even have the routines remove the pam-duress module completely so there's no evidence there was a duress routine in place. Real law enforcement agencies would also simply confiscate the device and hand it to a forensic team to pull a "golden image" from it to work with in lieu of a user session.

loup-vaillant 5y ago

Using #3 could land you in jail indefinitely in the UK I believe: if they don’t believe you forgot the password, they can interpret that as a refusal to give them the password (or unlock the computer), and jail you for this… until you give them the password. Which you can’t, because there is no password at this point. So either you admit that you just wiped your computer with the panic password, or you can shut up and rot in jail until you die. You need a way to make them believe you. Covertly wiping your computer is probably not going to end well.

jrockway 5y ago
Depends on the crime, I guess. If you face execution for murder or treason because of the data on your hard drive, life in prison is an upgrade.
- akerl_ 5y ago
  This is why I don’t keep evidence of committing murder/treason on my computer.
  - dredmorbius 5y ago
    Evidentiary tests may change.
drexlspivey 5y ago
So in the UK they can put you in prison for life without being charged or found guilty of any crime unless “they believe you”? Any source on that?
- macintux 5y ago
  A story from the US: https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont-decrypt-hard-drives-jailed-indefinitely/ https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont...
- zelse 5y ago
  It's a theoretical thing under the Regulation of Investigatory Powers Act, IIR. It hasn't been tested. In practice under the law it'd probably be a stretch under a sensible judiciary since you can't prove a negative and thus can't prove you don't know something. In a number of countries there is a defined offense, like in Australia if they don't believe you they can jail you for six months under the Cybercrime Act, 2001, or possibly 2 years (failure to obey a court order under the Crimes Act, 1914).
nuvious 5y ago
Author here; #3 also defies the use-case for a duress word. The attacker is supposed to be presented with what appears to be a normal login scenario while in the background sensitive data is being scrubbed or even have the routines remove the pam-duress module completely so there's no evidence there was a duress routine in place. Real law enforcement agencies would also simply confiscate the device and hand it to a forensic team to pull a "golden image" from it to work with in lieu of a user session.