5 ms·

So you're saying if I'm held at gunpoint or forced to surrender my password at the US airport that a password to clear my account of anything would be useless?

So you're saying if I'm held at gunpoint or forced to surrender my password at the US airport that a password to clear my account of anything would be useless? Neither of them know anything about me. It reminds me of the Trezor hardware wallet that allows you to have multiple passwords into your account. If your forced to give access you can log into the version with little in it. Nobody knows that you have secondary accounts with more in it...

jeroenhd 5y ago
If you're held under gunpoint, that script that wipes your entire hard drive will only make your day worse. AFAIK if you actually get detained and questioned at airports, your drive will already get imaged before any password is even tried. You may be able to get away with this on a mobile device where this feature isn't generally expected (because who uses Linux on a smartphone in the first place). I always wonder at what scenarios like these are supposed to be about. If saying no is not an option, pissing off your captors by giving them fake info probably isn't either. I don't know what law enforcement would be looking for on my work drive, but if saying no is no longer an option, my encryption password isn't worth getting shot over.
- varjag 5y ago
  It doesn't have to wipe your drive, just do reasonable things like kill your sensitive messenger accounts and clean up the history.
- shawnz 5y ago
  What does it matter if your drive is imaged if you are using full disk encryption?
  - dailyanchovy 5y ago
    They can try their luck again at having you give access.
    - shawnz 5y ago
      The duress login shouldn't reveal that anything is happening, so they have no reason to suspect you're using such a feature at all. Thus there would be no reason to ask you to log in again, and even if they do, you can simply use the duress credentials a second time.
      - eurasiantiger 5y ago
        If they can monitor network connections, they can see the duress connections, too.
        shawnz 5y ago
        You don't need to make it take any network actions, but even if you wanted to do that you could just use TLS. It would easily blend in with all the other services that use TLS as part of their normal operation.
        o-__-o 5y ago
        https://serverfault.com/questions/574405/tcpdump-server-hello-certificate-filter https://serverfault.com/questions/574405/tcpdump-server-hell...
        shawnz 5y ago
        Won't be possible with ESNI, and regardless you could just use an inconspicuous domain name, for example by piggybacking on a common cloud service.
  - dredmorbius 5y ago
    https://xkcd.com/538/ https://xkcd.com/538/
    - shawnz 5y ago
      The duress credentials are exactly how you avoid the "pipe wrench" scenario. The point of the FDE in that case is simply to prevent them from looking on the disk without your supervision.
      - dredmorbius 5y ago
        The duress credentials keep the pipe wrench from being useful. They don't keep it from being applied.
        shawnz 5y ago
        If the pipe wrench is getting applied regardless, that's a much different situation. In that case you could simply not comply at all. The duress credentials are meant to create plausible deniability of non-compliance, by giving the appearance of a genuine login which just reveals nothing.
        dredmorbius 5y ago
        Understood and agreed. This depends heavily on what the investigator expects to find. If the duress key removes information known to be present ... out comes the wrench. Or you could just be dealing with someone who DGAF. This ultimately seems to be a chief characteristic of many situations in which strong crypto is proposed. It's the breakdown of civil liberties, rights, and rule of law which might be the true ur-problem here.
        dredmorbius 5y ago
        Revisiting: Keep in mind that the duress credentials serve several purposes. 1. Give the appearance of compliance. It's possible that the investigator will be satisfied and abandon further search attempts. Wrench averted. 2. Provide the opportunity to perform a duress action, without the immediate appearance of doing so. This has a wide range of possibilities, including removing or disabling access to information, triggering warnings or notices to allies or supporters, revealing innocuous content, enabling a set of additional countermeasures (e.g., attacks from within the investigator's own space or network, or against the investigator's own tools, see Signal's response to Celebrite: https://signal.org/blog/cellebrite-vulnerabilities/ https://signal.org/blog/cellebrite-vulnerabilities/). Note that a protocol which denies the investigation subject access to a device would prevent this. The presumption that a subject would provide an access password provides opportunity for defences. Whether or not the pipe wrench (or any analogous or equivalent means of coercion) is applied is almost a moot point. With a duress password, you're largely assuming it will be. The objective isn't to prevent the wrench. It's to render it ineffective. Or at least that's the way I read it.
  - nudpiedo 5y ago
    If the attack is in hot the data is unencrypted, so getting the login password will (usually) also give access to the unencrypted disk (already mounted)
    - deleted 5y ago
      [deleted]
- TeeMassive 5y ago
  > If you're held under gunpoint, that script that wipes your entire hard drive will only make your day worse. Then I'll just use a script that doesn't make it look like I deleted everything.
- nudpiedo 5y ago
  Why not honeypot into a docker with fake data? Everyone would be happy (during a first moment). Sure if the attacks t is well informed then they will double check whether the target they got in is real or not.
  - ljm 5y ago
    "Okay okay! The password is hunter2, go on and try it, just don't shoot me!" Bad guy types in honeypot password A new update to Docker is available. Restart now to apply the update or subscribe to a Pro account to delay this update. "Oh, bugger."
    - nudpiedo 5y ago
      Sorry, my bad for assuming a system admin has enough reasoning capacity to avoid dumb mistakes.
- Spooky23 5y ago
  It’s silly nerd porn. The “real” problem is either: (a) You know the authorities want access to your data because <x>, and you travel across a border with it. (b) You possess sensitive information and are not aware of law enforcement’s desire to get it; (c) You’re swept up at random; (d) You’re a criminal, or carry a paper trail of potential illegal activity. Solutions: (a) Means you are stupid. The only way to win is not to play. (b) Means you either didn’t follow your employer’s security guidelines or aren’t aware of the risks associated with whatever is on your device. You can’t solve that problem without understanding that. (c) You should use discretion re: what you cross a border with and either accept the risk or do something else. (d) Don’t really care. See (a).
  - AussieWog93 5y ago
    (e) You are a whistleblower who doesn't want to be dragged off to a military prison and tortured
    - Sebb767 5y ago
      Which is the same as (a). Either have an USB stick with plausibly-deniable encryption or, better yet, store the data somewhere online (in encrypted form, of course) and download it once you crossed the border. There is no reason to have it readily available on your laptop.
  - drvdevd 5y ago
    I think the focus on Law Enforcement as the sole source of duress is no longer correct. Just as one example, we now live in an era where any entry point to a corporate network can equal millions or billions in eventual ransom payouts, right? As endpoint security mitigations improve, duress will not just be a silly nerd porn, and will probably not be limited to "high level" people, either.
- mschuster91 5y ago
  > AFAIK if you actually get detained and questioned at airports, your drive will already get imaged before any password is even tried. Good luck doing that on 2016ff MacBook Pro's (they all have soldered storage) or any Windows 10 laptop with TPM-backed Bitlocker encryption.
tedunangst 5y ago
Without knowing what your captor already knows about your device, deleting data they may expect to find is a pretty high risk gambit.
- Sebb767 5y ago
  If you think that them finding your data is the better option, you can always revert to using your normal login credentials.

jeroenhd 5y ago

If you're held under gunpoint, that script that wipes your entire hard drive will only make your day worse. AFAIK if you actually get detained and questioned at airports, your drive will already get imaged before any password is even tried. You may be able to get away with this on a mobile device where this feature isn't generally expected (because who uses Linux on a smartphone in the first place). I always wonder at what scenarios like these are supposed to be about. If saying no is not an option, pissing off your captors by giving them fake info probably isn't either. I don't know what law enforcement would be looking for on my work drive, but if saying no is no longer an option, my encryption password isn't worth getting shot over.

varjag 5y ago
It doesn't have to wipe your drive, just do reasonable things like kill your sensitive messenger accounts and clean up the history.
shawnz 5y ago
What does it matter if your drive is imaged if you are using full disk encryption?
- dailyanchovy 5y ago
  They can try their luck again at having you give access.
  - shawnz 5y ago
    The duress login shouldn't reveal that anything is happening, so they have no reason to suspect you're using such a feature at all. Thus there would be no reason to ask you to log in again, and even if they do, you can simply use the duress credentials a second time.
    - eurasiantiger 5y ago
      If they can monitor network connections, they can see the duress connections, too.
      - shawnz 5y ago
        You don't need to make it take any network actions, but even if you wanted to do that you could just use TLS. It would easily blend in with all the other services that use TLS as part of their normal operation.
        o-__-o 5y ago
        https://serverfault.com/questions/574405/tcpdump-server-hello-certificate-filter https://serverfault.com/questions/574405/tcpdump-server-hell...
        shawnz 5y ago
        Won't be possible with ESNI, and regardless you could just use an inconspicuous domain name, for example by piggybacking on a common cloud service.
- dredmorbius 5y ago
  https://xkcd.com/538/ https://xkcd.com/538/
  - shawnz 5y ago
    The duress credentials are exactly how you avoid the "pipe wrench" scenario. The point of the FDE in that case is simply to prevent them from looking on the disk without your supervision.
    - dredmorbius 5y ago
      The duress credentials keep the pipe wrench from being useful. They don't keep it from being applied.
      - shawnz 5y ago
        If the pipe wrench is getting applied regardless, that's a much different situation. In that case you could simply not comply at all. The duress credentials are meant to create plausible deniability of non-compliance, by giving the appearance of a genuine login which just reveals nothing.
        dredmorbius 5y ago
        Understood and agreed. This depends heavily on what the investigator expects to find. If the duress key removes information known to be present ... out comes the wrench. Or you could just be dealing with someone who DGAF. This ultimately seems to be a chief characteristic of many situations in which strong crypto is proposed. It's the breakdown of civil liberties, rights, and rule of law which might be the true ur-problem here.
        dredmorbius 5y ago
        Revisiting: Keep in mind that the duress credentials serve several purposes. 1. Give the appearance of compliance. It's possible that the investigator will be satisfied and abandon further search attempts. Wrench averted. 2. Provide the opportunity to perform a duress action, without the immediate appearance of doing so. This has a wide range of possibilities, including removing or disabling access to information, triggering warnings or notices to allies or supporters, revealing innocuous content, enabling a set of additional countermeasures (e.g., attacks from within the investigator's own space or network, or against the investigator's own tools, see Signal's response to Celebrite: https://signal.org/blog/cellebrite-vulnerabilities/ https://signal.org/blog/cellebrite-vulnerabilities/). Note that a protocol which denies the investigation subject access to a device would prevent this. The presumption that a subject would provide an access password provides opportunity for defences. Whether or not the pipe wrench (or any analogous or equivalent means of coercion) is applied is almost a moot point. With a duress password, you're largely assuming it will be. The objective isn't to prevent the wrench. It's to render it ineffective. Or at least that's the way I read it.
- nudpiedo 5y ago
  If the attack is in hot the data is unencrypted, so getting the login password will (usually) also give access to the unencrypted disk (already mounted)
  - deleted 5y ago
    [deleted]
TeeMassive 5y ago
> If you're held under gunpoint, that script that wipes your entire hard drive will only make your day worse. Then I'll just use a script that doesn't make it look like I deleted everything.
nudpiedo 5y ago
Why not honeypot into a docker with fake data? Everyone would be happy (during a first moment). Sure if the attacks t is well informed then they will double check whether the target they got in is real or not.
- ljm 5y ago
  "Okay okay! The password is hunter2, go on and try it, just don't shoot me!" Bad guy types in honeypot password A new update to Docker is available. Restart now to apply the update or subscribe to a Pro account to delay this update. "Oh, bugger."
  - nudpiedo 5y ago
    Sorry, my bad for assuming a system admin has enough reasoning capacity to avoid dumb mistakes.
Spooky23 5y ago
It’s silly nerd porn. The “real” problem is either: (a) You know the authorities want access to your data because <x>, and you travel across a border with it. (b) You possess sensitive information and are not aware of law enforcement’s desire to get it; (c) You’re swept up at random; (d) You’re a criminal, or carry a paper trail of potential illegal activity. Solutions: (a) Means you are stupid. The only way to win is not to play. (b) Means you either didn’t follow your employer’s security guidelines or aren’t aware of the risks associated with whatever is on your device. You can’t solve that problem without understanding that. (c) You should use discretion re: what you cross a border with and either accept the risk or do something else. (d) Don’t really care. See (a).
- AussieWog93 5y ago
  (e) You are a whistleblower who doesn't want to be dragged off to a military prison and tortured
  - Sebb767 5y ago
    Which is the same as (a). Either have an USB stick with plausibly-deniable encryption or, better yet, store the data somewhere online (in encrypted form, of course) and download it once you crossed the border. There is no reason to have it readily available on your laptop.
- drvdevd 5y ago
  I think the focus on Law Enforcement as the sole source of duress is no longer correct. Just as one example, we now live in an era where any entry point to a corporate network can equal millions or billions in eventual ransom payouts, right? As endpoint security mitigations improve, duress will not just be a silly nerd porn, and will probably not be limited to "high level" people, either.
mschuster91 5y ago
> AFAIK if you actually get detained and questioned at airports, your drive will already get imaged before any password is even tried. Good luck doing that on 2016ff MacBook Pro's (they all have soldered storage) or any Windows 10 laptop with TPM-backed Bitlocker encryption.

tedunangst 5y ago

Without knowing what your captor already knows about your device, deleting data they may expect to find is a pretty high risk gambit.

Sebb767 5y ago
If you think that them finding your data is the better option, you can always revert to using your normal login credentials.