4 ms·

Using #3 could land you in jail indefinitely in the UK I believe: if they don’t believe you forgot the password, they can interpret that as a refusal to give th

Using #3 could land you in jail indefinitely in the UK I believe: if they don’t believe you forgot the password, they can interpret that as a refusal to give them the password (or unlock the computer), and jail you for this… until you give them the password. Which you can’t, because there is no password at this point. So either you admit that you just wiped your computer with the panic password, or you can shut up and rot in jail until you die. You need a way to make them believe you. Covertly wiping your computer is probably not going to end well.

jrockway 5y ago
Depends on the crime, I guess. If you face execution for murder or treason because of the data on your hard drive, life in prison is an upgrade.
- akerl_ 5y ago
  This is why I don’t keep evidence of committing murder/treason on my computer.
  - dredmorbius 5y ago
    Evidentiary tests may change.
drexlspivey 5y ago
So in the UK they can put you in prison for life without being charged or found guilty of any crime unless “they believe you”? Any source on that?
- macintux 5y ago
  A story from the US: https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont-decrypt-hard-drives-jailed-indefinitely/ https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont...
- zelse 5y ago
  It's a theoretical thing under the Regulation of Investigatory Powers Act, IIR. It hasn't been tested. In practice under the law it'd probably be a stretch under a sensible judiciary since you can't prove a negative and thus can't prove you don't know something. In a number of countries there is a defined offense, like in Australia if they don't believe you they can jail you for six months under the Cybercrime Act, 2001, or possibly 2 years (failure to obey a court order under the Crimes Act, 1914).
nuvious 5y ago
Author here; #3 also defies the use-case for a duress word. The attacker is supposed to be presented with what appears to be a normal login scenario while in the background sensitive data is being scrubbed or even have the routines remove the pam-duress module completely so there's no evidence there was a duress routine in place. Real law enforcement agencies would also simply confiscate the device and hand it to a forensic team to pull a "golden image" from it to work with in lieu of a user session.

jrockway 5y ago

Depends on the crime, I guess. If you face execution for murder or treason because of the data on your hard drive, life in prison is an upgrade.

akerl_ 5y ago
This is why I don’t keep evidence of committing murder/treason on my computer.
- dredmorbius 5y ago
  Evidentiary tests may change.

drexlspivey 5y ago

So in the UK they can put you in prison for life without being charged or found guilty of any crime unless “they believe you”? Any source on that?

macintux 5y ago
A story from the US: https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont-decrypt-hard-drives-jailed-indefinitely/ https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont...
zelse 5y ago
It's a theoretical thing under the Regulation of Investigatory Powers Act, IIR. It hasn't been tested. In practice under the law it'd probably be a stretch under a sensible judiciary since you can't prove a negative and thus can't prove you don't know something. In a number of countries there is a defined offense, like in Australia if they don't believe you they can jail you for six months under the Cybercrime Act, 2001, or possibly 2 years (failure to obey a court order under the Crimes Act, 1914).

nuvious 5y ago

Author here; #3 also defies the use-case for a duress word. The attacker is supposed to be presented with what appears to be a normal login scenario while in the background sensitive data is being scrubbed or even have the routines remove the pam-duress module completely so there's no evidence there was a duress routine in place. Real law enforcement agencies would also simply confiscate the device and hand it to a forensic team to pull a "golden image" from it to work with in lieu of a user session.