9 ms·

Comments are full of gunpoint scenarios, but I think a far more likely scenario for most HN readers is law enforcement / customs agents asking you to unlock you

by yosito 5y ago

Comments are full of gunpoint scenarios, but I think a far more likely scenario for most HN readers is law enforcement / customs agents asking you to unlock your device during travel or some other random checkpoint so they can scan it. In that case, I doubt the officer would even have a clue about the use of a duress password to selectively and silently delete some private data. I think the biggest risk would be that a scan of your device could detect the PAM config and duress script which could be a flag to monitor you more closely, or might possibly be considered illegal itself in some jurisdictions.

leephillips 5y ago
That is a gunpoint scenario.
Spooky23 5y ago
In the US, at minimum you’re lying to a federal agent. Never a good idea.
- yosito 5y ago
  I don't know the legal implications, but if the duress password unlocks your device and simply deletes a directory or two, and the officer only asked you to unlock your device (without a warrant, by the way), how is that lying?
  - hirundo 5y ago
    Even if it isn't lying, it's destruction of evidence. 18 U.S. Code 1519: > Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.
    - yosito 5y ago
      Would that apply to a warrantless search?
      - salawat 5y ago
        Yes. Sadly.
    - Aeolun 5y ago
      > investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States I mean, you’re not seeking to obstruct anything other than a federal agent looking at your personal pictures, which they explicitly do not need to fulfill their duty. Now if you were removing evidence of your crimes. Anyway, I know it doesn’t work that way, but I think it should.
    - R0b0t1 5y ago
      Not clear. You can argue you were afraid for your life or property in the case you did not expect the agent or courts to react reasonably to the now-concealed information. As well, they would need to prove you concealed or destroyed information. Similar case law exists in this context, but for actions like running from the police.
      - o-__-o 5y ago
        Do not do this unless you have strict guidance from a lawyer immediately before this happens. One small mistake could open you up to criminal liability and a world of hurt. Better to just plan ahead, bring a burner phone and show the photos to the agent when asked. IANAL but play one on tv
        deleted 5y ago
        [deleted]
        R0b0t1 5y ago
        Are you insane? Going along with the courts is usually not in your best interests. Hiding the evidence and never going to trial certainly is. If we are talking about information that you definitely need to hide then the penalty for your obstruction of justice, whatever its form, will be a rounding error on your sentence. If it does not definitely need to be hidden then should they find out they are unlikely to charge you. An attorney will tell you what is legal. An excellent attorney will tell you what you can get away with. Strong language I know, but prisons are full of innocent people.
  - Spooky23 5y ago
    Despite rumors to the contrary, the police aren’t stupid. They are trained to ask questions in ways that elicit a confession or falsehood. The simplest example is asking “Do you know why I pulled you over?”. Typically, people spontaneously confess to speeding, sometimes they break down and admit that someone is wrapped up in a rug in the trunk. The courts have consistently ruled that customs is different and you can be searched without a warrant. Don’t cross borders with contraband or evidence of criminal acts/dissident identity/your email correspondence with foreign agents/etc.
    - isatty 5y ago
      Time to post this again: https://www.youtube.com/watch?v=d-7o9xYp7eE https://www.youtube.com/watch?v=d-7o9xYp7eE (Don't talk to the police)
      - Sebb767 5y ago
        Customs is different in two crucial points: 1. The probability of your being in a stressful situation without the option to leave is high - you probably arrived via plane, so you can't simply go back, and you don't know the local laws well. 2. You usually know that a customs checkpoint is upcoming. So, in that case, it's far better to prepare (i.e. don't bring things you don't want searched/compromised) and cooperate.
        deleted 5y ago
        [deleted]
        wildfire 5y ago
        Indeed. I was once "detained" whilst going from France to England while the customs official searched my bag. I complained to the UK immigration and the same customs officier called me back, searched my bag again, and said "unless you agree to withdraw your complaint, we are going to have to continue searching your bag until the train departs and you miss it". i.e. costing me about £150 in expenses. As expected, I withdraw it and went on my way. However I now make a point to record the name / number of custom officials I make a complaint to -- in case they turn out to be jerks like the UK one was.
muti 5y ago
"You could even spawn a process to remove the pam_duress module so the threat actor won't be able to see if the duress module was available" This scenario was considered by the author
- yosito 5y ago
  Ah, thanks! I didn't read closely enough.
- Nextgrid 5y ago
  Technically you'd also need to rewrite the logs in a plausible manner (removing the mentions of the PAM module and potentially replacing it with their "normal" equivalents) and depending on your threat model, actually securely erase the files so that disk recovery software can't later restore the deleted files.
  - Sebb767 5y ago
    If your threat model is someone that will even invest the time to sift through your logs, it might be wise to disable (persistent) logging in the first place.
nullc 5y ago
On linux distros, at least before wayland, it was easy to make your account hidden from the gdm chooser (e.g. by putting it in a different group). Then you could setup a dummy account that doesn't have too much of interest in it. Combined with pam crypto to encrypt your home on login, the result is something that is reasonably private against casual inspection. I used to use this back when I couldn't afford to travel with a disposable use laptop...
- o-__-o 5y ago
  > Forensics agent pulls and mounts hard drive > Agent sees /home/hiddenuser > Government seeks search warrant for content > DA demonstrates recent knowledge/use of /home/hiddenuser > Judge holds you in contempt until you provide encryption keys
  - nullc 5y ago
    No basis for such a warrant for some US citizen entering the country. No such case has ever occurred, at least at the time when I received legal advice on the subject. Consider the alternative: You're not worse off than you would be if you didn't hide it. Hiding your login is a good security practice against all kinds of potential coercion.
  - jc01480 5y ago
    Forgetting the keys is established as protected speech under 1A. Don’t have the case handy atm. Fairly new. Knowing the keys and intentionally withholding them has yet to be established either way. But there will be a case soon enough. Funny thing about law is that both sides (prosec. & defense) often don’t want many things clarified further because they usually have far-reaching impacts to parallel legal issues. Roe v Wade is a perfect example.
  - atoav 5y ago
    > Forensics agent pulls and mounts hard drive Is this what the typical airport threat scenario looks like? How do they do this with soldered in drives? > Agent sees /home/hiddenuser Or they see nothing, because your drive is encrypted. They come to ask you for the key, you comply they see $blandaccount with some seemingly important company data and a scary corporate message as the desktop background (as justification why there is even encryption). Bonus points if you complain about it yourself ("If you ask me all of this is a bit paranoid"). Afterwards you use the real key and see $realaccount, because you thought about plausible deniability and how to use it propperly – if you still trust the integrity of your device, that is.
BLKNSLVR 5y ago
A factory reset phone is a travel-friendly phone. That's what I did last time I traveled... an increasingly depressingly long time ago. Probably good practice to take a phone from 'scratch' to 'setup' regularly anyway. Like restoring backups.

by yosito 5y ago

leephillips 5y ago

That is a gunpoint scenario.

Spooky23 5y ago

In the US, at minimum you’re lying to a federal agent. Never a good idea.

yosito 5y ago
I don't know the legal implications, but if the duress password unlocks your device and simply deletes a directory or two, and the officer only asked you to unlock your device (without a warrant, by the way), how is that lying?
- hirundo 5y ago
  Even if it isn't lying, it's destruction of evidence. 18 U.S. Code 1519: > Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.
  - yosito 5y ago
    Would that apply to a warrantless search?
    - salawat 5y ago
      Yes. Sadly.
  - Aeolun 5y ago
    > investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States I mean, you’re not seeking to obstruct anything other than a federal agent looking at your personal pictures, which they explicitly do not need to fulfill their duty. Now if you were removing evidence of your crimes. Anyway, I know it doesn’t work that way, but I think it should.
  - R0b0t1 5y ago
    Not clear. You can argue you were afraid for your life or property in the case you did not expect the agent or courts to react reasonably to the now-concealed information. As well, they would need to prove you concealed or destroyed information. Similar case law exists in this context, but for actions like running from the police.
    - o-__-o 5y ago
      Do not do this unless you have strict guidance from a lawyer immediately before this happens. One small mistake could open you up to criminal liability and a world of hurt. Better to just plan ahead, bring a burner phone and show the photos to the agent when asked. IANAL but play one on tv
      - deleted 5y ago
        [deleted]
      - R0b0t1 5y ago
        Are you insane? Going along with the courts is usually not in your best interests. Hiding the evidence and never going to trial certainly is. If we are talking about information that you definitely need to hide then the penalty for your obstruction of justice, whatever its form, will be a rounding error on your sentence. If it does not definitely need to be hidden then should they find out they are unlikely to charge you. An attorney will tell you what is legal. An excellent attorney will tell you what you can get away with. Strong language I know, but prisons are full of innocent people.
- Spooky23 5y ago
  Despite rumors to the contrary, the police aren’t stupid. They are trained to ask questions in ways that elicit a confession or falsehood. The simplest example is asking “Do you know why I pulled you over?”. Typically, people spontaneously confess to speeding, sometimes they break down and admit that someone is wrapped up in a rug in the trunk. The courts have consistently ruled that customs is different and you can be searched without a warrant. Don’t cross borders with contraband or evidence of criminal acts/dissident identity/your email correspondence with foreign agents/etc.
  - isatty 5y ago
    Time to post this again: https://www.youtube.com/watch?v=d-7o9xYp7eE https://www.youtube.com/watch?v=d-7o9xYp7eE (Don't talk to the police)
    - Sebb767 5y ago
      Customs is different in two crucial points: 1. The probability of your being in a stressful situation without the option to leave is high - you probably arrived via plane, so you can't simply go back, and you don't know the local laws well. 2. You usually know that a customs checkpoint is upcoming. So, in that case, it's far better to prepare (i.e. don't bring things you don't want searched/compromised) and cooperate.
      - deleted 5y ago
        [deleted]
      - wildfire 5y ago
        Indeed. I was once "detained" whilst going from France to England while the customs official searched my bag. I complained to the UK immigration and the same customs officier called me back, searched my bag again, and said "unless you agree to withdraw your complaint, we are going to have to continue searching your bag until the train departs and you miss it". i.e. costing me about £150 in expenses. As expected, I withdraw it and went on my way. However I now make a point to record the name / number of custom officials I make a complaint to -- in case they turn out to be jerks like the UK one was.

muti 5y ago

"You could even spawn a process to remove the pam_duress module so the threat actor won't be able to see if the duress module was available" This scenario was considered by the author

yosito 5y ago
Ah, thanks! I didn't read closely enough.
Nextgrid 5y ago
Technically you'd also need to rewrite the logs in a plausible manner (removing the mentions of the PAM module and potentially replacing it with their "normal" equivalents) and depending on your threat model, actually securely erase the files so that disk recovery software can't later restore the deleted files.
- Sebb767 5y ago
  If your threat model is someone that will even invest the time to sift through your logs, it might be wise to disable (persistent) logging in the first place.

nullc 5y ago

On linux distros, at least before wayland, it was easy to make your account hidden from the gdm chooser (e.g. by putting it in a different group). Then you could setup a dummy account that doesn't have too much of interest in it. Combined with pam crypto to encrypt your home on login, the result is something that is reasonably private against casual inspection. I used to use this back when I couldn't afford to travel with a disposable use laptop...

o-__-o 5y ago
> Forensics agent pulls and mounts hard drive > Agent sees /home/hiddenuser > Government seeks search warrant for content > DA demonstrates recent knowledge/use of /home/hiddenuser > Judge holds you in contempt until you provide encryption keys
- nullc 5y ago
  No basis for such a warrant for some US citizen entering the country. No such case has ever occurred, at least at the time when I received legal advice on the subject. Consider the alternative: You're not worse off than you would be if you didn't hide it. Hiding your login is a good security practice against all kinds of potential coercion.
- jc01480 5y ago
  Forgetting the keys is established as protected speech under 1A. Don’t have the case handy atm. Fairly new. Knowing the keys and intentionally withholding them has yet to be established either way. But there will be a case soon enough. Funny thing about law is that both sides (prosec. & defense) often don’t want many things clarified further because they usually have far-reaching impacts to parallel legal issues. Roe v Wade is a perfect example.
- atoav 5y ago
  > Forensics agent pulls and mounts hard drive Is this what the typical airport threat scenario looks like? How do they do this with soldered in drives? > Agent sees /home/hiddenuser Or they see nothing, because your drive is encrypted. They come to ask you for the key, you comply they see $blandaccount with some seemingly important company data and a scary corporate message as the desktop background (as justification why there is even encryption). Bonus points if you complain about it yourself ("If you ask me all of this is a bit paranoid"). Afterwards you use the real key and see $realaccount, because you thought about plausible deniability and how to use it propperly – if you still trust the integrity of your device, that is.

BLKNSLVR 5y ago

A factory reset phone is a travel-friendly phone. That's what I did last time I traveled... an increasingly depressingly long time ago. Probably good practice to take a phone from 'scratch' to 'setup' regularly anyway. Like restoring backups.