3 ms·
Bad for you, because no one with a wrench would believe you. Here's a thought experiment: You are a hacker with a 100% (to your knowledge) secure notebook full
by choeger 5y ago
Bad for you, because no one with a wrench would believe you.
Here's a thought experiment: You are a hacker with a 100% (to your knowledge) secure notebook full of company secrets. I am an attacker and I have your son/daughter as a hostage. I am asking you to unlock that laptop for me in exchange for your kid. What do you do?
Do you really trust your failsafes enough to risk the life of your own kid? Or do you just unlock the goddamn notebook for me?
- prox 5y agoHow about a fake unlock (like a secondary password) that only partially unlocks an account or spoofs it with bogus intel.
- tyingq 5y agoVeracrypt hidden volumes look like a nice implementation of that: https://veracrypt.eu/en/docs/hidden-volume/ https://veracrypt.eu/en/docs/hidden-volume/
- Rooki 5y agoSurely there are very few situations where it would be worth gambling your children's life over some data. Perhaps if there were many other lives at stake but even then...
- tgsovlerkhgsel 5y agoThe author acknowledges that in the last sentence.
- derefr 5y ago> Do you really trust your failsafes enough to risk the life of your own kid? I mean, the right way to do it is with a precommitment to preventatively destroying the thing the attacker wants from you, via some kind of dead-man's-switch. You don't let your future self make the decision of whether to give up your secrets; your hypothetical future self is under duress. Your present self is not, and therefore knows better. Of course, they still probably won't believe you that the secret is destroyed with no backup. But now you actually have no option to cooperate with them, so at least you're off the hook for the moral responsibility of whether the hostages live or not any more. The only ones that can make a decision that will causally influence whether the hostages live or die, at that point, are the hostage-takers.
- hosh 5y agoAnd some of those attackers will just off at least one of the hostage anyways as an object lesson, as a way to "motivate" you. That kind of dead-man-letter defense is a deterrent that relies on the attacker's ability to assess that the information can be destroyed, before going through the trouble of coming after you. If they are unable to assess it, or their intelligence is wrong, or you never let it wildly known that there is a dead-man-letter, once hostages are taken, you're still in that situation. Even if you don't consider it as your moral responsibility, it won't bring dead people back to life. The cost is still the same. And if you survive, the trauma will still be there.
- derefr 5y agoI didn't say it would do anything to discourage bad actors from kidnapping those you care about. Just that it's a lot less stressful to be in an interrogation situation, when there's nothing you actually need to be using your willpower to resist doing. (Instead, it's just Kafkaesque.)
- EGreg 5y agoWhy would anyone believe they will let people go when you do what they say? Because “bad man made promise”? LMAO I mean at that point, you are better off acting insane.
- TedDoesntTalk 5y agoRansomware actors seem to deliver when paid. Honor among thieves.
- ALittleLight 5y agoMy present self wouldn't risk my children for my secrets either. If villains have my children I'm willing to trade my secrets to get them back. The villains and I can settle up once the kids are safe.