5 ms·

I always thought that a lock screen with two passwords would be an interesting idea. Say the BusKill locks your system and sends a request to a server. If you d

by V__ 5y ago

I always thought that a lock screen with two passwords would be an interesting idea. Say the BusKill locks your system and sends a request to a server. If you don't enter the correct password to abort the script within a few seconds, it will run on your server, which sends a distress mail/call to emergency contacts, revoke all ssh keys/passwords etc. If however the distress password gets entered, the script still runs, but the system unlocks into a virtual pc or another account which is not suspicious.

gambiting 5y ago
Truecrypt had this exact function - one password would decrypt your drive sort of on one end, and start the OS there, another password would decrypt the drive on the other end, and start the OS installed there - so you always had perfectly plausible deniability, since the drive taken as a whole looked like a completely normal encrypted drive(in fact you could accidentally destroy the hidden partition by overwriting "empty" area while booted into the non-secret OS). Always thought that was super cool.
- kortilla 5y ago
  The only problem is this is sort of obvious from a forensics perspective. Person is using truecrypt, they boot it up for you, and the partition is only half the size it should be.
  - JadeNB 5y ago
    Your parent seems to point out that's not how it works: you've got access to the ful partition either way, meaning you can accidentally overwrite the other partition.
    - alias_neo 5y ago
      If I remember right, the hidden partitions are indistinguishable from random data on your disk and it was necessary to provide an offset to the first block (or whatever) so it could be decrypted. You could easily overwrite it accidentally because it just looks like free space.
  - gambiting 5y ago
    No, like the other reply pointed out too - it's not obvious. The first password unlocks the entire partition, the hidden one is just within the "empty" area of the drive. If you write a sufficiently large file while running the OS you could just overwrite and destroy the hidden partition without knowing that you did so. It's also impossible to tell that the hidden parition is there because encrypted data is indistinguishable from encrypted empty area of the drive.
    - ASalazarMX 5y ago
      Since Truecrypt bailed without explanation, do you know if Veracrypt also has this feature?
      - somehnguy 5y ago
        It does. Veracrypt is basically Truecrypt with some new features as far as I've been able to tell.
        mPReDiToR 5y ago
        After TC killed the project (for all intents and purposes) is there the ssme level of trust in VC?
        gambiting 5y ago
        The question always was what kind of attack are you trying to guard yourself against. I imagine top level agencies have a way to crack truecrypt/veracrypt encrypted volumes, but I also imagine they aren't using that capability against just anyone to not show their hand and risk the issue being fixed.
- Linosaurus 5y ago
  > perfectly plausible deniability The paranoid dystopian counterpart is that you cannot prove you don't have a second partition either. Might get awkward if someone decided to compel the second password on less solid evidence. If you're not actually using the feature.
  - detaro 5y ago
    There was a case here in Germany where the police report revealed that they apparently spent a lot of time looking for evidence of a hidden partition/encrypted data etc because a PC owned by single man with zero evidence of porn was unusual. (but didn't find anything in the end, and didn't claim anything they didn't have evidence for)
  - arpa 5y ago
    this is why you should actually have "signs of life" and something _slightly_ illegal on your plausible deniability partition. Just enough dirt to get you into trouble, but not too much trouble. If you're squeeky clean, you get the rubber hose cryptography treatment.
    - Someone 5y ago
      If you want those signs of life to be convincing, it should include all kinds of history without long gaps, such as: - email, including recently received and sent emails - web browser history - system logs - software updates In practice, I think it’s impossible to do that. If the police discovers, for example, that your system logs show your machine was off for a week, but they also just saw you reset it, what do you tell them?
      - gambiting 5y ago
        >>but they also just saw you reset it, what do you tell them? That you're not a computer expert and have no idea why your computer wasn't keeping logs correctly?
        5y ago
eloisius 5y ago
Have I got a PAM module for you: https://github.com/nuvious/pam-duress https://github.com/nuvious/pam-duress
- lmilcin 5y ago
  The problem is, if they are serious and suspect you might be prepared and technical savvy, they will never allow you to operate the device.
  - eloisius 5y ago
    Yep. Pretty much all nerd solutions to physical or legal threats are genius but also worse than useless. Here's a $5 hammer, hit him with it until he gives us what we're looking for, so goes the comic I saw once.
    - kortilla 5y ago
      That’s why it needs to be destructive. You can’t beat access to something out of someone if it has been deleted.
      - nkrisc 5y ago
        While true, they may beat you anyway just to be sure.
        ASalazarMX 5y ago
        Big opportunity to implement a kill-switch if the microphone recognizes your screams!
    - jamessb 5y ago
      > Here's a $5 hammer, hit him with it until he gives us what we're looking for, so goes the comic I saw once. You are probably thinking of the $5 wrench in https://xkcd.com/538/ https://xkcd.com/538/
    - 5y ago
hef19898 5y ago
Disclaimer: I know next to nothing about OS'es and login and so on. I had an idea once, would it be possible to set up two sets of passwords? One to properly unlock your device, and one to trigger either encryption or scrambling of the data when entered?
- MayeulC 5y ago
  Of course, this is a kill switch, but that's usually detectable if the attacker is sophisticated enough. Plus, they can always backup the disk before. Plausible deniability lets you pretend you do not have incriminating data, but it's tricky to use in the first place: https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyA... Travelling with an empty disk seems like a more appropriate option. Dm-verity could probably be used to check that there has been no tampering.
- ryanlol 5y ago
  Of course, but this won’t be easy with commodity hardware. Standard practice is to use write-blockers to prevent this kind of tricks, but of course you can prevent write-blockers by integrating your storage. I think you could get a pixel phone to do this in a useful way.
- nefitty 5y ago
  In software, where there's a will, there's a way. Darknet Diaries has a cool episode about the dark cellphone industry: https://darknetdiaries.com/episode/105/ https://darknetdiaries.com/episode/105/
- maltfield 5y ago
  Lookup "duress passwords" * https://en.wikipedia.org/wiki/Duress_code https://en.wikipedia.org/wiki/Duress_code The feature is more relevant in (full disk) encryption software than OSes.

by V__ 5y ago

gambiting 5y ago

Truecrypt had this exact function - one password would decrypt your drive sort of on one end, and start the OS there, another password would decrypt the drive on the other end, and start the OS installed there - so you always had perfectly plausible deniability, since the drive taken as a whole looked like a completely normal encrypted drive(in fact you could accidentally destroy the hidden partition by overwriting "empty" area while booted into the non-secret OS). Always thought that was super cool.

kortilla 5y ago
The only problem is this is sort of obvious from a forensics perspective. Person is using truecrypt, they boot it up for you, and the partition is only half the size it should be.
- JadeNB 5y ago
  Your parent seems to point out that's not how it works: you've got access to the ful partition either way, meaning you can accidentally overwrite the other partition.
  - alias_neo 5y ago
    If I remember right, the hidden partitions are indistinguishable from random data on your disk and it was necessary to provide an offset to the first block (or whatever) so it could be decrypted. You could easily overwrite it accidentally because it just looks like free space.
- gambiting 5y ago
  No, like the other reply pointed out too - it's not obvious. The first password unlocks the entire partition, the hidden one is just within the "empty" area of the drive. If you write a sufficiently large file while running the OS you could just overwrite and destroy the hidden partition without knowing that you did so. It's also impossible to tell that the hidden parition is there because encrypted data is indistinguishable from encrypted empty area of the drive.
  - ASalazarMX 5y ago
    Since Truecrypt bailed without explanation, do you know if Veracrypt also has this feature?
    - somehnguy 5y ago
      It does. Veracrypt is basically Truecrypt with some new features as far as I've been able to tell.
      - mPReDiToR 5y ago
        After TC killed the project (for all intents and purposes) is there the ssme level of trust in VC?
        gambiting 5y ago
        The question always was what kind of attack are you trying to guard yourself against. I imagine top level agencies have a way to crack truecrypt/veracrypt encrypted volumes, but I also imagine they aren't using that capability against just anyone to not show their hand and risk the issue being fixed.
Linosaurus 5y ago
> perfectly plausible deniability The paranoid dystopian counterpart is that you cannot prove you don't have a second partition either. Might get awkward if someone decided to compel the second password on less solid evidence. If you're not actually using the feature.
- detaro 5y ago
  There was a case here in Germany where the police report revealed that they apparently spent a lot of time looking for evidence of a hidden partition/encrypted data etc because a PC owned by single man with zero evidence of porn was unusual. (but didn't find anything in the end, and didn't claim anything they didn't have evidence for)
- arpa 5y ago
  this is why you should actually have "signs of life" and something _slightly_ illegal on your plausible deniability partition. Just enough dirt to get you into trouble, but not too much trouble. If you're squeeky clean, you get the rubber hose cryptography treatment.
  - Someone 5y ago
    If you want those signs of life to be convincing, it should include all kinds of history without long gaps, such as: - email, including recently received and sent emails - web browser history - system logs - software updates In practice, I think it’s impossible to do that. If the police discovers, for example, that your system logs show your machine was off for a week, but they also just saw you reset it, what do you tell them?
    - gambiting 5y ago
      >>but they also just saw you reset it, what do you tell them? That you're not a computer expert and have no idea why your computer wasn't keeping logs correctly?
      - 5y ago

eloisius 5y ago

Have I got a PAM module for you: https://github.com/nuvious/pam-duress https://github.com/nuvious/pam-duress

lmilcin 5y ago
The problem is, if they are serious and suspect you might be prepared and technical savvy, they will never allow you to operate the device.
- eloisius 5y ago
  Yep. Pretty much all nerd solutions to physical or legal threats are genius but also worse than useless. Here's a $5 hammer, hit him with it until he gives us what we're looking for, so goes the comic I saw once.
  - kortilla 5y ago
    That’s why it needs to be destructive. You can’t beat access to something out of someone if it has been deleted.
    - nkrisc 5y ago
      While true, they may beat you anyway just to be sure.
      - ASalazarMX 5y ago
        Big opportunity to implement a kill-switch if the microphone recognizes your screams!
  - jamessb 5y ago
    > Here's a $5 hammer, hit him with it until he gives us what we're looking for, so goes the comic I saw once. You are probably thinking of the $5 wrench in https://xkcd.com/538/ https://xkcd.com/538/
  - 5y ago

hef19898 5y ago

Disclaimer: I know next to nothing about OS'es and login and so on. I had an idea once, would it be possible to set up two sets of passwords? One to properly unlock your device, and one to trigger either encryption or scrambling of the data when entered?

MayeulC 5y ago
Of course, this is a kill switch, but that's usually detectable if the attacker is sophisticated enough. Plus, they can always backup the disk before. Plausible deniability lets you pretend you do not have incriminating data, but it's tricky to use in the first place: https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyA... Travelling with an empty disk seems like a more appropriate option. Dm-verity could probably be used to check that there has been no tampering.
ryanlol 5y ago
Of course, but this won’t be easy with commodity hardware. Standard practice is to use write-blockers to prevent this kind of tricks, but of course you can prevent write-blockers by integrating your storage. I think you could get a pixel phone to do this in a useful way.
nefitty 5y ago
In software, where there's a will, there's a way. Darknet Diaries has a cool episode about the dark cellphone industry: https://darknetdiaries.com/episode/105/ https://darknetdiaries.com/episode/105/
maltfield 5y ago
Lookup "duress passwords" * https://en.wikipedia.org/wiki/Duress_code https://en.wikipedia.org/wiki/Duress_code The feature is more relevant in (full disk) encryption software than OSes.