5 ms·
This "$5 wrench" XKCD always come up but... Plausible deniability ain't the only way around it. For example there are safes that, no matter what you do, are o
by TacticalCoder 5y ago
This "$5 wrench" XKCD always come up but... Plausible deniability ain't the only way around it.
For example there are safes that, no matter what you do, are only ever going to open on, say, wednesday morning at 10am. Or a safe that shall only open if, one hour previous to that, you entered your own personal code + a rolling code. You enter the rolling code and the one-hour countdown starts. Now... If you can only get the rolling code by calling someone (for example a security company) and if that person accepts two words, one being the real one, the other the "I'm under duress" one, now suddenly the "$5 wrench attack" doesn't look that great anymore.
BTW my home alarm has something similar: they'll came me after either a break-in or if I push the button "I'm under attack"... Then through the speakers they'll ask me "the" word. No matter if I say "banana" or "potato", they'll answer: all is fine, good night. But... "banana" means "everything is cool" while "potato" means "I'm under duress". Cops show up in 120 seconds where I live. The $5 wrench dudes better make very good use of that $5 wrench that'll, for sure, bring them billions of $$$ (such intelligent human beings btw: they figured out that a $5 wrench shall bring them riches) because in 120 seconds the cops are going to be there.
Back to the safe: the countdown starts and the attacker has no clue if the police has been contacted. They have to wait one hour. Oh and both codes starts the countdown. But the "I'm under duress one" will lead to some failure message on the safe "Error: mechanism locked" or "Bug 2134978" (whatever fancy you can come up with).
A $5 wrench attack is one thing. Kidnapping someone for days is another thing. Waiting for a safe to open for one hour without knowing if the cops are on their way (and have one hour to be there) is yet another thing.
My point is: I'm a bit fed up by people who have the victim mentality and think nothing can be done versus attackers. If attackers were that smart, they wouldn't be doing $5 wrench attacks in the first place. Use your intelligence to come up with schemes that a $5 wrench attack cannot break.
Another good one: a safe which only opens after a countdown of one-hour, no other way round. But as soon as you enter the code (and the countdown starts), a video feed of the room where the safe is located is sent to a security company. Someone at the security company checks the feed: he sees the $5 wrench (or he sees two people in the room, which is forbidden)... He calls the police and the police has one room to get the dude with the $5 wrench.
I much prefer people who think not just about how to resist $5 wrench attack but who thinks about ways to maximize the chance the one holding the $5 wrench ends up where he belongs.
So yup: I'm a bit pissed by that $5 wrench XKCD. So pissed I may actually one day join forces with company working on solutions to fight against that.
- HideousKojima 5y ago>Cops show up in 120 seconds where I live. Sorry to nitpick a single sentence out of your entire post, but where in the world do you live that has a response time like that? I wouldn't expect that kind of response time even if I lived next door to a police station. Hell I'd be doubtful of getting a response time like that if my spouse was an on-duty cop and was home when the attack occurred.
- supersell 5y agoPrison
- mortehu 5y agoI've called police for ongoing violence twice, and in both cases the response time was shorter than this. This is one thing the police really knows how to do. See also https://leb.fbi.gov/image-repository/police-response-time-to-active-shooter-attacks.jpg/view https://leb.fbi.gov/image-repository/police-response-time-to... which has the median response time to active shooter situations at 3 minutes
- remram 5y agoThen the attacker kidnap your kid, and you go through the entire procedure correctly the next day and give them the data. However comprehensive your security procedure is, so long as a human can unlock it, your data is not secure. That's the point of the xkcd, not the specific wrench.
- 2fast4you 5y agoYou’re assuming the attacker needs to be in the room with you, coercing you directly. Imagine this: an attacker has something against you. Maybe they know a secret you don’t want getting out, maybe they’ve kidnapped a loved one, etc. The attacker has threatened you and shown proof of the threat all with coming face to face. They now demand you give up the contents of the safe as ransom. How is your time delay and secret code words gonna help?
- cryptonector 5y agoSafes are rated in time to breach. They can all be breached. Revealing a duress code will not achieve anything unless the attacker is running your code (why would they), and if they're not, it will produce insufficient quantities of meaningful plaintext, leading to... more torture. Repeat after me: cryptography cannot be the rubber hose.