3 ms·

Doesn’t the use of a PDDB make all subsequent denials implausible? Or am I missing something?

nevinera 4y ago
It's a little complex, but not really. It's depth-N secret-hiding; if you have a true secret that absolutely must be hidden, you hide a disk full of anime at the top level, a smaller disk of furry porn below that, and a hundred pages of terrible erotic fiction below that, as your "deepest darkest secret". And now you have a "good" justification for using a PDDB to keep your shame hidden, and the layer below _that_ holding the corporate secrets you're trying to auction off can't be proven in any reasonable way (from the disk. I'm sure it's obvious by this point that I'm no expert on corporate espionage, but there are plenty of other ways you'll get caught). I mean, if you're not the kind of person that would use something like this anyway, then people will always _suspect_ you have something deeper in there (even if you don't). But they won't be able to prove it - that's the goal.
- doctor_eval 4y ago
  Yeah but the deniability will fall apart when they look in your browser history and find Wattpad :-)
NateEag 4y ago
I think you're right. Once a target has shown that they have hidden something at a lower level, which only they were able to demonstrate existed, the attacker knows the target has prepared an in-depth plausibly-deniable defense. They will therefore have no reason to trust the target's claims that "No really, that's the worst thing I have," and will have a very strong reason to doubt it.
- doctor_eval 4y ago
  Right? I haven't looked into how it works (I have nothing plausible to deny :-) but the web page says it's a filesystem, so I guess it's software, it has to be installed or run from somewhere, and the moment any hint of that software is discovered (browser history to the github page?), then deniability becomes less plausible. At best, using it successfully would seem to require a level of secops that is really hard to achieve.

It's a little complex, but not really. It's depth-N secret-hiding; if you have a true secret that absolutely must be hidden, you hide a disk full of anime at the top level, a smaller disk of furry porn below that, and a hundred pages of terrible erotic fiction below that, as your "deepest darkest secret". And now you have a "good" justification for using a PDDB to keep your shame hidden, and the layer below _that_ holding the corporate secrets you're trying to auction off can't be proven in any reasonable way (from the disk. I'm sure it's obvious by this point that I'm no expert on corporate espionage, but there are plenty of other ways you'll get caught). I mean, if you're not the kind of person that would use something like this anyway, then people will always _suspect_ you have something deeper in there (even if you don't). But they won't be able to prove it - that's the goal.

doctor_eval 4y ago
Yeah but the deniability will fall apart when they look in your browser history and find Wattpad :-)

NateEag 4y ago

I think you're right. Once a target has shown that they have hidden something at a lower level, which only they were able to demonstrate existed, the attacker knows the target has prepared an in-depth plausibly-deniable defense. They will therefore have no reason to trust the target's claims that "No really, that's the worst thing I have," and will have a very strong reason to doubt it.

doctor_eval 4y ago
Right? I haven't looked into how it works (I have nothing plausible to deny :-) but the web page says it's a filesystem, so I guess it's software, it has to be installed or run from somewhere, and the moment any hint of that software is discovered (browser history to the github page?), then deniability becomes less plausible. At best, using it successfully would seem to require a level of secops that is really hard to achieve.