17 ms·

Full disk encryption is too good?

201 points by mrsebastian 15y ago

TMK 15y ago
Great. I feel that full-hard disk encryption is necessary for our own privacy safety. If I had problems with Cops I would probably be shutting down my PC always before letting anyone in, though I already have quick auto-shutdown system with my SD card. I unmount my SD card and the PC shuts down and can not be logged in without the card if the SD card is not mounted.
- rexreed 15y ago
  What did you use for the SD card solution?
  - TMK 15y ago
    I wrote a small script to keep checking if the SD card is mounted and if a certain key file exists in the SD card. This script is auto-started before my gnome Login screen.
    - mbreese 15y ago
      Couldn't someone: a) physically remove your hard drive b) mount it in a different machine c) find your SD checking script d) figure out what key file you're checking for e) write that key file to a new SD card (or otherwise circumvent the check) This assumes that your HD isn't fully encrypted, in which case you'd be pretty well protected. It does sound like a nifty way to auto-logout quickly though...
      - TMK 15y ago
        The HD is fully encrypted and the system does not only check if a file exists, but if the file in the SD card contains specific key, which is not stored in the system, but it's my own encryption implementation for the key so I'm not certain how secure it is. a) Yes they can. b) Of course they can do that if the HD is not encrypted or the encryption is broken. c) Yes they can do that, but why would they do it if they already broke the hard drive encryption? They could just delete the script. d) Well yes surely they could do this. Anyway my only goal implementing the SD card shutdown was to secure the system from friends who want to invade my privacy and thief's. Basically I can do auto login to my admin account and if the SD card is not mounted it shut downs.
- rohit89 15y ago
  Couldn't they just force you to give the decryption keys ?
  - troels 15y ago
    Not if you forgot it.
    - lucian1900 15y ago
      Actually in the UK you can be detained indefinitely even if you plead that you forgot it.
      - ja27 15y ago
        That scares me. I've forgotten half my Truecrypt passwords. I guess I should give up and delete those archives.
  - mrsebastian 15y ago
    Plead the Fifth!
    - daeken 15y ago
      I think you're joking, but for what it's worth, that doesn't work. You can claim that the encryption key itself contains self-incriminating data, but then they'll simply say "ok, we completely understand. Go ahead and type it into your laptop and decrypt the data and you don't have to reveal the key."
      - VladRussian 15y ago
        right to remain silent. Orally, in writing, keyboard typing, or through any other means of communications.
      - tomjen3 15y ago
        Your honor, it has been more than six months since I was arrested and I can no longer remember the encryption key. All I can remember is that it twenty random letters/numbers. Even if you lie in court it is very difficult to prove it.
- mrcharles 15y ago
  I'm not sure what the benefit of the SD card is in this case -- something physical, you can be legally compelled to hand it over, since it's a physical object.
  - ConstantineXVI 15y ago
    It's much easier to make a SD card unavailable (destroyed, "lost", etc.) vs. an entire laptop, and you wouldn't be as vulnerable if a third party got a hold of the laptop (since all the valuable data is sitting in your wallet (on your person) instead of the briefcase (in the seat next to you)).
    - TMK 15y ago
      Well In my case the data actually is in the laptop and encrypted, but the SD card only disables logging in on the PC, even if they crack my password.
      - ConstantineXVI 15y ago
        Unless your SD card contains something vital to access of your data (encryption key, etc), all that setup does is protect your data from people who try to use your laptop in a coffeeshop while you're in the john. Still nothing stopping one from taking the entire laptop, removing the drive, and mounting it in another system.
        vladd 15y ago
        The encryption key could be a function of his login password and it could be stored in-memory after he is logged in. The issue is to have a trigger which wipes it from memory by logging out the current user when the police shows up, and unplugging the SD is a nice trigger for that. That's at least what I imagined, his setup might be completely different (a keyboard combination for logging out might also work better).
        TMK 15y ago
bootz15 15y ago
I like safety, be it encryption, locking my doors, etc. Good luck finding a legal justification around that.
CWuestefeld 15y ago
being able to crack full disk encryption is vital for the prosecution of child porn and pharmaceutical spam barons, amongst others Put in those terms, it seems that the trade-off between our right to privacy versus the needs of law enforcement is so ridiculously unbalanced that the law enforcement people ought to just slink away with their tails between their legs.
- msellout 15y ago
  Could you explain that a little more? I'm not disagreeing, but I'm not sure I understand what's so vital about preventing people from reading the data on my hard drive after they've confiscated it.
  - sixtofour 15y ago
    You have a fifth amendment right not to incriminate yourself, which the article mentions by noting that you don't have to give up your password when asked. In my mind (IANAL), if I don't have to give up information about myself, then I have the right to encrypt my information, and to not be presumed a criminal merely for having encrypted my information. Note that the 5th amendment is not about protecting your criminal activity, since you're presumed innocent unless convicted. It's a right that you have regardless of your character or activity.
    - tptacek 15y ago
      You don't have a right not to leave evidence. If you did, destruction of evidence wouldn't be a crime.
      - DasIch 15y ago
        We are not talking about evidence here, we are talking about information that at some point may be considered evidence. That is a big difference.
      - burgerbrain 15y ago
        I'm struggling to figure out how this comment is related to the one that you responded to. Did you respond to the wrong one?
alexhawdon 15y ago
What a crap article, especially to go on here. 1. Everyone on here except the tinfoil-hat brigade know that governments can't crack modern encryption that's been properly implemented. If they /do/ have the capability then it's tucked away somewhere very secret and they're using it for far more important things than catching criminals. 2. "with the cryogenic RAM freezing technique, presumably" - errr, no. With the "sit down at the computer and turn off the encryption/copy the data to an external drive technique", I think you'll find. Obvious bullsh*t to anyone technical but sounds 'cool' to your average 14yr old who reads these sort of sites. 3. "a risk to national security" ... "vital for the prosecution of child porn and pharmaceutical spam barons". Okay, so we eventually get closer to the truth. But hey - 'national security threats' sound much more urgent - let's put that in the article.
- pjin 15y ago
  2. "with the cryogenic RAM freezing technique, presumably" - errr, no. With the "sit down at the computer and turn off the encryption/copy the data to an external drive technique", I think you'll find. Obvious bullsh*t to anyone technical but sounds 'cool' to your average 14yr old who reads these sort of sites. Errr, actually yes. You may be interested in [1] and [2]. [1] http://citp.princeton.edu/pub/coldboot.pdf http://citp.princeton.edu/pub/coldboot.pdf [2] http://www.youtube.com/watch?v=JDaicPIgn9U http://www.youtube.com/watch?v=JDaicPIgn9U
  - jeffreyg 15y ago
    I'm assuming he was mocking the ignorance of the article as it addressed live memory acquisition. The author jumped to something obscure (RAM freezing) when there are forensics tools (memorize, etc) that can be used to image memory on a running machine in hopes of getting a decryption key / other passwords.
    - wmf 15y ago
      Or even easier: if the encrypted drive is mounted, just use cp (or the overpriced forensic equivalent). Cold boot attacks are sci-fi.
noonespecial 15y ago
So full disk encryption does what its supposed to do? Great. Next.
nextparadigms 15y ago
It's like arguing thick walls and windows and strong door locks make it harder for law enforcement to break in to catch the criminals. Nowadays, I'm very suspicious whenever they use the phrase "to fight against child pornography", because I just know they have a different agenda/priority in mind if they had to use that, but they'd rather give the child pornography line to the public.
- corin_ 15y ago
  Correct me if I'm wrong but that was just the journalist giving one of two examples for when we want law enforcement to succeed in their goals - it wasn't the Government covering up real reasons for anything.
  - Duff 15y ago
    Note he didn't point out crimes like embezzlement, bookmaking or murder. When spokespeople for the police say "We can't do X, which makes it harder to stop child pornography and drug dealing", that's PR-speak for "It's bad, trust us and don't think about it." Also conspicuously absent is preventing terrorism, which is a scenario where obtaining the password is more likely to be impossible, because the owner is most likely dead. My layman's understanding is that the law doesn't consider being compelled to reveal a password to be self-incrimination. Failing to reveal a password will get you held in contempt, or result in an "adverse inference" ruling from the judge.
    - corin_ 15y ago
      But it wasn't said by a spokesperson for the police, it was said by a random journalist after reading a report.
      - Duff 15y ago
        Who wrote the source report? Mediocre journalism is consists of stringing together press releases.
- 15y ago
RexRollman 15y ago
I believe that we will eventually return to "good" old days, when strong encryption was outlawed. If the intelligence sector doesn't get it overturned itself, then I expect that someone in Congress will probably push a bill through to do so under the guise of preventing child porn (after all, who isn't against child porn?). Oh, and a tip of the hat to Phil Zimmermann, who created PGP twenty years ago this year.
- jrockway 15y ago
  No, this won't happen. Every major corporation encrypts the fuck out of their employee's laptops, because they are legally required to do so. The ship has sailed. Crypto is a key component of the modern economy. It would be like banning US dollars because drug dealers use US dollars.
  - jleader 15y ago
    Ever tried to obtain more than 10,000 of those US dollars? Not exactly "banned", but pretty heavily restricted, from what I understand, for just about that reason.
    - felipemnoa 15y ago
      No, you can call your bank (in US at least) one or two days before and they will have those 10K, 20k, 50k ready for you. Whether that raises flags and FBI agents start tailing you is a different matter.
    - jrockway 15y ago
      Obvious bullshit. Consider corporate payroll; anyone making more than $120,000 a year gets a monthly paycheck for more than $10,000, and this causes no problems.
      - jleader 15y ago
        I was referring to physical dollar bills; how many drug dealers get paid by direct deposit?
ck2 15y ago
When full disk encryption is outlawed...
pavel_lishin 15y ago
> First, evidence-gathering goons can turn off a computer (for transportation) without realizing it’s encrypted, and thus can’t get back at the data (unless the arrestee gives up his password, which he doesn’t have to do); I thought that if they had a warrant, you had to give up the password, much as you'd have to give up the key to a locked door in your house?
- deleted 15y ago
  [deleted]
- cheald 15y ago
  The Fifth Amendment precludes that. > No person shall...be compelled in any criminal case to be a witness against himself Courts have previously upheld passwords as self-implicating information, which you cannot be constitutionally compelled to provide. > in In re Boucher (2009), the US District Court of Vermont ruled that the Fifth Amendment might protect a defendant from having to reveal an encryption password, or even the existence of one, if the production of that password could be deemed a self-incriminating "act" under the Fifth Amendment. http://en.wikipedia.org/wiki/In_re_Boucher http://en.wikipedia.org/wiki/In_re_Boucher Boucher ended up having to unlock the hard drive, because he had previously unlocked the drive for border agents. Had he refused, the court likely would have held that he could not be compelled to produce the password or the hard drive contents. A warrant gives law enforcement the right to gather evidence, but doesn't compel you to provide it. If you won't provide it, they are authorized to take it by force. In the case of encryption, they don't have enough (legal) force to take it. Therefore, they are entirely dependent on the accused cooperating to gather that information, but the accused cannot be compelled to cooperate under the Fifth. This is scary for them, because it means that they can't legally compel you to give up the information, and they can't gain access to it by force. A wholly uncooperative defendant is effectively unassailable.
  - potatolicious 15y ago
    > "you cannot be constitutionally compelled" The US government has frequent shown that they have no qualms against unconstitutionally compelling individuals...
w1ntermute 15y ago
https://www.xkcd.com/538/ https://www.xkcd.com/538/ It's common knowledge that the government has few qualms about violating its own laws. No doubt they won't allow some pesky legal restrictions stand in the way of cracking FDE.
- teaspoon 15y ago
  Are you suggesting that the FBI tortures every suspected pedophile and spammer who uses FDE?
  - fleitz 15y ago
    I think he's suggesting that the US government uses pain up to and including the amount of pain induced by breaking a limb or organ failure to extract information from those it holds without trial. This assertion would seem to be consistent with the official position of the US government. Whether inducing pain equivalent to organ failure to extract information is a violation US or International law is probably a question best answered by the ICC.
    - w1ntermute 15y ago
      > Whether inducing pain equivalent to organ failure to extract information is a violation US or International law is probably a question best answered by the ICC. No doubt this question has already been answered on numerous occasions with respect to such violations in 3rd world countries and enemies of the US and its allies. However, the US government, for all practical purposes, is above international law.
    - teaspoon 15y ago
      That's certainly true. If you're being held without trial, you're beyond the help of most technologies and pesky legal restrictions.
  - potatolicious 15y ago
    No, but they may lie, coerce, and otherwise try to convince you to give up the password without laying a hand on you. This might not sound so bad on paper, but I personally don't know what I would do when locked in a room with a professional interrogator.
dubya 15y ago
It sounds like it hurts fishing expeditions. They can always get a warrant and hide a tiny video recorder somewhere pointed at the screen, or install a key logger to capture the password (maybe not on a notebook?), or work with the *-baron's ISP to capture evidence that goes over the internet.
- billswift 15y ago
  Or do a black bag job to get the key, then type it in after seizing the computer and say it was just a lucky guess.
- innoncent1 15y ago
  Netbooks have replaceable keyboards. You'd never know.
wavephorm 15y ago
Geez ExtremeTech really needs to do something about their iPad support. That is without question the worst iPad viewing experience I've ever seen. Just give the iPad visitors the desktop version. Whatever mobile system they are using is horrendous, unusable, and should be abandoned.
- watmough 15y ago
  I believe it's a commonly available theme. Seen it in a few places. I also think its terrible.
- cshesse 15y ago
  The iPhone version makes me so angry I have trouble reading the article.
rsingel 15y ago
US CERT is NOT an intelligence agency. Very misleading title.
- mrsebastian 15y ago
  "US-CERT's mission is to improve the nation's cybersecurity posture, coordinate cyber information sharing and proactively manage cyber risks to the nation while protecting the constitutional rights of Americans. US-CERT vision is to be a trusted global leader in cybersecurity - collaborative, agile, and responsive in a complex environment." From: http://www.us-cert.gov/aboutus.html http://www.us-cert.gov/aboutus.html Certainly sounds like intelligence (and counterintelligence) is one of the main aspects of their work. Agree, they don't sound like _human_ intelligence gatherers... but I'm fairly certain that US-CERT would know plenty of information about hackers, hacking, pirates, and so on.
pg 15y ago
Or so they want us to believe...
- boyter 15y ago
  That's exactly what I think. The fact that governments are now saying that some encryption is un-crackable makes me highly suspicious. I'm not a tin-foil hat person, but I wouldn't trust any encryption out there with my life if there was a concentrated effort by combined governments to defeat it.
tedjdziuba 15y ago
It's easier to break fingers than it is to break codes.
devs1010 15y ago
good, hopefully this can spell the end of these asshats digging around in everyone's data
nirvana 15y ago
I've always thought that a solution to the problems with insufficient 5th amendment protection would be to make your password a passphrase that contains an admission of a crime. For instance: "I admit that I smoked marijuana on the 5th of December 2010". or "I under paid my taxes in 2005 by $50." These passphrases, as literal admissions of a crime, would have to be protected by the 5th amendment. Of course, that presumes that the legal system operates under the constraints of the bill of rights, a presumption I don't believe currently holds very often. (Neither of the example phrases given here are actually true about me. )
- abalashov 15y ago
  The problem with that is that the 5th Amendment, as specifically formulated, protects you from being compelled to give _testimony_ against yourself. The success of your strategy hinges on the idea that divulging the password is an act of a testimonial nature, and existing precedents have not gone that way. Testimony is a very particular kind of thing, rather narrowly circumscribed.
  - nirvana 15y ago
    Could you be more specific? Under the 5th ammendment, you can refuse to talk to the police. If a judge orders you to reveal it, or be held in contempt of court, is that not a "Testimony"? And thus, wouldn't giving your passphrase literally be expressing a confession to a crime (presuming it was in the form of a confession)?
    - abalashov 15y ago
      The question is really about whether the content of the password itself can be entered into evidence, and in most cases, the answer is no, though it would, of course, depend on the scope of the search warrant (if that's the context in which it is being evaluated) and several other factors. But in practice, a password is understood to be something rather arbitrary, so it is not regarded as having strong evidentiary weight. Of all the things I can do, setting my password to "ikillednicolebrownsimpson" is least likely to implicate me, even with a great deal of related supporting evidence. Secondly, they can get around this quite easily by telling you to just type it in without disclosing it to them. Your refusal to comply will be regarded the same way as a refusal to open a safe or something similar, and you can be held (indefinitely, in many jurisdictions) for contempt of court. The difference, of course, is that the police can open a safe if they have to. The 5th amendment does not release you from an obligation to cooperate with police, though, as you rightly point out, you are not required to disclose evidence to them or to aid their investigation apart from complying with their request to look around. To what extent divulging a password or passphrase enters into this scope is a matter of ongoing court battles. They have gone both ways.
abalashov 15y ago
Sometimes it is an inevitable consequence of the march of technological progress that certain legal and civil artifacts of previous eras must fall away, and we need to let that run its natural course, instead of trying to put up pointless and ineffectual -- but costly and frightening -- bureaucratic boondoggles in its way. We will just have to live with the fact that secure end-to-end electronic communication and storage encryption that is not accessible by law enforcement is available to anyone who really wants it. For the most part, this is good news for privacy, civil rights and protection from information crime; in a few extremely marginal cases, like terrorist plotters and whatnot, this is bad, but we can't have our cake and eat it too. Trying to stop it, roll it back, pretend it doesn't exist, etc. is a pointless waste of time.
- bcl 15y ago
  As is trying to legislate it away, which is what the authorities' reaction usually is.
- innoncent1 15y ago
  200 years ago, every man could own a rifle and all rifles were assault rifles. Citizens were equal with their governments. They could ban together and form armies. Today, looking at the vast differences between arms that governments posses versus what their citizens may legally posses and you'll soon realize that the only technological equality we have remaining is strong encryption thus the governments attack that technology accusing everyone who uses it of being either a state sponsored terrorist or a child porn monster (why else would anyone use it... what do they have to hide). They themselves use encryption extensively, but they don't want me and you to do so. The United States once classified some encryption algorithms as a munition and banned exports. We citizens can't buy tanks or air craft carriers or satellites, but we can legally use AES 256 encryption (at least for now) and we should. That's all we have left.
  - abalashov 15y ago
    Indeed; it was said best below by another commenter: http://news.ycombinator.com/item?id=3253811 http://news.ycombinator.com/item?id=3253811
joeybaker 15y ago
Misleading title, the quote is nowhere to be found in the article which says little beyond the fact that encryption is tough to crack. Nowhere does it say it can't be done.
deleted 15y ago
[deleted]
tobylane 15y ago
Shame (for the agency) the courts already decided on this. Hope this stands. http://en.wikipedia.org/wiki/United_States_v._Boucher http://en.wikipedia.org/wiki/United_States_v._Boucher
DTE 15y ago
The feds were worried a long time ago but full disk encryption (or any encryption really) was not adopted by the public. The barrier to entry was too high. Only now is this odd relationship (encryption is ok but only when it isn't commonly used) going to have to play out in our legal system and culture, and it will be super interesting to see how we decide as a society what the limits of this technology are. See: http://www.wired.com/wired/archive/1.02/crypto.rebels_pr.html http://www.wired.com/wired/archive/1.02/crypto.rebels_pr.htm...
droithomme 15y ago
Well goodness. If this same US government didn't insist they have the right to clone my hard disk without a warrant whenever I go through customs, maybe I wouldn't need full disk encryption.
michaelfeathers 15y ago
> the FBI, CIA, and NSA, also have a problem cracking encrypted hard disks — and according to a new research paper, this is a serious risk to national security. Imagine what would happen if people could hold information in their minds without putting it computer files. That would be a very serious risk.
tptacek 15y ago
Here is one of those oh-so-productive HN threads where virtually everyone is competing to find either cleverer or more emphatic ways of agreeing with the same statement; in this case, it's "the government shouldn't regulate encryption", but it might just as well be "the government shouldn't be electronically strip searching people at airports"†. This phenomenon presents a manifold of problems, including: * Because we appear to be unable to move past the most immediately obvious point, we can't fit any other thoughts in our head, like, "maybe there is a real societal problem that needs to be addressed here" --- not by regulating encryption, but, for instance, perhaps by allocating funding and training differently. * It's boring to have a bunch of people with more or less the exact same life experiences competing to agree with each other. * When it's not boring, it's exasperating, such as when the thread competes to build a case that all of law enforcement is a conspiracy to find more effective ways to predict who we're going to vote for --- or creepy, such as when people more or less suggest that child pornography isn't a real problem. Two thoughts. That's all I'm asking. I agree that the first thought is "don't regulate full disk encryption". The second thought though should be something along the lines of, "yes, that's an interesting new problem for law enforcement"; it shouldn't be "OH MY GOD LOOK HERE'S THE GOVERNMENT LOOKING FOR ANOTHER EXCUSE TO SPY ON MY PORN STASH." † I know, I was just as bad on those TSA threads as everyone else.
- pbsd 15y ago
  I found the actual paper on the issue much more appropriate in tone than the tech blog linked above. Nowhere it suggests to change laws (the "legal approach" is essentially to get warrants that allow surprise approaches to the targets), nor to regulate encryption. The meat of the article is simply describing how investigators should be prepared to deal with FDE, when they expect to encounter it, both via legal and technical measures. This alone highly increases their chances of success. Finally, this reminds me of Matt Blaze's analysis of the 2010 wiretap report, where in the 6 cases where encryption was found, 0 of them actually prevented evidence recovery. I suspect well-prepared law enforcement will be able to be as effective, even in spite of FDE.
  - pasbesoin 15y ago
    Paper is paywalled. I find this slightly ironic.
Karunamon 15y ago
> the FBI, CIA, and NSA, also have a problem cracking encrypted hard disks Was I the only one who thought "Good." when they encountered this sentence?
linuxhansl 15y ago
"being able to crack full disk encryption is vital for the prosecution of white-collar criminals, child porn ringleaders, pharmaceutical spam barons, and the curtailment of terrorism" Again, there is a terrorist and "child porn ringleader" hiding under every rock. Before computers and full disk encryption people used other forms of information hiding, and the world did not end. If the only evidence for a crime is to be found on some encrypted disk drive, it would be a weak case anyway.
lywald 15y ago
The next step is reading people's minds to know what they fantasize about. [The study, titled “The impact of brain privacy on police investigation,” illustrates the difficulty that CSI teams have in obtaining enough data to build a solid case against criminals.] It's funny because we'll come to this one day.

201 points by mrsebastian 15y ago

TMK 15y ago

Great. I feel that full-hard disk encryption is necessary for our own privacy safety. If I had problems with Cops I would probably be shutting down my PC always before letting anyone in, though I already have quick auto-shutdown system with my SD card. I unmount my SD card and the PC shuts down and can not be logged in without the card if the SD card is not mounted.

rexreed 15y ago
What did you use for the SD card solution?
- TMK 15y ago
  I wrote a small script to keep checking if the SD card is mounted and if a certain key file exists in the SD card. This script is auto-started before my gnome Login screen.
  - mbreese 15y ago
    Couldn't someone: a) physically remove your hard drive b) mount it in a different machine c) find your SD checking script d) figure out what key file you're checking for e) write that key file to a new SD card (or otherwise circumvent the check) This assumes that your HD isn't fully encrypted, in which case you'd be pretty well protected. It does sound like a nifty way to auto-logout quickly though...
    - TMK 15y ago
      The HD is fully encrypted and the system does not only check if a file exists, but if the file in the SD card contains specific key, which is not stored in the system, but it's my own encryption implementation for the key so I'm not certain how secure it is. a) Yes they can. b) Of course they can do that if the HD is not encrypted or the encryption is broken. c) Yes they can do that, but why would they do it if they already broke the hard drive encryption? They could just delete the script. d) Well yes surely they could do this. Anyway my only goal implementing the SD card shutdown was to secure the system from friends who want to invade my privacy and thief's. Basically I can do auto login to my admin account and if the SD card is not mounted it shut downs.
rohit89 15y ago
Couldn't they just force you to give the decryption keys ?
- troels 15y ago
  Not if you forgot it.
  - lucian1900 15y ago
    Actually in the UK you can be detained indefinitely even if you plead that you forgot it.
    - ja27 15y ago
      That scares me. I've forgotten half my Truecrypt passwords. I guess I should give up and delete those archives.
- mrsebastian 15y ago
  Plead the Fifth!
  - daeken 15y ago
    I think you're joking, but for what it's worth, that doesn't work. You can claim that the encryption key itself contains self-incriminating data, but then they'll simply say "ok, we completely understand. Go ahead and type it into your laptop and decrypt the data and you don't have to reveal the key."
    - VladRussian 15y ago
      right to remain silent. Orally, in writing, keyboard typing, or through any other means of communications.
    - tomjen3 15y ago
      Your honor, it has been more than six months since I was arrested and I can no longer remember the encryption key. All I can remember is that it twenty random letters/numbers. Even if you lie in court it is very difficult to prove it.
mrcharles 15y ago
I'm not sure what the benefit of the SD card is in this case -- something physical, you can be legally compelled to hand it over, since it's a physical object.
- ConstantineXVI 15y ago
  It's much easier to make a SD card unavailable (destroyed, "lost", etc.) vs. an entire laptop, and you wouldn't be as vulnerable if a third party got a hold of the laptop (since all the valuable data is sitting in your wallet (on your person) instead of the briefcase (in the seat next to you)).
  - TMK 15y ago
    Well In my case the data actually is in the laptop and encrypted, but the SD card only disables logging in on the PC, even if they crack my password.
    - ConstantineXVI 15y ago
      Unless your SD card contains something vital to access of your data (encryption key, etc), all that setup does is protect your data from people who try to use your laptop in a coffeeshop while you're in the john. Still nothing stopping one from taking the entire laptop, removing the drive, and mounting it in another system.
      - vladd 15y ago
        The encryption key could be a function of his login password and it could be stored in-memory after he is logged in. The issue is to have a trigger which wipes it from memory by logging out the current user when the police shows up, and unplugging the SD is a nice trigger for that. That's at least what I imagined, his setup might be completely different (a keyboard combination for logging out might also work better).
        TMK 15y ago

bootz15 15y ago

I like safety, be it encryption, locking my doors, etc. Good luck finding a legal justification around that.

CWuestefeld 15y ago

being able to crack full disk encryption is vital for the prosecution of child porn and pharmaceutical spam barons, amongst others Put in those terms, it seems that the trade-off between our right to privacy versus the needs of law enforcement is so ridiculously unbalanced that the law enforcement people ought to just slink away with their tails between their legs.

msellout 15y ago
Could you explain that a little more? I'm not disagreeing, but I'm not sure I understand what's so vital about preventing people from reading the data on my hard drive after they've confiscated it.
- sixtofour 15y ago
  You have a fifth amendment right not to incriminate yourself, which the article mentions by noting that you don't have to give up your password when asked. In my mind (IANAL), if I don't have to give up information about myself, then I have the right to encrypt my information, and to not be presumed a criminal merely for having encrypted my information. Note that the 5th amendment is not about protecting your criminal activity, since you're presumed innocent unless convicted. It's a right that you have regardless of your character or activity.
  - tptacek 15y ago
    You don't have a right not to leave evidence. If you did, destruction of evidence wouldn't be a crime.
    - DasIch 15y ago
      We are not talking about evidence here, we are talking about information that at some point may be considered evidence. That is a big difference.
    - burgerbrain 15y ago
      I'm struggling to figure out how this comment is related to the one that you responded to. Did you respond to the wrong one?

alexhawdon 15y ago

What a crap article, especially to go on here. 1. Everyone on here except the tinfoil-hat brigade know that governments can't crack modern encryption that's been properly implemented. If they /do/ have the capability then it's tucked away somewhere very secret and they're using it for far more important things than catching criminals. 2. "with the cryogenic RAM freezing technique, presumably" - errr, no. With the "sit down at the computer and turn off the encryption/copy the data to an external drive technique", I think you'll find. Obvious bullsh*t to anyone technical but sounds 'cool' to your average 14yr old who reads these sort of sites. 3. "a risk to national security" ... "vital for the prosecution of child porn and pharmaceutical spam barons". Okay, so we eventually get closer to the truth. But hey - 'national security threats' sound much more urgent - let's put that in the article.

pjin 15y ago
2. "with the cryogenic RAM freezing technique, presumably" - errr, no. With the "sit down at the computer and turn off the encryption/copy the data to an external drive technique", I think you'll find. Obvious bullsh*t to anyone technical but sounds 'cool' to your average 14yr old who reads these sort of sites. Errr, actually yes. You may be interested in [1] and [2]. [1] http://citp.princeton.edu/pub/coldboot.pdf http://citp.princeton.edu/pub/coldboot.pdf [2] http://www.youtube.com/watch?v=JDaicPIgn9U http://www.youtube.com/watch?v=JDaicPIgn9U
- jeffreyg 15y ago
  I'm assuming he was mocking the ignorance of the article as it addressed live memory acquisition. The author jumped to something obscure (RAM freezing) when there are forensics tools (memorize, etc) that can be used to image memory on a running machine in hopes of getting a decryption key / other passwords.
  - wmf 15y ago
    Or even easier: if the encrypted drive is mounted, just use cp (or the overpriced forensic equivalent). Cold boot attacks are sci-fi.

noonespecial 15y ago

So full disk encryption does what its supposed to do? Great. Next.

nextparadigms 15y ago

It's like arguing thick walls and windows and strong door locks make it harder for law enforcement to break in to catch the criminals. Nowadays, I'm very suspicious whenever they use the phrase "to fight against child pornography", because I just know they have a different agenda/priority in mind if they had to use that, but they'd rather give the child pornography line to the public.

corin_ 15y ago
Correct me if I'm wrong but that was just the journalist giving one of two examples for when we want law enforcement to succeed in their goals - it wasn't the Government covering up real reasons for anything.
- Duff 15y ago
  Note he didn't point out crimes like embezzlement, bookmaking or murder. When spokespeople for the police say "We can't do X, which makes it harder to stop child pornography and drug dealing", that's PR-speak for "It's bad, trust us and don't think about it." Also conspicuously absent is preventing terrorism, which is a scenario where obtaining the password is more likely to be impossible, because the owner is most likely dead. My layman's understanding is that the law doesn't consider being compelled to reveal a password to be self-incrimination. Failing to reveal a password will get you held in contempt, or result in an "adverse inference" ruling from the judge.
  - corin_ 15y ago
    But it wasn't said by a spokesperson for the police, it was said by a random journalist after reading a report.
    - Duff 15y ago
      Who wrote the source report? Mediocre journalism is consists of stringing together press releases.
15y ago

RexRollman 15y ago

I believe that we will eventually return to "good" old days, when strong encryption was outlawed. If the intelligence sector doesn't get it overturned itself, then I expect that someone in Congress will probably push a bill through to do so under the guise of preventing child porn (after all, who isn't against child porn?). Oh, and a tip of the hat to Phil Zimmermann, who created PGP twenty years ago this year.

jrockway 15y ago
No, this won't happen. Every major corporation encrypts the fuck out of their employee's laptops, because they are legally required to do so. The ship has sailed. Crypto is a key component of the modern economy. It would be like banning US dollars because drug dealers use US dollars.
- jleader 15y ago
  Ever tried to obtain more than 10,000 of those US dollars? Not exactly "banned", but pretty heavily restricted, from what I understand, for just about that reason.
  - felipemnoa 15y ago
    No, you can call your bank (in US at least) one or two days before and they will have those 10K, 20k, 50k ready for you. Whether that raises flags and FBI agents start tailing you is a different matter.
  - jrockway 15y ago
    Obvious bullshit. Consider corporate payroll; anyone making more than $120,000 a year gets a monthly paycheck for more than $10,000, and this causes no problems.
    - jleader 15y ago
      I was referring to physical dollar bills; how many drug dealers get paid by direct deposit?

ck2 15y ago

When full disk encryption is outlawed...

pavel_lishin 15y ago

> First, evidence-gathering goons can turn off a computer (for transportation) without realizing it’s encrypted, and thus can’t get back at the data (unless the arrestee gives up his password, which he doesn’t have to do); I thought that if they had a warrant, you had to give up the password, much as you'd have to give up the key to a locked door in your house?

deleted 15y ago
[deleted]
cheald 15y ago
The Fifth Amendment precludes that. > No person shall...be compelled in any criminal case to be a witness against himself Courts have previously upheld passwords as self-implicating information, which you cannot be constitutionally compelled to provide. > in In re Boucher (2009), the US District Court of Vermont ruled that the Fifth Amendment might protect a defendant from having to reveal an encryption password, or even the existence of one, if the production of that password could be deemed a self-incriminating "act" under the Fifth Amendment. http://en.wikipedia.org/wiki/In_re_Boucher http://en.wikipedia.org/wiki/In_re_Boucher Boucher ended up having to unlock the hard drive, because he had previously unlocked the drive for border agents. Had he refused, the court likely would have held that he could not be compelled to produce the password or the hard drive contents. A warrant gives law enforcement the right to gather evidence, but doesn't compel you to provide it. If you won't provide it, they are authorized to take it by force. In the case of encryption, they don't have enough (legal) force to take it. Therefore, they are entirely dependent on the accused cooperating to gather that information, but the accused cannot be compelled to cooperate under the Fifth. This is scary for them, because it means that they can't legally compel you to give up the information, and they can't gain access to it by force. A wholly uncooperative defendant is effectively unassailable.
- potatolicious 15y ago
  > "you cannot be constitutionally compelled" The US government has frequent shown that they have no qualms against unconstitutionally compelling individuals...

w1ntermute 15y ago

https://www.xkcd.com/538/ https://www.xkcd.com/538/ It's common knowledge that the government has few qualms about violating its own laws. No doubt they won't allow some pesky legal restrictions stand in the way of cracking FDE.

teaspoon 15y ago
Are you suggesting that the FBI tortures every suspected pedophile and spammer who uses FDE?
- fleitz 15y ago
  I think he's suggesting that the US government uses pain up to and including the amount of pain induced by breaking a limb or organ failure to extract information from those it holds without trial. This assertion would seem to be consistent with the official position of the US government. Whether inducing pain equivalent to organ failure to extract information is a violation US or International law is probably a question best answered by the ICC.
  - w1ntermute 15y ago
    > Whether inducing pain equivalent to organ failure to extract information is a violation US or International law is probably a question best answered by the ICC. No doubt this question has already been answered on numerous occasions with respect to such violations in 3rd world countries and enemies of the US and its allies. However, the US government, for all practical purposes, is above international law.
  - teaspoon 15y ago
    That's certainly true. If you're being held without trial, you're beyond the help of most technologies and pesky legal restrictions.
- potatolicious 15y ago
  No, but they may lie, coerce, and otherwise try to convince you to give up the password without laying a hand on you. This might not sound so bad on paper, but I personally don't know what I would do when locked in a room with a professional interrogator.

dubya 15y ago

It sounds like it hurts fishing expeditions. They can always get a warrant and hide a tiny video recorder somewhere pointed at the screen, or install a key logger to capture the password (maybe not on a notebook?), or work with the *-baron's ISP to capture evidence that goes over the internet.

billswift 15y ago
Or do a black bag job to get the key, then type it in after seizing the computer and say it was just a lucky guess.
innoncent1 15y ago
Netbooks have replaceable keyboards. You'd never know.

wavephorm 15y ago

Geez ExtremeTech really needs to do something about their iPad support. That is without question the worst iPad viewing experience I've ever seen. Just give the iPad visitors the desktop version. Whatever mobile system they are using is horrendous, unusable, and should be abandoned.

watmough 15y ago
I believe it's a commonly available theme. Seen it in a few places. I also think its terrible.
cshesse 15y ago
The iPhone version makes me so angry I have trouble reading the article.

rsingel 15y ago

US CERT is NOT an intelligence agency. Very misleading title.

mrsebastian 15y ago
"US-CERT's mission is to improve the nation's cybersecurity posture, coordinate cyber information sharing and proactively manage cyber risks to the nation while protecting the constitutional rights of Americans. US-CERT vision is to be a trusted global leader in cybersecurity - collaborative, agile, and responsive in a complex environment." From: http://www.us-cert.gov/aboutus.html http://www.us-cert.gov/aboutus.html Certainly sounds like intelligence (and counterintelligence) is one of the main aspects of their work. Agree, they don't sound like _human_ intelligence gatherers... but I'm fairly certain that US-CERT would know plenty of information about hackers, hacking, pirates, and so on.

pg 15y ago

Or so they want us to believe...

boyter 15y ago
That's exactly what I think. The fact that governments are now saying that some encryption is un-crackable makes me highly suspicious. I'm not a tin-foil hat person, but I wouldn't trust any encryption out there with my life if there was a concentrated effort by combined governments to defeat it.

tedjdziuba 15y ago

It's easier to break fingers than it is to break codes.

devs1010 15y ago

good, hopefully this can spell the end of these asshats digging around in everyone's data

nirvana 15y ago

I've always thought that a solution to the problems with insufficient 5th amendment protection would be to make your password a passphrase that contains an admission of a crime. For instance: "I admit that I smoked marijuana on the 5th of December 2010". or "I under paid my taxes in 2005 by $50." These passphrases, as literal admissions of a crime, would have to be protected by the 5th amendment. Of course, that presumes that the legal system operates under the constraints of the bill of rights, a presumption I don't believe currently holds very often. (Neither of the example phrases given here are actually true about me. )

abalashov 15y ago
The problem with that is that the 5th Amendment, as specifically formulated, protects you from being compelled to give _testimony_ against yourself. The success of your strategy hinges on the idea that divulging the password is an act of a testimonial nature, and existing precedents have not gone that way. Testimony is a very particular kind of thing, rather narrowly circumscribed.
- nirvana 15y ago
  Could you be more specific? Under the 5th ammendment, you can refuse to talk to the police. If a judge orders you to reveal it, or be held in contempt of court, is that not a "Testimony"? And thus, wouldn't giving your passphrase literally be expressing a confession to a crime (presuming it was in the form of a confession)?
  - abalashov 15y ago
    The question is really about whether the content of the password itself can be entered into evidence, and in most cases, the answer is no, though it would, of course, depend on the scope of the search warrant (if that's the context in which it is being evaluated) and several other factors. But in practice, a password is understood to be something rather arbitrary, so it is not regarded as having strong evidentiary weight. Of all the things I can do, setting my password to "ikillednicolebrownsimpson" is least likely to implicate me, even with a great deal of related supporting evidence. Secondly, they can get around this quite easily by telling you to just type it in without disclosing it to them. Your refusal to comply will be regarded the same way as a refusal to open a safe or something similar, and you can be held (indefinitely, in many jurisdictions) for contempt of court. The difference, of course, is that the police can open a safe if they have to. The 5th amendment does not release you from an obligation to cooperate with police, though, as you rightly point out, you are not required to disclose evidence to them or to aid their investigation apart from complying with their request to look around. To what extent divulging a password or passphrase enters into this scope is a matter of ongoing court battles. They have gone both ways.

abalashov 15y ago

Sometimes it is an inevitable consequence of the march of technological progress that certain legal and civil artifacts of previous eras must fall away, and we need to let that run its natural course, instead of trying to put up pointless and ineffectual -- but costly and frightening -- bureaucratic boondoggles in its way. We will just have to live with the fact that secure end-to-end electronic communication and storage encryption that is not accessible by law enforcement is available to anyone who really wants it. For the most part, this is good news for privacy, civil rights and protection from information crime; in a few extremely marginal cases, like terrorist plotters and whatnot, this is bad, but we can't have our cake and eat it too. Trying to stop it, roll it back, pretend it doesn't exist, etc. is a pointless waste of time.

bcl 15y ago
As is trying to legislate it away, which is what the authorities' reaction usually is.
innoncent1 15y ago
200 years ago, every man could own a rifle and all rifles were assault rifles. Citizens were equal with their governments. They could ban together and form armies. Today, looking at the vast differences between arms that governments posses versus what their citizens may legally posses and you'll soon realize that the only technological equality we have remaining is strong encryption thus the governments attack that technology accusing everyone who uses it of being either a state sponsored terrorist or a child porn monster (why else would anyone use it... what do they have to hide). They themselves use encryption extensively, but they don't want me and you to do so. The United States once classified some encryption algorithms as a munition and banned exports. We citizens can't buy tanks or air craft carriers or satellites, but we can legally use AES 256 encryption (at least for now) and we should. That's all we have left.
- abalashov 15y ago
  Indeed; it was said best below by another commenter: http://news.ycombinator.com/item?id=3253811 http://news.ycombinator.com/item?id=3253811

joeybaker 15y ago

Misleading title, the quote is nowhere to be found in the article which says little beyond the fact that encryption is tough to crack. Nowhere does it say it can't be done.

deleted 15y ago

[deleted]

tobylane 15y ago

Shame (for the agency) the courts already decided on this. Hope this stands. http://en.wikipedia.org/wiki/United_States_v._Boucher http://en.wikipedia.org/wiki/United_States_v._Boucher

DTE 15y ago

The feds were worried a long time ago but full disk encryption (or any encryption really) was not adopted by the public. The barrier to entry was too high. Only now is this odd relationship (encryption is ok but only when it isn't commonly used) going to have to play out in our legal system and culture, and it will be super interesting to see how we decide as a society what the limits of this technology are. See: http://www.wired.com/wired/archive/1.02/crypto.rebels_pr.html http://www.wired.com/wired/archive/1.02/crypto.rebels_pr.htm...

droithomme 15y ago

Well goodness. If this same US government didn't insist they have the right to clone my hard disk without a warrant whenever I go through customs, maybe I wouldn't need full disk encryption.

michaelfeathers 15y ago

> the FBI, CIA, and NSA, also have a problem cracking encrypted hard disks — and according to a new research paper, this is a serious risk to national security. Imagine what would happen if people could hold information in their minds without putting it computer files. That would be a very serious risk.

tptacek 15y ago

Here is one of those oh-so-productive HN threads where virtually everyone is competing to find either cleverer or more emphatic ways of agreeing with the same statement; in this case, it's "the government shouldn't regulate encryption", but it might just as well be "the government shouldn't be electronically strip searching people at airports"†. This phenomenon presents a manifold of problems, including: * Because we appear to be unable to move past the most immediately obvious point, we can't fit any other thoughts in our head, like, "maybe there is a real societal problem that needs to be addressed here" --- not by regulating encryption, but, for instance, perhaps by allocating funding and training differently. * It's boring to have a bunch of people with more or less the exact same life experiences competing to agree with each other. * When it's not boring, it's exasperating, such as when the thread competes to build a case that all of law enforcement is a conspiracy to find more effective ways to predict who we're going to vote for --- or creepy, such as when people more or less suggest that child pornography isn't a real problem. Two thoughts. That's all I'm asking. I agree that the first thought is "don't regulate full disk encryption". The second thought though should be something along the lines of, "yes, that's an interesting new problem for law enforcement"; it shouldn't be "OH MY GOD LOOK HERE'S THE GOVERNMENT LOOKING FOR ANOTHER EXCUSE TO SPY ON MY PORN STASH." † I know, I was just as bad on those TSA threads as everyone else.

pbsd 15y ago
I found the actual paper on the issue much more appropriate in tone than the tech blog linked above. Nowhere it suggests to change laws (the "legal approach" is essentially to get warrants that allow surprise approaches to the targets), nor to regulate encryption. The meat of the article is simply describing how investigators should be prepared to deal with FDE, when they expect to encounter it, both via legal and technical measures. This alone highly increases their chances of success. Finally, this reminds me of Matt Blaze's analysis of the 2010 wiretap report, where in the 6 cases where encryption was found, 0 of them actually prevented evidence recovery. I suspect well-prepared law enforcement will be able to be as effective, even in spite of FDE.
- pasbesoin 15y ago
  Paper is paywalled. I find this slightly ironic.

Karunamon 15y ago

> the FBI, CIA, and NSA, also have a problem cracking encrypted hard disks Was I the only one who thought "Good." when they encountered this sentence?

linuxhansl 15y ago

"being able to crack full disk encryption is vital for the prosecution of white-collar criminals, child porn ringleaders, pharmaceutical spam barons, and the curtailment of terrorism" Again, there is a terrorist and "child porn ringleader" hiding under every rock. Before computers and full disk encryption people used other forms of information hiding, and the world did not end. If the only evidence for a crime is to be found on some encrypted disk drive, it would be a weak case anyway.

lywald 15y ago

The next step is reading people's minds to know what they fantasize about. [The study, titled “The impact of brain privacy on police investigation,” illustrates the difficulty that CSI teams have in obtaining enough data to build a solid case against criminals.] It's funny because we'll come to this one day.