4 ms·

As a thought experiment, I was wondering how to store something in a box/envelope, and know if someone else has looked at it. My conclusion was to search for "

by p1mrx 3y ago

As a thought experiment, I was wondering how to store something in a box/envelope, and know if someone else has looked at it. My conclusion was to search for "holographic tamper" on AliExpress, and carefully examine the photos to find models where each sticker has a number and a differently-aligned background pattern. Prices are around $5 for 250. Then you could use several stickers to seal whatever container, and take photos to record each sticker and its pattern. There are ways to exploit this system, but it probably helps against a non-sophisticated attacker.

cfield 3y ago
How about glitter nail polish? https://news.ycombinator.com/item?id=6986327 https://news.ycombinator.com/item?id=6986327
- p1mrx 3y ago
  Yeah, that may be a better idea. I see that some brands of nail polish use coarser flecks that would be easier to compare visually.
- jacquesm 3y ago
  That's so funny, I once long ago worked on a project that suspended retro reflective beads in a solution to get unique patterns, this is a very simple variation on that theme and probably a more effective one.
jamesrom 3y ago
State of the art is a bag of beans: https://dys2p.com/en/2021-12-tamper-evident-protection.html https://dys2p.com/en/2021-12-tamper-evident-protection.html
- Cpoll 3y ago
  I wonder if there's no attack on these. I think I'm fantasizing, and I suspect this won't work, but: Inject the vacuum-sealed package with a thermal plastic/resin that keeps the beans in position. Then cut open the solid beans and extract what you need. Once you're done, re-assemble, re-vacuum and then heat while applying vacuum to remove the resin.
  - epicide 3y ago
    Resins aren't always perfectly still when curing. Especially if you need large volumes of the stuff. Not to mention, time becomes a factor pretty quickly. The faster the cure for the resin, the more exothermic it is (along with higher risk of thermal runaway), which increases the chance of shifting. Not to mention, you'd also need a really effective solvent for resin that doesn't also happen to be a solvent for whatever the mosaic is made of. Perhaps the mosaic is made of resin beads. All that being said, it's virtually guaranteed that a valid attack on these methods exists. There's no such thing as perfect security. It's always a case of evaluating your threat model to make security attempts that thwart a constantly moving array of types of attack.
    - whamlastxmas 3y ago
      I'd go for injecting non-electrically conductive liquid that can both freeze and evaporate, freezing the liquid, remove electronics, tamper, replace, pull a light vacuum and air to remove liquid/allow evaporation
- deleted 3y ago
  [deleted]
tastyfreeze 3y ago
Go old school with a wax seal and a signet ring.
- Mountain_Skies 3y ago
  You need multiple color wax and a photo of the pattern for that to work.
dpifke 3y ago
The past few years at DEF CON, there's been a "village" where you can practice (or watch others) defeating such schemes: https://info.defcon.org/village/?id=67 https://info.defcon.org/village/?id=67
josefx 3y ago
> There are ways to exploit this system, but it probably helps against a non-sophisticated attacker. The LockPickingLawyer on youtube demonstrated that you can just unglue the commonly used tamper seals with a bit of alcohol and reapply them when it had time to evaporate. Someone watching his channel wanted to use a lock sealed with them as proof that LPL was picking locks off camera first and all he got was proof that the seals where useless.
- dcdc123 3y ago
  https://youtube.com/watch?v=xUJtqvYDnkg https://youtube.com/watch?v=xUJtqvYDnkg
- noSyncCloud 3y ago
  Video in question: https://youtu.be/xUJtqvYDnkg?si=RgpKWJC81V7NVtUd https://youtu.be/xUJtqvYDnkg?si=RgpKWJC81V7NVtUd
XorNot 3y ago
Kind of depends on what you mean by sophisticated. X-Ray imaging has gotten surprisingly affordable: https://www.ebay.com.au/itm/386247465197 https://www.ebay.com.au/itm/386247465197 (honestly I was looking for canister X-Ray machines which are a bit safer for this, now I'm seeing these things and thinking "is my search for a way to find joists in walls actually over?)

by p1mrx 3y ago

cfield 3y ago

How about glitter nail polish? https://news.ycombinator.com/item?id=6986327 https://news.ycombinator.com/item?id=6986327

p1mrx 3y ago
Yeah, that may be a better idea. I see that some brands of nail polish use coarser flecks that would be easier to compare visually.
jacquesm 3y ago
That's so funny, I once long ago worked on a project that suspended retro reflective beads in a solution to get unique patterns, this is a very simple variation on that theme and probably a more effective one.

jamesrom 3y ago

State of the art is a bag of beans: https://dys2p.com/en/2021-12-tamper-evident-protection.html https://dys2p.com/en/2021-12-tamper-evident-protection.html

Cpoll 3y ago
I wonder if there's no attack on these. I think I'm fantasizing, and I suspect this won't work, but: Inject the vacuum-sealed package with a thermal plastic/resin that keeps the beans in position. Then cut open the solid beans and extract what you need. Once you're done, re-assemble, re-vacuum and then heat while applying vacuum to remove the resin.
- epicide 3y ago
  Resins aren't always perfectly still when curing. Especially if you need large volumes of the stuff. Not to mention, time becomes a factor pretty quickly. The faster the cure for the resin, the more exothermic it is (along with higher risk of thermal runaway), which increases the chance of shifting. Not to mention, you'd also need a really effective solvent for resin that doesn't also happen to be a solvent for whatever the mosaic is made of. Perhaps the mosaic is made of resin beads. All that being said, it's virtually guaranteed that a valid attack on these methods exists. There's no such thing as perfect security. It's always a case of evaluating your threat model to make security attempts that thwart a constantly moving array of types of attack.
  - whamlastxmas 3y ago
    I'd go for injecting non-electrically conductive liquid that can both freeze and evaporate, freezing the liquid, remove electronics, tamper, replace, pull a light vacuum and air to remove liquid/allow evaporation
deleted 3y ago
[deleted]

tastyfreeze 3y ago

Go old school with a wax seal and a signet ring.

Mountain_Skies 3y ago
You need multiple color wax and a photo of the pattern for that to work.

dpifke 3y ago

The past few years at DEF CON, there's been a "village" where you can practice (or watch others) defeating such schemes: https://info.defcon.org/village/?id=67 https://info.defcon.org/village/?id=67

josefx 3y ago

> There are ways to exploit this system, but it probably helps against a non-sophisticated attacker. The LockPickingLawyer on youtube demonstrated that you can just unglue the commonly used tamper seals with a bit of alcohol and reapply them when it had time to evaporate. Someone watching his channel wanted to use a lock sealed with them as proof that LPL was picking locks off camera first and all he got was proof that the seals where useless.

dcdc123 3y ago
https://youtube.com/watch?v=xUJtqvYDnkg https://youtube.com/watch?v=xUJtqvYDnkg
noSyncCloud 3y ago
Video in question: https://youtu.be/xUJtqvYDnkg?si=RgpKWJC81V7NVtUd https://youtu.be/xUJtqvYDnkg?si=RgpKWJC81V7NVtUd

XorNot 3y ago

Kind of depends on what you mean by sophisticated. X-Ray imaging has gotten surprisingly affordable: https://www.ebay.com.au/itm/386247465197 https://www.ebay.com.au/itm/386247465197 (honestly I was looking for canister X-Ray machines which are a bit safer for this, now I'm seeing these things and thinking "is my search for a way to find joists in walls actually over?)