5 ms·

Still go to prison for not showing. So until devices have multiple pins for plausible deniability we are still screwed. What’s so hard to make 2-3 pins and eac

Still go to prison for not showing. So until devices have multiple pins for plausible deniability we are still screwed. What’s so hard to make 2-3 pins and each to access different logged in apps and files. If Apple/android was serious about it would implement it, but from my research seems to be someone that it’s against it, as it’s too good. I don’t want to remove my Banking apps when I go travel or in “dangerous” places. If you re kidnapped you will be forced to send out all your money.

cr125rider 9mo ago
Fourth and Fifth amendments disagree
- twelvedogs 9mo ago
  I don't think we're doing amendments any more
  - ddtaylor 9mo ago
    And if we are it will be a new one with a high number and it will be pure insanity
- kyrra 9mo ago
  People are jailed for contempt of court for failing to provide passwords. https://reason.com/2017/05/31/florida-man-jailed-180-days-for-not-givi/ https://reason.com/2017/05/31/florida-man-jailed-180-days-fo...
  - fluoridation 9mo ago
    Wow, so US judges are just making it up as they go along, huh? It's like every case is a different judgement with no consistent criterion. >Doe vs. U.S. That case centered around whether the feds could force a suspect to sign consent forms permitting foreign banks to produce any account records that he may have. In Doe, the justices ruled that the government did have that power, since the forms did not require the defendant to confirm or deny the presence of the records. Well, what if the defendant was innocent of that charge but guilty of or involved in an unrelated matter for which there was evidence in the account records?
- lm28469 9mo ago
  Sure but in the real world it can take months or years, Francis Rawls stayed 4 years in jail because he didn't want to unlock hard drives.
jibe 9mo ago
Hannah Natanson is not in prison though.
bitexploder 9mo ago
You do not. We have this thing in our constitution called the 5th amendment. You cannot be forced to divulge the contents of your mind, including your pin or passwords. Case law supports this. For US citizens at least. Hopefully the constitution is still worth something.
- lm28469 9mo ago
  That's in the fantasy world of constitution maximalists. In real world it doesn't work like that and you might still lose money/time/your sanity fighting a system who cares less and less about your rights
  - bitexploder 9mo ago
    The case law on this specific topic is convincing. If you are ever in that situation it is usually going to be worth your time and money to assert the right and see it through. Case law supports this. The general maximum “penalty” is being held in contempt of court. And if the government is wrongly persecuting you, it is lose / lose if you divulge.
  - carlosjobim 9mo ago
    Do you think this is for fighting parking tickets? It is for journalists to not reveal their sources, whom might be at risk of severe consequences including death. That's a whole lot more to loose than your money and time.
    - lm28469 9mo ago
      That's not what we're discussing here, you can't just say "I plead the fifth" and walk away if the people in charge decided you wouldn't walk away, no matter what's right or "legal" Francis Rawls stayed 4 years in jail despite pleading the fifth all day long
      - bitexploder 9mo ago
        That case also established 18 months as an upper limit. If you are in that situation it is usually better to simply jot divulge. Especially if there is incriminating evidence. Or you are a journalist being harassed by the DOJ. It can only bring you more pain. They will always find something.
stouset 9mo ago
Absolutely every aspect of it? What’s so hard about adding a feature that effectively makes a single-user device multi-user? Which needs the ability to have plausible deniability for the existence of those other users? Which means that significant amounts of otherwise usable space needs to be inaccessibly set aside for those others users on every device—to retain plausible deniability—despite an insignificant fraction of customers using such a feature? What could be hard about that?
- izzydata 9mo ago
  It doesn't seem fundamentally different from a PC having multiple logins that are accessed from different passwords. Hasn't this been a solved problem for decades?
  - compiler-guy 9mo ago
    Multi-user has been solved for decades. Multi-user that plausibly looks like single-user to three letter agencies? Not even close.
    - izzydata 9mo ago
      Doesn't having standard multi-user functionality automatically create the plausible deniability? If they tried so hard to create an artificial plausible deniability that would be more suspicious than normal functionality that just gets used sometimes.
      - wtallis 9mo ago
        What needs to be plausibly denied is the existence of a second user account, because you're not going to be able to plausibly deny that the account belongs to you when it resides on the phone found in your pocket.
  - paulryanrogers 9mo ago
    Apple's hardware business model incentivizes only supporting one user per device. Android has supported multiple users per device for years now.
lm28469 9mo ago
Yep, you need an emergency mode that completely resets the phone to factory settings, maybe triggered with a decoy pin. Or a mode that physically destroys the chip storing the keys
Cthulhu_ 9mo ago
How does "go to prison for not showing" work when a lot of constitutions have a clause for a suspect not needing to participate in their own conviction / right to remain silent? A detective can have a warrant to search someone's home or car, but that doesn't mean the owner needs to give them the key as far as I know.
- SoftTalker 9mo ago
  It does mean that. You can't be forced to divulge information in your head, as that would be testimonial. But if there are papers, records, or other evidentiary materials that are e.g. locked in a safe you can be compelled to open it with a warrant, and refusal would be contempt.
  - parineum 9mo ago
    I know it seems like an incredibly dubious claim but the "I forgot" defense actually works here. It's not really that useful for a safe since they aren't _that_ difficult to open and, if you haven't committed a crime, it's probably better to open your safe for them than have them destroy it so you need a new one. For a mathematically impossible to break cipher though, very useful.
  - Steltek 9mo ago
    They need to prove that those materials exist on the device first. You can't be held in contempt for a fishing expedition.
    - SoftTalker 9mo ago
      You need "probable cause to believe" which is not as strong as "prove" but yes, it can't be a pure fishing expedition.
  - lostlogin 9mo ago
    FaceID and TouchID aren’t protected by that as I understand it.
frogcommander 9mo ago
Why are you on a website for programmers and software developers if you arent a software developer and you know nothing of the subject?
- deleted 9mo ago
  [deleted]
palmotea 9mo ago
> Still go to prison for not showing. So until devices have multiple pins for plausible deniability we are still screwed. > What’s so hard to make 2-3 pins and each to access different logged in apps and files. Besides the technical challenges, I think there's a pretty killer human challenge: it's going to be really hard for the user to create an alternate account that looks real to someone who's paying attention. Sure, you can probably fool some bored agent in customs line who knows nothing about you, but not a trained investigator who's focused on you and knows a lot about you.
- davidwritesbugs 9mo ago
  Background agent in the decoy identity that periodically browses the web, retrieves email from a banal account etc.?
  - palmotea 9mo ago
    > Background agent in the decoy identity that periodically browses the web, retrieves email from a banal account etc.? No. Think about it for a second: you're a journalist being investigated to find your sources, and your phone says you mainly check sports scores and send innocuous emails to "grandma" in LLM-speak? It's not going to fool someone who's actually thinking.
  - stouset 9mo ago
    Even more complications for a “why can’t they just…”. It’s almost as if this kind of thing is difficult to do in practice.
- fluoridation 9mo ago
  But at that point it turns from "the person refused to unlock the device" to "we think the person has unlocked the device into a fake account".
  - skeptic_ai 9mo ago
    That’s what plausible deniability. How can you even tell?
eduction 9mo ago
Completely separate decision with a higher legal bar for doing that. It's one thing to allow police to search a phone. Another to compel someone to unlock the device. We live in a world of grays and nuance and an "all or nothing" outlook on security discourages people from taking meaningful steps to protect themselves.
Blackthorn 9mo ago
They are willing to kill people and then justify it by calling them terrorists. Plausible deniability is pointless.
- jb1991 9mo ago
  Uh, that escalated quickly.
  - ryanmcbride 9mo ago
    Actually it's been escalating pretty steadily for 250 years
DamnInteresting 9mo ago
> What’s so hard to make 2-3 pins and each to access different logged in apps and files. I've been advocating for this under-duress-PIN feature for years, as evidenced by this HN comment I made about 9 years ago: https://news.ycombinator.com/item?id=13631653 https://news.ycombinator.com/item?id=13631653 Maybe someday.
ryanmcbride 9mo ago
It's more a policy problem than a phone problem. Apple could add as many pins as they want but until there are proper legal based privacy protections, law enforcement will still just be like "well how do we know you don't have a secret pin that unlocks 40TB of illegal content? Better disappear you just to be sure" For as long as law enforcement treats protection of privacy as implicit guilt, the best a phone can really do is lock down and hope for the best. Even if there was a phone that existed that perfectly protected your privacy and was impossible to crack or was easy to spoof content on, law enforcement would just move the goal post of guilt so that owning the phone itself is incriminating. Edit: I wanna be clear that I'm not saying any phone based privacy protections are a waste of time. They're important. I'm saying that there is no perfect solution with the existing policy being enforced, which is "guilty until proven dead"
pluralmonad 9mo ago
I always wondered if this was the feature of TrueCrypt that made it such a big target. LUKS is fine, I guess, but TrueCrypt felt like actual secrecy.
snowwrestler 9mo ago
“Plausible deniability” is a public relations concept. It doesn’t confer any actual legal protection.
- dkarras 9mo ago
  It absolutely offers some legal protection. If it is implemented correctly, no legal framework for it is required. Government forces you to enter your password. You comply and enter "a" password. The device shows contents. You did what you were asked to do. If there is no way for the government to prove that you entered a decoy password that shows decoy contents, you are in the clear. Done correctly (in device and OPSEC) government can't prove you entered your decoy password so you can't be held in contempt. And that is the entire point. It is not like asking the government to give your "plausible deniability" rights. It is about not potentially incriminating yourself against people that abuse the system to force you to incriminate yourself.
  - snowwrestler 9mo ago
    > You comply and enter "a" password. The device shows contents. You did what you were asked to do. No, you did something fake to avoid doing what you were asked to do. > If there is no way for the government to prove that you entered a decoy password that shows decoy contents, you are in the clear. But there are very effective ways to find hidden encrypted volumes on devices. And then you’ll be asked to decrypt those too, and then what? This sort of thing is already table stakes for CSAM prosecutions, for example. Law enforcement can read the same blog posts and know as much about technology as you do. Especially if we are hypothesizing an advertised feature of a commercial OS!
    - dkarras 9mo ago
      >No, you did something fake to avoid doing what you were asked to do. Yes, that is what plausible deniability is. >But there are very effective ways to find hidden encrypted volumes on devices. And then you’ll be asked to decrypt those too, and then what? I emphasized "done right". If existence of hidden encryption can be proven, then you don't have plausible deniability. Something has gone wrong. My point was: OP claimed plausible deniability does not apply in legal cases which is a weird take. If you can have plausible deniability, then it can save you legally. This does not only apply to tech of course, but encryption was the subject here. In all cases though, if your situation is not "plausible" (due to broken tech, backdoors, poor OPSEC in tech, and / or damning other evidence in other cases as well) then you don't have plauisble deniability by definition. Having ways of definitively detecting hidden encrypted volumes might be the norm today, might be impossible tomorrow. Then you will have plausible deniability and it will work legally as far as that piece of "evidence" is concerned.
Zak 9mo ago
Assuming the rule of law is still functioning, there are multiple protections for journalists who refuse to divulge passwords in the USA. A journalist can challenge any such order in court and usually won't be detained during the process as long as they show up in court when required and haven't tried to destroy evidence. Deceiving investigators by using an alternate password, or destroying evidence by using a duress code on the other hand is almost always a felony. It's a very bad idea for a journalist to do that, as long as the rule of law is intact.
- dboreham 9mo ago
  I think it's pretty clear at this point that rule of law isn't functioning. Perhaps it never was. It was just rule of law theater.
AdamN 9mo ago
Even if this worked (which would be massively expensive to implement) the misconfiguration possibilities are endless. It wouldn't be customer-centric to actually release this capability. Better for the foreseeable future to have separate devices and separate accounts (i.e. not in the same iCloud family for instance)
eviks 9mo ago
There is no plausible deniability here, that's only relevant in a rule-of-law type of situation, but then you wouldn't need it as you can't be legally compelled to do that anyway. "We don't see any secret source communication on your work device = you entered the wrong pin = go think about what your behavior in jail"
deleted 9mo ago
[deleted]

cr125rider 9mo ago

Fourth and Fifth amendments disagree

twelvedogs 9mo ago
I don't think we're doing amendments any more
- ddtaylor 9mo ago
  And if we are it will be a new one with a high number and it will be pure insanity
kyrra 9mo ago
People are jailed for contempt of court for failing to provide passwords. https://reason.com/2017/05/31/florida-man-jailed-180-days-for-not-givi/ https://reason.com/2017/05/31/florida-man-jailed-180-days-fo...
- fluoridation 9mo ago
  Wow, so US judges are just making it up as they go along, huh? It's like every case is a different judgement with no consistent criterion. >Doe vs. U.S. That case centered around whether the feds could force a suspect to sign consent forms permitting foreign banks to produce any account records that he may have. In Doe, the justices ruled that the government did have that power, since the forms did not require the defendant to confirm or deny the presence of the records. Well, what if the defendant was innocent of that charge but guilty of or involved in an unrelated matter for which there was evidence in the account records?
lm28469 9mo ago
Sure but in the real world it can take months or years, Francis Rawls stayed 4 years in jail because he didn't want to unlock hard drives.

jibe 9mo ago

Hannah Natanson is not in prison though.

bitexploder 9mo ago

You do not. We have this thing in our constitution called the 5th amendment. You cannot be forced to divulge the contents of your mind, including your pin or passwords. Case law supports this. For US citizens at least. Hopefully the constitution is still worth something.

lm28469 9mo ago
That's in the fantasy world of constitution maximalists. In real world it doesn't work like that and you might still lose money/time/your sanity fighting a system who cares less and less about your rights
- bitexploder 9mo ago
  The case law on this specific topic is convincing. If you are ever in that situation it is usually going to be worth your time and money to assert the right and see it through. Case law supports this. The general maximum “penalty” is being held in contempt of court. And if the government is wrongly persecuting you, it is lose / lose if you divulge.
- carlosjobim 9mo ago
  Do you think this is for fighting parking tickets? It is for journalists to not reveal their sources, whom might be at risk of severe consequences including death. That's a whole lot more to loose than your money and time.
  - lm28469 9mo ago
    That's not what we're discussing here, you can't just say "I plead the fifth" and walk away if the people in charge decided you wouldn't walk away, no matter what's right or "legal" Francis Rawls stayed 4 years in jail despite pleading the fifth all day long
    - bitexploder 9mo ago
      That case also established 18 months as an upper limit. If you are in that situation it is usually better to simply jot divulge. Especially if there is incriminating evidence. Or you are a journalist being harassed by the DOJ. It can only bring you more pain. They will always find something.

stouset 9mo ago

Absolutely every aspect of it? What’s so hard about adding a feature that effectively makes a single-user device multi-user? Which needs the ability to have plausible deniability for the existence of those other users? Which means that significant amounts of otherwise usable space needs to be inaccessibly set aside for those others users on every device—to retain plausible deniability—despite an insignificant fraction of customers using such a feature? What could be hard about that?

izzydata 9mo ago
It doesn't seem fundamentally different from a PC having multiple logins that are accessed from different passwords. Hasn't this been a solved problem for decades?
- compiler-guy 9mo ago
  Multi-user has been solved for decades. Multi-user that plausibly looks like single-user to three letter agencies? Not even close.
  - izzydata 9mo ago
    Doesn't having standard multi-user functionality automatically create the plausible deniability? If they tried so hard to create an artificial plausible deniability that would be more suspicious than normal functionality that just gets used sometimes.
    - wtallis 9mo ago
      What needs to be plausibly denied is the existence of a second user account, because you're not going to be able to plausibly deny that the account belongs to you when it resides on the phone found in your pocket.
- paulryanrogers 9mo ago
  Apple's hardware business model incentivizes only supporting one user per device. Android has supported multiple users per device for years now.

lm28469 9mo ago

Yep, you need an emergency mode that completely resets the phone to factory settings, maybe triggered with a decoy pin. Or a mode that physically destroys the chip storing the keys

Cthulhu_ 9mo ago

How does "go to prison for not showing" work when a lot of constitutions have a clause for a suspect not needing to participate in their own conviction / right to remain silent? A detective can have a warrant to search someone's home or car, but that doesn't mean the owner needs to give them the key as far as I know.

SoftTalker 9mo ago
It does mean that. You can't be forced to divulge information in your head, as that would be testimonial. But if there are papers, records, or other evidentiary materials that are e.g. locked in a safe you can be compelled to open it with a warrant, and refusal would be contempt.
- parineum 9mo ago
  I know it seems like an incredibly dubious claim but the "I forgot" defense actually works here. It's not really that useful for a safe since they aren't _that_ difficult to open and, if you haven't committed a crime, it's probably better to open your safe for them than have them destroy it so you need a new one. For a mathematically impossible to break cipher though, very useful.
- Steltek 9mo ago
  They need to prove that those materials exist on the device first. You can't be held in contempt for a fishing expedition.
  - SoftTalker 9mo ago
    You need "probable cause to believe" which is not as strong as "prove" but yes, it can't be a pure fishing expedition.
- lostlogin 9mo ago
  FaceID and TouchID aren’t protected by that as I understand it.

frogcommander 9mo ago

Why are you on a website for programmers and software developers if you arent a software developer and you know nothing of the subject?

deleted 9mo ago
[deleted]

palmotea 9mo ago

> Still go to prison for not showing. So until devices have multiple pins for plausible deniability we are still screwed. > What’s so hard to make 2-3 pins and each to access different logged in apps and files. Besides the technical challenges, I think there's a pretty killer human challenge: it's going to be really hard for the user to create an alternate account that looks real to someone who's paying attention. Sure, you can probably fool some bored agent in customs line who knows nothing about you, but not a trained investigator who's focused on you and knows a lot about you.

davidwritesbugs 9mo ago
Background agent in the decoy identity that periodically browses the web, retrieves email from a banal account etc.?
- palmotea 9mo ago
  > Background agent in the decoy identity that periodically browses the web, retrieves email from a banal account etc.? No. Think about it for a second: you're a journalist being investigated to find your sources, and your phone says you mainly check sports scores and send innocuous emails to "grandma" in LLM-speak? It's not going to fool someone who's actually thinking.
- stouset 9mo ago
  Even more complications for a “why can’t they just…”. It’s almost as if this kind of thing is difficult to do in practice.
fluoridation 9mo ago
But at that point it turns from "the person refused to unlock the device" to "we think the person has unlocked the device into a fake account".
- skeptic_ai 9mo ago
  That’s what plausible deniability. How can you even tell?

eduction 9mo ago

Completely separate decision with a higher legal bar for doing that. It's one thing to allow police to search a phone. Another to compel someone to unlock the device. We live in a world of grays and nuance and an "all or nothing" outlook on security discourages people from taking meaningful steps to protect themselves.

Blackthorn 9mo ago

They are willing to kill people and then justify it by calling them terrorists. Plausible deniability is pointless.

jb1991 9mo ago
Uh, that escalated quickly.
- ryanmcbride 9mo ago
  Actually it's been escalating pretty steadily for 250 years

DamnInteresting 9mo ago

> What’s so hard to make 2-3 pins and each to access different logged in apps and files. I've been advocating for this under-duress-PIN feature for years, as evidenced by this HN comment I made about 9 years ago: https://news.ycombinator.com/item?id=13631653 https://news.ycombinator.com/item?id=13631653 Maybe someday.

ryanmcbride 9mo ago

It's more a policy problem than a phone problem. Apple could add as many pins as they want but until there are proper legal based privacy protections, law enforcement will still just be like "well how do we know you don't have a secret pin that unlocks 40TB of illegal content? Better disappear you just to be sure" For as long as law enforcement treats protection of privacy as implicit guilt, the best a phone can really do is lock down and hope for the best. Even if there was a phone that existed that perfectly protected your privacy and was impossible to crack or was easy to spoof content on, law enforcement would just move the goal post of guilt so that owning the phone itself is incriminating. Edit: I wanna be clear that I'm not saying any phone based privacy protections are a waste of time. They're important. I'm saying that there is no perfect solution with the existing policy being enforced, which is "guilty until proven dead"

pluralmonad 9mo ago

I always wondered if this was the feature of TrueCrypt that made it such a big target. LUKS is fine, I guess, but TrueCrypt felt like actual secrecy.

snowwrestler 9mo ago

“Plausible deniability” is a public relations concept. It doesn’t confer any actual legal protection.

dkarras 9mo ago
It absolutely offers some legal protection. If it is implemented correctly, no legal framework for it is required. Government forces you to enter your password. You comply and enter "a" password. The device shows contents. You did what you were asked to do. If there is no way for the government to prove that you entered a decoy password that shows decoy contents, you are in the clear. Done correctly (in device and OPSEC) government can't prove you entered your decoy password so you can't be held in contempt. And that is the entire point. It is not like asking the government to give your "plausible deniability" rights. It is about not potentially incriminating yourself against people that abuse the system to force you to incriminate yourself.
- snowwrestler 9mo ago
  > You comply and enter "a" password. The device shows contents. You did what you were asked to do. No, you did something fake to avoid doing what you were asked to do. > If there is no way for the government to prove that you entered a decoy password that shows decoy contents, you are in the clear. But there are very effective ways to find hidden encrypted volumes on devices. And then you’ll be asked to decrypt those too, and then what? This sort of thing is already table stakes for CSAM prosecutions, for example. Law enforcement can read the same blog posts and know as much about technology as you do. Especially if we are hypothesizing an advertised feature of a commercial OS!
  - dkarras 9mo ago
    >No, you did something fake to avoid doing what you were asked to do. Yes, that is what plausible deniability is. >But there are very effective ways to find hidden encrypted volumes on devices. And then you’ll be asked to decrypt those too, and then what? I emphasized "done right". If existence of hidden encryption can be proven, then you don't have plausible deniability. Something has gone wrong. My point was: OP claimed plausible deniability does not apply in legal cases which is a weird take. If you can have plausible deniability, then it can save you legally. This does not only apply to tech of course, but encryption was the subject here. In all cases though, if your situation is not "plausible" (due to broken tech, backdoors, poor OPSEC in tech, and / or damning other evidence in other cases as well) then you don't have plauisble deniability by definition. Having ways of definitively detecting hidden encrypted volumes might be the norm today, might be impossible tomorrow. Then you will have plausible deniability and it will work legally as far as that piece of "evidence" is concerned.

Zak 9mo ago

Assuming the rule of law is still functioning, there are multiple protections for journalists who refuse to divulge passwords in the USA. A journalist can challenge any such order in court and usually won't be detained during the process as long as they show up in court when required and haven't tried to destroy evidence. Deceiving investigators by using an alternate password, or destroying evidence by using a duress code on the other hand is almost always a felony. It's a very bad idea for a journalist to do that, as long as the rule of law is intact.

dboreham 9mo ago
I think it's pretty clear at this point that rule of law isn't functioning. Perhaps it never was. It was just rule of law theater.

AdamN 9mo ago

Even if this worked (which would be massively expensive to implement) the misconfiguration possibilities are endless. It wouldn't be customer-centric to actually release this capability. Better for the foreseeable future to have separate devices and separate accounts (i.e. not in the same iCloud family for instance)

eviks 9mo ago

There is no plausible deniability here, that's only relevant in a rule-of-law type of situation, but then you wouldn't need it as you can't be legally compelled to do that anyway. "We don't see any secret source communication on your work device = you entered the wrong pin = go think about what your behavior in jail"

deleted 9mo ago

[deleted]