6 ms·
If I understand correctly, the key feature of OTR is its plausible deniability; the messages you send do not have a digital signature that a third party can use
by aes256 14y ago
If I understand correctly, the key feature of OTR is its plausible deniability; the messages you send do not have a digital signature that a third party can use to verify their integrity, but the other party in the conversation is able to verify them.
Is that really going to hold up in court? Surely by the same token I could dismiss absolutely everything there is any record of me sending or receiving over HTTP because it could theoretically have been forged or tampered with in transit.
- snowwrestler 14y agoIs plausible deniability an actual legal concept at all? I see it used here and on other technical forums in topics like this, but aside from that I've only ever heard of it in political, not legal, contexts. Any lawyers able to shed light?
- oconnore 14y agoThe most useful feature (of course, not a unique feature) of OTR is perfect forward secrecy. This means that, unlike GPG, you can lose your private key and not give up everything you have ever encrypted. The plausible deniability stuff is probably not that useful in court, as you note.
- georgeorwell 14y agoIf the 'plausible deniability' is not that useful in court, that means it isn't plausible deniability. It's better to say that OTR doesn't provide plausible deniability, even though it claims to, if that's what you believe. (I don't have an opinion either way.)
- aes256 14y agoIt's plausible deniability, but that alone isn't sufficient to avoid prosecution in most jurisdictions. The standard in most jurisdictions is proof beyond reasonable doubt. I don't think the OTR plausible deniability would be considered reasonable doubt, especially if the content of the messages is corroborated by other evidence.
- georgeorwell 14y agoI always thought the term plausible deniability implied reasonable doubt, and that if it didn't, it wasn't plausible deniability. I mean, there's not much point in claiming something offers plausible deniability if it isn't a valid defense in court. Or is there? Do you have an example from actual case law? All I have is Wikipedia: "Plausible deniability is also a legal concept. It refers to lack of evidence proving an allegation. Standards of proof vary in civil and criminal cases. In civil cases, the standard of proof is "preponderance of the evidence" whereas in a criminal matter, the standard is "beyond a reasonable doubt." If an opponent lacks incontrovertible proof (evidence) of their allegation, one can "plausibly deny" the allegation even though it may be true."
- stinkytaco 14y agoHowever, deniability becomes less plausible when there's other evidence that makes deniability harder... i.e. Someone claims to have had a conversation with you, the logs of the conversation exists and that person can corroborate that the person on one end was them. Of course you can claim that someone was impersonating you, but what if later you had a recorded phone conversation referencing the OTR conversation, etc. In and of itself, a piece of evidence is plausibly deniable. In the face or corroborating evidence, it may not be. Alas, however, I do not have an example from actual case law. EDIT: I knew I had seen some case law sort of related to this before and it was in re Boucher and US v. Fricosu. They are not directly related to "Plausible Deniability", rather they compelled defendents to decrypt their hard drives. Certainly in the Boucher case there was reason to believe that the contents of the drive were incriminating (the file names were the giveaway, I believe) so perhaps this does not fit in to the exact facts we are trying to recreate, but those are the only two cases that relate that I can recall.
- georgeorwell 14y agoThanks for elaborating, I better understand the claim that OTR plausible deniability is not that useful in court now.