3 ms·
>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "
by johnnyApplePRNG 3mo ago
>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries;
This would evade 99% of them.
Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things".
I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example.
They took everything. They found everything. Everything except for the $1,000 piece of drug paraphernalia I had sitting right out in open view in the middle of the apartment... the Volcano vaporizer.
It didn't look like anything they had seen before so they didn't think anything of it.
Same would be true with this USB drive in 99% of border crossing privacy invasions... plug in USB, ask for password, read it/copy it/whatever... they're not taking it apart and performing open heart surgery on a $5 USB drive at the border.
They might throw it out... or keep it or something... sure... but in general... this is a hell of a lot better than a regular USB drive imho.
- matheusmoreira 3mo ago> It didn't look like anything they had seen before so they didn't think anything of it. You will miss your government's incompetence when they start rectifying these failures. I know I do. They are the tyrants who oppress us with a clean conscience. They never rest and have infinite money. Their occasional episodes of bumbling incompetence is the only respite, but those won't last. Especially now with AI to think for them.
- pixl97 3mo agoYa. Especially when were at the point they know you know about hidden encrypted disks because they have your full internet history for the last 10 years. I guess it's human nature to build the Torment Nexus.
- deleted 3mo ago[deleted]
- brookst 3mo agoActually I’ve found some flaws in the Torment Nexus and have a PR to improve it.
- tptacek 3mo agoThis is self-soothing, not a real security plan. It doesn't matter how competent a security agency is, because there's a whole ecosystem of vendors selling into that space; knowledge of how to attack encrypted disks like this is outsourced, and, importantly, those firms have incentives to mop up even random stuff like this, because vendors will be selected in part based on lists of how many different circumvention and privacy tools they can detect.
- LorenPechtel 3mo agoThis isn't stand-up-to-state-actors security. This is keep-state-actors-from-noticing security. They know you're guilty, they'll get it. The XKCD version of password cracking works no matter how secure your hardware. But while states realistically can crack most anything it doesn't mean they can crack *every*thing. There are simply too many flash drives crossing the border every day. But there is a big flaw I see: 8gb. You're carting around an 8gb flash drive these days??
- giancarlostoro 3mo ago> The XKCD version of password cracking works no matter how secure your hardware. Lavabit would like to enter the conversation.
- ThePowerOfFuet 3mo agoThe xkcd approach worked in that case; the wrench in that case was legal, not physical, but boy would it have hurt nonetheless.
- giancarlostoro 3mo agoHe deleted everything ultimately. He printed it out in ultra tiny font in order to comply, but it was nearly impossible for law enforcement to use it. The FBI never decrypted the files.
- 3mo ago
- fhdkweig 3mo ago> Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". The state-level threat isn't just about the direct employees' competence. They also have the funding to purchase tools made by people who really know what they are doing. Think of things like Pegasus spyware or Darksword iPhone hacking. I can believe that a keystone cop wouldn't know the difference between a bong and a flower vase, but border crossing guards will know a USB drive when they see one and pass a copy of it to someone who knows what they are doing.
- johnnyApplePRNG 3mo agoPegasus spyware operations cost something like $500k a pop, last I checked.
- tptacek 3mo agoCan you check again and share where you're getting that number?
- fhdkweig 3mo agoThat's kinda the defining characteristic of a state-level threat. They have all the money they could ever need. The reason Pegasus can charge that much is because there are people able and willing to pay that much.
- NetMageSCW 3mo ago
- dijit 3mo agoI was arrested once and interrogated in great detail about how to access the data on a bluetooth usb dongle. Just to say, I know what you mean.
- marysol5 3mo agoIn court I had to explain how a TPM works, to the prosecution.....
- giancarlostoro 3mo agoAnyone using forensic software can dump an image of your entire drive including all partitions, byte for byte copy. Just because you got away with being careless once doesn't mean this will work every time. If you don't want your files to be copied in encrypted or plain unencrypted form, don't bring them with you. You're better off re-downloading them over the web at that point.
- ted_dunning 3mo agoUnless they disassemble this drive, a forensic dump will only show the open partition.
- marysol5 3mo agoA cursory X-Ray would show the internal SD. This product needs a hardware re-design (which I've seen other projects do) to have onboard flash instead. Saying that, any proper investigation would read the firmware from the flash and identify the decryption routing anyway
- zyx321 3mo agoIt has an SD card because proper flash is expensive. Surely the people making "4TB" flash drives on Temu must be using the same methods, or else they will be soon.
- ozim 3mo agoYou are conflating „state level actor” with „police level action”. There is a world of difference if you get searched by your local police and a country level agency. There are military units dealing with forensic investigations they have 100x or 1000x more budget and much smarter people. But they don’t care about some drug dealers. They don’t waste time on silly stuff.
- marysol5 3mo agoThe military really doesn’t have "much smarter people", the intelligent people are all in private industry, then LEO, THEN the military. The military is stuffed full of grunts who are just there for the pay, and in many cases, conscription. You can throw all the money you want at something, it doesn't make it work, just look at the US military
- XorNot 3mo agoTrying to keep data on a USB drive hidden long term is a losing game is the thing. If you're intercepted with anything of value what you want is to rapidly destroy it. This was the big problem I found when I was trying to figure out a secure way use Yubikeys: they're both long term unreliable, and short term impossible to wipe or destroy fast enough. Literally a printout of 1 time passwords has better security properties in an adversarial situation. For a storage device what you want isn't a secure store, what you want is a pin pull or switch which wipes it instantly.
- stackghost 3mo ago>Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". Even dumb cops know how to use a Cellebrite machine.
- throwawayffffas 3mo ago> This would evade 99% of them. > Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things" Famous last words. Do not underestimate the police, they have been doing this longer than you, they typically have highly sophisticated people working for them, and at the border they have enormous resources behind them.