4 ms·

This isn't stand-up-to-state-actors security. This is keep-state-actors-from-noticing security. They know you're guilty, they'll get it. The XKCD version of

This isn't stand-up-to-state-actors security. This is keep-state-actors-from-noticing security. They know you're guilty, they'll get it. The XKCD version of password cracking works no matter how secure your hardware. But while states realistically can crack most anything it doesn't mean they can crack *every*thing. There are simply too many flash drives crossing the border every day. But there is a big flaw I see: 8gb. You're carting around an 8gb flash drive these days??

giancarlostoro 3mo ago
> The XKCD version of password cracking works no matter how secure your hardware. Lavabit would like to enter the conversation.
- ThePowerOfFuet 3mo ago
  The xkcd approach worked in that case; the wrench in that case was legal, not physical, but boy would it have hurt nonetheless.
  - giancarlostoro 3mo ago
    He deleted everything ultimately. He printed it out in ultra tiny font in order to comply, but it was nearly impossible for law enforcement to use it. The FBI never decrypted the files.
    - akerl_ 3mo ago
      What about the other Lavabit users whose data he had handed over previously, before deciding to say no?
    - tptacek 3mo ago
      It's hard to tell if you're being serious here. At the end of the day, Lavabit's security came down to... the FBI's inability to read an ultra tiny font? That's not the actual story (like, that happened, but all it did was provoke the DOJ), but it's remarkable to see someone cite that as a success for Levison.
    - marysol5 3mo ago
      FBI = legal
tptacek 3mo ago
We're talking about exactly the same threat. What I'm pointing out is that state adversaries won't have to "notice" this; all they'll have to do is plug the device into a standard commercial forensics scanner product --- and we're stipulating that they're plugging the device in already (else what does it matter what bits are on it). They pay other people to notice this stuff for them!
- awesome_dude 3mo ago
  > They pay other people to notice this stuff for them! Money, even at state level, is not some infinite resource (and neither is time). States put effort into what they consider worth investigating - no state strip searches every incoming traveller, and goes through every item in their possession - it's possible for them to do, and if they did they'd find a hang of a lot more contraband, but it's costly, time consuming, and politically risky.
  - mediaman 3mo ago
    He's saying they just plug your USB stick into some gizmo sold to the state, and it's going to find enough to escalate it. If the idea is that there's no point in encrypting anything on a USB stick, and you just hope they don't look at it at all, sure. But there is no threat model here that includes "check the USB stick" and does not automatically lead to finding and breaking "hidden" content.
    - NetMageSCW 3mo ago
      Try to explain how the hidden content would be found? It effectively doesn’t exist until the password is in place. It isn’t hidden, it isn’t connected at all.
      - mingus88 3mo ago
        I’m no expert but I can imagine a scenario where an x-ray scan can notice an SD card embedded into the controller and flag that for follow-up SD card the author says was added to offset the cost of eMMC but would presumably stand out as anomalous with whatever AI is classifying the scan
otherme123 3mo ago
> But there is a big flaw I see: 8gb. You're carting around an 8gb flash drive these days?? What is the problem? I have promotional flash drives from 1 Gb up to 8 Gb, that I use to store music for my car, or to carry pdfs to print in shared printers. I don't care if they break or get lost. I know people that carry similar promotional items with similar capacities. What is suspicious about 8 Gb drives? Maybe the lack of external branding, like "SanDisk" or "Walmart"?
- marysol5 3mo ago
  I found a 8GB USB drive in my pocket after doing the washing the other day (RIP). I'd been using it to boot the debian installer from.
  - raddan 3mo ago
    You should check to see if it still works. My favorite thumb drive went through the washing machine several times and still works.
- LorenPechtel 3mo ago
  Most drives are bigger. I have some around that size--but they're old.
zyx321 3mo ago
It would be less suspicious if the drive advertised 512GB and returned garbage data for any read past 8GB

giancarlostoro 3mo ago

> The XKCD version of password cracking works no matter how secure your hardware. Lavabit would like to enter the conversation.

ThePowerOfFuet 3mo ago
The xkcd approach worked in that case; the wrench in that case was legal, not physical, but boy would it have hurt nonetheless.
- giancarlostoro 3mo ago
  He deleted everything ultimately. He printed it out in ultra tiny font in order to comply, but it was nearly impossible for law enforcement to use it. The FBI never decrypted the files.
  - akerl_ 3mo ago
    What about the other Lavabit users whose data he had handed over previously, before deciding to say no?
  - tptacek 3mo ago
    It's hard to tell if you're being serious here. At the end of the day, Lavabit's security came down to... the FBI's inability to read an ultra tiny font? That's not the actual story (like, that happened, but all it did was provoke the DOJ), but it's remarkable to see someone cite that as a success for Levison.
  - marysol5 3mo ago
    FBI = legal

tptacek 3mo ago

We're talking about exactly the same threat. What I'm pointing out is that state adversaries won't have to "notice" this; all they'll have to do is plug the device into a standard commercial forensics scanner product --- and we're stipulating that they're plugging the device in already (else what does it matter what bits are on it). They pay other people to notice this stuff for them!

awesome_dude 3mo ago
> They pay other people to notice this stuff for them! Money, even at state level, is not some infinite resource (and neither is time). States put effort into what they consider worth investigating - no state strip searches every incoming traveller, and goes through every item in their possession - it's possible for them to do, and if they did they'd find a hang of a lot more contraband, but it's costly, time consuming, and politically risky.
- mediaman 3mo ago
  He's saying they just plug your USB stick into some gizmo sold to the state, and it's going to find enough to escalate it. If the idea is that there's no point in encrypting anything on a USB stick, and you just hope they don't look at it at all, sure. But there is no threat model here that includes "check the USB stick" and does not automatically lead to finding and breaking "hidden" content.
  - NetMageSCW 3mo ago
    Try to explain how the hidden content would be found? It effectively doesn’t exist until the password is in place. It isn’t hidden, it isn’t connected at all.
    - mingus88 3mo ago
      I’m no expert but I can imagine a scenario where an x-ray scan can notice an SD card embedded into the controller and flag that for follow-up SD card the author says was added to offset the cost of eMMC but would presumably stand out as anomalous with whatever AI is classifying the scan

otherme123 3mo ago

> But there is a big flaw I see: 8gb. You're carting around an 8gb flash drive these days?? What is the problem? I have promotional flash drives from 1 Gb up to 8 Gb, that I use to store music for my car, or to carry pdfs to print in shared printers. I don't care if they break or get lost. I know people that carry similar promotional items with similar capacities. What is suspicious about 8 Gb drives? Maybe the lack of external branding, like "SanDisk" or "Walmart"?

marysol5 3mo ago
I found a 8GB USB drive in my pocket after doing the washing the other day (RIP). I'd been using it to boot the debian installer from.
- raddan 3mo ago
  You should check to see if it still works. My favorite thumb drive went through the washing machine several times and still works.
LorenPechtel 3mo ago
Most drives are bigger. I have some around that size--but they're old.

zyx321 3mo ago

It would be less suspicious if the drive advertised 512GB and returned garbage data for any read past 8GB