3 ms·
Why not one-time use codes (e.g. [1]) instead of the phone? You can discreetly destroy the list that you carry as long as you can only get a new list at your de
by zeteo 13y ago
Why not one-time use codes (e.g. [1]) instead of the phone? You can discreetly destroy the list that you carry as long as you can only get a new list at your destination.
[1] https://support.google.com/accounts/answer/1187538 https://support.google.com/accounts/answer/1187538
- edent 13y agoThat rather assumes that you have a convenient, fast, and unobtrusive way of destroying the list while being told "would you mind stepping over here, sir" in an airport full of security cameras. The alternative - and much more practical suggestion - is not to travel with the codes. You run the risk of not being able to connect to the service - but at least no-one else can.
- zeteo 13y agoRice paper doesn't taste too bad. How will they prove in court that my snack had security codes on it?
- delinka 13y agoStartup idea: Security Snacks - one-time pads printed on pairs of snack foods
- peterwwillis 13y agoJournalists concerned with being detained already wipe their data or ship SD cards separately for fear of being compelled to forfeit them. They can simply discard the list before they head to the airport. The most practical way to use this for non-2fa sites would be to have an overly long, random password and save it in the browser's password manager. Delete the Firefox profile before you travel, and you can't be compelled to reveal the password you could never remember. An easier alternative might be using Deniable Encryption (http://en.wikipedia.org/wiki/Deniable_encryption http://en.wikipedia.org/wiki/Deniable_encryption)
- viraptor 13y agoThere's a big difference though. If you destroy your way of accessing the data after you've been asked to provide it (or when you expect the person you talk to will ask you to provide it), then it may be looked at in a very different way than if you really don't have it to begin with.
- DanBC 13y agoThe requirement under RIPA is not to hand over the keys, but to make the encrypted content available - to decrypt it. By destroying the OTPs you are a: provably preventing access to the content (2 year or 5 year jail sentence)
- davorak 13y agoYou make it sound like they could demand that I access the encrypted content on a random third party and put me in jail for not coming up with mathematical break through needed to decrypted the data without the passphrase. I doubt the law is that strict. Do you know what level of suspicion or proof for the court to apply jail time?
- drill_sarge 13y agohttp://www.legislation.gov.uk/ukpga/2000/23/section/49 http://www.legislation.gov.uk/ukpga/2000/23/section/49
- davorak 13y agoThanks, also of interest might be the overview notes for section 49: http://www.legislation.gov.uk/ukpga/2000/23/notes/division/6/5/1 http://www.legislation.gov.uk/ukpga/2000/23/notes/division/6... However after reading about section 49 for the last few minutes I did not spot what the burden of proof is for non-compliance, the range of penalties for non-compliance nor how it scales with offense, and I do not now what "on reasonable grounds", a requirement to use section 49, means in UK law. Another interesting quote is that inorder to issue a notice you "must describe the protected information to which the notice relates;" What counts as describe in UK law? I would hope that authorities would not just beable to guess at the structure. I would hope they are require to have some other evidence that would allow them to describe the information they are seeking.
- DanBC 13y ago> Do you know what level of suspicion or proof for the court to apply jail time? I genuinely do not know anymore. I knew that anti-terror laws were being broken every day in this country. I never imagined it was going to be as flagrant as detaining the husband of a journalist as he changed airplanes in the UK.