5 ms·

Are passwords stored in ____________ safe? No. Next question. ;) Are they "safe enough"? Maybe, it depends entirely on your use case.

syntheticnature 13y ago
Interestingly, one value that fits in that blank is "your head."
- btian 13y ago
  Still unsafe because I'll reveal it if they (e.g., NSA, CIA) torture me, threaten to kill my family etc.
  - dsego 13y ago
    Or a new technology is invented to read the human mind.
    - ogreyonder 13y ago
      Or a technology already exists :) "UC Berkeley scientists have developed a system to capture visual activity in human brains and reconstruct it as digital video clips..." http://gizmodo.com/5843117/scientists-reconstruct-video-clips-from-brain-activity http://gizmodo.com/5843117/scientists-reconstruct-video-clip...
    - aperrien 13y ago
      Like this technology? https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/martinovic https://www.usenix.org/conference/usenixsecurity12/technical...
  - syntheticnature 13y ago
    That's the idea -- even your mind is not a safe place for a password.
  - deleted 13y ago
    [deleted]
- robmcm 13y ago
  As this story illustrates: http://www.bbc.co.uk/news/uk-25745989 http://www.bbc.co.uk/news/uk-25745989
  - joering2 13y ago
    +1. First, I wish to know what technology he used. Is TrueCrypt sufficient (with similarly strong password). Not because I have to hide anything, of course, just my wife wants me to encrypt our spicy photos, in case :) Second, I am not sure I understand the judge decision. If the man truly forgot it, or lets say the files on USB got corrupted (can happen) and the password he is giving out does not work, then how can you continue to jail him (for that reason)? Is this something specific to UK, or are similar US cases out there?
    - aper 13y ago
      What if I have just erased my USB-stick with good dose of /dev/random and haven't actually formatted it to any filesystem yet. Good encryption is indistinguishable from randomness, so could they blame me for not giving up password and jail me for carrying randomness in my pocket?
      - robmcm 13y ago
        I think they will use that to put you away, if they don't believe you...
      - acdha 13y ago
        In many countries they can jail you for failure to disclose encryption keys – for example, in the UK you could spend two years in jail unless you could convince the court that there was in fact no encrypted data on that USB key: http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingd...
      - 0xdeadbeefbabe 13y ago
        If they did arrest you for that, but you aren't really Jack Bauer you could at least get points on hn for writing the story of "How I was arrested for carrying random data on my usb stick"
- Toenex 13y ago
  thumb screws is all anyone would need with me.
  - cobrausn 13y ago
    The threat of lengthy prison sentences is the more 'civilized' version of this.
saraid216 13y ago
Yeah. Safety and security seem to be fundamentally misunderstood by most people: they simply don't know what a threat analysis is, how to do one, or why it's important. If you can't answer, "From who?", then the answer is flatly, "No." I have a hard time understanding why such a skill is so rare. It seems sort of useful.

syntheticnature 13y ago

Interestingly, one value that fits in that blank is "your head."

btian 13y ago
Still unsafe because I'll reveal it if they (e.g., NSA, CIA) torture me, threaten to kill my family etc.
- dsego 13y ago
  Or a new technology is invented to read the human mind.
  - ogreyonder 13y ago
    Or a technology already exists :) "UC Berkeley scientists have developed a system to capture visual activity in human brains and reconstruct it as digital video clips..." http://gizmodo.com/5843117/scientists-reconstruct-video-clips-from-brain-activity http://gizmodo.com/5843117/scientists-reconstruct-video-clip...
  - aperrien 13y ago
    Like this technology? https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/martinovic https://www.usenix.org/conference/usenixsecurity12/technical...
- syntheticnature 13y ago
  That's the idea -- even your mind is not a safe place for a password.
- deleted 13y ago
  [deleted]
robmcm 13y ago
As this story illustrates: http://www.bbc.co.uk/news/uk-25745989 http://www.bbc.co.uk/news/uk-25745989
- joering2 13y ago
  +1. First, I wish to know what technology he used. Is TrueCrypt sufficient (with similarly strong password). Not because I have to hide anything, of course, just my wife wants me to encrypt our spicy photos, in case :) Second, I am not sure I understand the judge decision. If the man truly forgot it, or lets say the files on USB got corrupted (can happen) and the password he is giving out does not work, then how can you continue to jail him (for that reason)? Is this something specific to UK, or are similar US cases out there?
  - aper 13y ago
    What if I have just erased my USB-stick with good dose of /dev/random and haven't actually formatted it to any filesystem yet. Good encryption is indistinguishable from randomness, so could they blame me for not giving up password and jail me for carrying randomness in my pocket?
    - robmcm 13y ago
      I think they will use that to put you away, if they don't believe you...
    - acdha 13y ago
      In many countries they can jail you for failure to disclose encryption keys – for example, in the UK you could spend two years in jail unless you could convince the court that there was in fact no encrypted data on that USB key: http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingd...
    - 0xdeadbeefbabe 13y ago
      If they did arrest you for that, but you aren't really Jack Bauer you could at least get points on hn for writing the story of "How I was arrested for carrying random data on my usb stick"
Toenex 13y ago
thumb screws is all anyone would need with me.
- cobrausn 13y ago
  The threat of lengthy prison sentences is the more 'civilized' version of this.

saraid216 13y ago

Yeah. Safety and security seem to be fundamentally misunderstood by most people: they simply don't know what a threat analysis is, how to do one, or why it's important. If you can't answer, "From who?", then the answer is flatly, "No." I have a hard time understanding why such a skill is so rare. It seems sort of useful.