Hacker News Reader

Comment by perfectfire | Hacker News Reader

I have a way of setting and entering passwords without ever knowing what the password is. I've only ever done it on accident, but if this ever became law in the US it would become my standard way of entering passwords. They can't compel me to reveal the password because I literally don't know it.

View on HN

The cops' response will be: "Bullshit. You have to know the password, and you're going to sit in that cell until you tell us what it is."

Don't try to hack around the law. You'll fail.

How about under stress you have trouble remember the password, and thinking of the wrong password, can corrupt your knowledge of the right password (in my experience and knowledge this can actually happen yes)? How about old encrypted backup zips ? Encrypted media files from your browser by media streaming services ? How about pressure ? How about some people cannot remember a password without being in the right place (yes this exists) ? How about passwords you use for more then service ? What about public encryptions keys stored on your computer, are they encrypted data or random bytes ? How about the stenography data probably encoded in the music you downloaded from your music provider ?

These sort of laws create many problems one can not hope solve without a few punishing/ruining the life/killing of a few innocent bystanders.

> How about under stress you have trouble remember the password

Reply will be: "You'll get plenty of time in jail to relax and think about it".

I know we're talking about Canada in the article, and that there are differences in the laws around this.

There's a guy currently sitting in a US jail, I think in Georgia, held on contempt of court charges. He was originally charged with murder, and during his trial, he managed to goad the judge into an absurd argument, part of which involved the defendant wanting to defend himself. I'll skip the details. There's a Rick and Morty cartoon out there about it...

Anyways, to my point. The judge has the power to keep this guy in jail more or less indefinitely. You can argue with the cops, you can argue with your lawyer, but if it's in the law and you try to argue it with the judge, you're staying in jail.

Canada has strong protections against indefinite incarceration.

5 years isn't indefinite. It's definite. 5 years is a ridiculously long time, but it's what England implemented for RIPA if the encrypted material is thought to be images of child sexual abuse.

I'd have to look it up but if I recall correctly in the UK not disclosing your password carries a penalty of 2 years maximum.

Which if you think about it is stupid since in a situation where you have encrypted data that proves your are a terroist, paedophile or serious criminal, 2 years for not disclosing your password vs 10+ for disclosing it is simple game theory.

Not to mention the stigma of going to prison for not disclosing your password vs the above mentioned crimes.

It's not "hacking" around the law anymore than stopping at a red light instead of blowing right through it is "hacking" around traffic laws. If I literally do not know the password the onus is on the prosecution to prove that I do know it before they can put me in jail. And if you think the police get to hold you in contempt of court or convict you of not following the password reveal law you clearly have no idea how the justice system works.

I do the same – write down a long password where upper and lower case letters a mixed liberally. Type it a many many times but don't memorize it. Now you have the password as muscle memory but have no way to tell anyone what it is. Make sure to save the password in a password manager!

Care to expand?

If I tell then people will know about it and then they'll write my method into any law they create to force revealing of passwords. It's stupidly simple though.

this is why services with sensitive information need an optional duress password.

Reply on news.ycombinator.com