Hacker News Reader

I had an iPhone that I forgot the password to and it was a real pain in the ass. I ended up locked out of my phone and could never get past it. I have also played around with pgp and made an account and tried sending a couple encrypted emails to no one in particular. Now I forget how to even log into pgp. I also have several email address I have forgotten the passwords to. A device I used for years when the screen broke I used another phone for a month then forgot the password with out many tries. So I feel this is a concern. It is easy to forget a password. I don't use cat123, my password is like 20 characters long with capitals and special punctuation marks. Though I suspect many people would conveniently forget their password I have no doubt some would legitimately forget.

I use a password manager, and I genuinely do not know the password for most of my accounts.

there could be language in a warrant to include that scenario.

I use a very long, static password baked into a YubiKey (with some other measures), and I honestly don't know what the password is.

Q: What's your password?

A: I have no idea.

Q: How do you log into computers then?

A: I'm going to invoke my right to remain silent now, thanks.

[I am under no illusion that this actually helps the compelled decryption situation]

IRL you should be invoking your right by simply not answering the first question or any other.

You are correct.

If you ever actually get arrested, do not do this. Once you start answering questions, you forfeit your right to silence, and refusing to answer questions later can and will be taken as evidence against you. Just be silent from the beginning.

You can shut up any time; there's no "Oh, you were talking, now you can't stop talking."

Of course you cannot take back what escaped your mouth prior to asserting for right to remain silent.

This hurts the compelled decryption situation immensely. You have a physical key that you can be forced to turn over, and then they basically have everything.

There are other measures, such as a prefix or suffix ("PIN") that you can supply, so the physical key doesn't have the entire password. Otherwise, you're right.

It's also useful to be able to leave the physical key at home, or with another party.

... and if you hand it to your attorney, does that count as privileged communication?

Warrants have to be specific, correct? If they asked for your Xyz password and you didn't know it, you explained you used a password manager- would they have to get an expanded warrant to compel you to disclose that password? Would that be considered an overly broad warrant?

I use my password manager to save things that are not passwords too- padlock combos, combo to my safe, medical info, parents wills, banking, all my dirty secrets... Seems wrong they could get access to all my info if the warrant is just for Xyz.

Speaking of which, I have a computer with a locked screensaver which I've forgotten the password for. If anyone in the vicinity of Boston knows how to do a cold-boot attack and is interested in practicing on it, please get in touch. :-)

It doesn't really matter if the process fails, it would just be nice to regain access, and it would be interesting to learn how to do it.

Is the hard drive encrypted? If not, just take it out and... You're done.

Yes, otherwise it would be simple.

Does it have memory encryption enabled? Or even an IOMMU?

Does it boot on its own, without entering a password?

I'm on the wrong side of the ocean, alas, but I'm betting this won't be too hard to crack.

Regarding the hardware questions, I don't know. FWIW, it's a Dell Inspiron i3531-1200BK.

It does have FDE, and requires a password on boot for that.

So, hang on. Do you know the FDE password?

If so, just take the disk out and plop it in another machine and-- you're done.

If not, then no cold-boot attack can possibly work.

No, I don't. The laptop was in suspend-mode for long enough that I forgot the password. It's been on a power supply since, to keep it from turning off. I can get it to a screensaver, and that's it, so far.

That makes everything much harder.

You know that, I suppose. You'll have to crack it by using FireWire or a similar method that lets you read/alter memory, or by opening it up and connecting probes directly to main memory. I have no problem telling you that the latter would be harder.

I certainly would not be able to do either.

And to clarify, since you mentioned cold boot attacks earlier -- yes, that could work, but there's also a very good chance that it clears memory during BIOS initialization.

https://github.com/carmaa/inception

This tool could help you, possibly.

Awesome, thanks.

Is it installing security updates? If not (you could even force it by disconnecting its Internet connection), then there's a good chance an exploit has already been discovered that you can use. This is probably easier than a cold boot attack.

No, it's not. Thanks for the suggestion. That sounds like something I could take a crack at myself.

> I had an iPhone that I forgot the password to and it was a real pain in the ass.

I know this doesn't address your comment head-on (i.e lost password) - but it does address the issue of stolen phones which are apparently impossible to restore back to their factory settings.

Most people who rob iPhones are not technically savvy, but they know people who are, and they get those people to debrick the phones.

The real question is: who are these people who can unbrick iPhones?. Well it turns out: all you need to do is look on your town noticeboard and there are a slew of people who claim to 'unlock' or otherwise debrick iPhones.

Typically the tech they use to debrick the phones is readily available on the web, and god knows what other things they do to the phones once they are 'market ready' and ready to be sold (malware implants, either accidental or deliberate can be found on these devices).

I know from experience and know a few people in those circles who deal with stolen phones all day, everyday. There are also firms who demand proof-of-ID so that stolen phones can be tracked and tied back to an individual. The firms that don't require ID have something to hide (they typically ask for no ID and happily sell you a stolen phone for a cut price).

You can also use stolen phones for spare parts, though I suppose they're much less valuable as such.

Absolutely this. I had someone say "well my phone would be worthless anyways since it would be locked" I laughed at them. I said so your perfectly good screen has no value to me if mine is cracked? Your speaker in the phone worthless? And so on. I am typing this on an iPhone 4s that has had more donor parts then I can even fathom. You can buy unlocked motherboards as well, though with Apple locking things like the home button to the board not entirely sure how that would work but the point stands the phones are definitely with something locked or not.

Indeed, the article doesn't address the question of forgetting. And generally, it over-complicates things.

Let's say that you don't know the password, and never did, because it's not your device. If ordered to decrypt, you just say: "I don't know the password." You don't plead the Fifth. Because you simply don't know the password, and the thought of self-incrimination would never occur to you.

Now let's say that it's your device, and that you did know the password, at one time. But maybe only for a few seconds after you set it, and then forgot to write it down. Or maybe you did that intentionally, to nuke a device before resale. Or maybe you have honestly just forgotten it. I have one or two old drives around like that, so hey ;) Anyway, in that situation, you'd just say: "I've forgotten the password."

But now, let's say that it's your device, and that you do in fact know the password. What do you say? If you plead the Fifth, that's basically an admission that you know the password. Because, as I've said, the thought of self-incrimination would have never occurred to you, if you didn't know it. So you don't do that. You just say that you've forgotten it.

There are, I admit, some concerns with that approach. First, you're lying to an agent, and penalties for that can be extremely severe. So it's your call to make. Also, if an agent testifies that you were using the device when swatted, that claim may seem iffy.

But if pleading the Fifth is no longer an option, what are the alternatives? You can at least claim trauma. And if you're old like me, a ministroke.

> But if pleading the Fifth is no longer an option, what are the alternatives?

Simple: just give the password!

But then the state has access to my linux iso collection....

That'd open up quite the can of worms, for me ;)

And I'm just a punter.

> If you plead the Fifth, that's basically an admission that you know the password.

Is this your opinion or from the article?

Remaining silent is (in the USA) evidence of nothing. The burden of proof is on the prosecution.

Actually pleading the fifth, to a specific question, may have different implications. IANAL.

Yes, "[r]emaining silent is (in the USA) evidence of nothing", but only regarding the facts of the case. But it can be evidence of contempt, and that can put you in jail. And because each refusal to answer is an additional act of contempt, there's effectively no limit to jail time. You're stuck in a contempt-of-court loop.

It's my own opinion. I mean, isn't it obvious?

In what circumstances, where you actually don't know something, would you plead the Fifth? Would you do that, just as a matter of principle, just because they're asking for something that they have no right to ask? That seems like asking for trouble.

I do understand the intent of the Fifth Amendment. To protect defendants from incriminating themselves. And, I believe, to forestall the use of torture.

But now, regarding passwords and access credentials, the Fifth is becoming unworkable. I mean, that Philly ex-cop is still in jail for contempt. And perhaps he actually has forgotten the password to his Apple storage device.

First, you can't legally take the fifth just because they are asking something they "have no right to ask". You can only legally take the 5th to prevent possible implication. You also only need to worry about the 5th during certain scenarios. Most of the time you can just refuse to speak. But if you've actually been charge and decided to take the stand and start to answer questions, you have waived your fifth amendment right because that would inhibit the cross-examination's questions.

"I mean, isn't it obvious?" That's a common misconception about the 5th amendment. In fact the US Supreme Court has said - "One of the Fifth Amendment's basic functions is to protect innocent men who otherwise might be ensnared by ambiguous circumstances."

Case in point: Detective: "Do you know the victim?" Suspect: "Yeah, we've crossed paths a few times before - mutual friends" Detective: "Do you like him?" Suspect: "Not especially. He always seemed kind of arrogant." Detective: "Where were you Friday night?" Suspect: "I went out with a few friends to the Irish pub at the corner of 7th" Detective: "That's interesting because his body was found about a mile from there. And the body was located roughly halfway between that pub and your apartment."

Oops. Now you're screwed. You've confirmed your knew the person, didn't like them, and was in the area of the murder on the night it occurred. And your language even uses the past tense ("seemed kind of arrogant"). All of this would be used against you.

Sure, you can refuse to speak during police questioning.

However, if you're charged, you will asked to take the stand, and perhaps be deposed. I'm not sure that you can keep refusing to speak, without facing contempt charges, unless you plead the Fifth. But IANAL, so ???

My "isn't it obvious" comment was not about the innocent. But rather about someone who is arguably guilty, and knows it, but doesn't want to give that away.

Not sure if you live in the US or not, but in the US you are never required to be deposed or take the stand if you are the person being charged. A person charged with a crime can never be forced to take the stand at all. If they choose to do so, they make that choice knowing that they are waiving their fifth amendment rights and can not take the fifth as that would hinder the right of the prosecution to cross-examine them.

If a person is not the one being charged with the crime they can be required to appear in court and provide testimony but if during the course of testimony they would be giving an answer that exposes any illegal activity on their part, they can take the fifth. A good example of this is is someone witnessed a crime but they were buying drugs at the time when they happened to witness it and they were questioned about why they were at that location at that time and what they were doing there. Answering that question would force an admission of a felony on their part and would expose them to charges so they can legally refuse to answer by citing the fifth amendment. A lot of times this is rectified by being granted immunity in return for testimony since the criminal activity on the part of the person testifying is not usually of significance to the prosecution.

OK, but what about that ex Philly cop who's been in jail for a couple years, for contempt, for refusing to provide a device passphrase? His actual trial is basically on hold, until he answers. Unless the Supreme Court intervenes, anyway.

That's a fair point to bring up. The verdict is still out on that one, as far as I know. From what I remember the issue was that he wasn't going to incriminate himself because they already had separate evidence showing that there was child porn on that device and he was the one who downloaded it. So since this was already known to police it wouldn't be a violation of his 5th amendment rights since the information was already known.

There were other rulings for other individuals for whom the government didn't have the evidence against already and they wanted the device access to give them that evidence. In those cases, as I recall, it was said that a defendant could not be required to decrypt unless the device was crossing the border and was subject to the standard lack of privacy at the border. Otherwise, since they didn't have proof, what they needed was the "content of his mind" and that was privileged. As for the border, they might not even be able to require decryption if you are a US citizen. They might demand it and even confiscate the device. But if you are a US citizen, you can't be blocked from entry. So they might just keep the device in those cases and allow you in. I can't swear to the accuracy of that one, though. But I'm pretty sure that's mostly correct. Non-citizens can be turned down at the border for pretty much any reason, including refusal to submit to searches and other privacy-related issues.

Thanks. I didn't realize that they had independent evidence that there was child porn on the device.

Or at least, I didn't realize that they had valid independent evidence of that. As I understand it, they had data from a hacked version of the Freenet client, showing that his node had received pieces of child porn files. They knew that because they were serving those files, and could identify pieces by hash value. Their expert testified that, contrary to claims by the Freenet Project about random routing of file pieces, they could determine that the defendant's node was in fact the recipient, and not just a relay. But, according to the Freenet Project, that's bullshit, which is based on a misunderstanding (perhaps intentional) of the Freenet protocol and mechanism.

I wonder whether they have other independent evidence that's actually valid. But these are subtle points for a judge. And I'm guessing that the defendant doesn't have the expert muscle to dispute those claims. And/or that juries could follow any of that.

The idea is to to go to jail for refusing the court order you can follow. I've personally forgotten quite a few complicated passwords over the years. Try it, set a password, it makes perfect sense, but if you don't use it for weeks, it's gone! Jail? Nope, I knew it but I really don't now. And since, I really may not know, and no one can be sure...jail should not be an option.

legitimate forgetting will rarely arise: law enforcement just captures the defendant entering the password (e.g. surveillance video).

Face ID is also hard to "forget" :-)

Say, “hey Siri, whose phone is this?” It will require that your password be entered to unlock the phone; Face ID won’t work.

You can also hold the power and volume up buttons for five seconds on the iPhone X.

Having old devices/HDD sitting around seems to be common in tech and non tech circles. So, I suspect 10+% of people already have an encrypted device in their home where they forgot the password. Now, given a few dozen tries they might be able to recall it, but it’s not something they can just hand out.

I'd be surprised if more than 10% of the population actually ever owned an external drive... (excepting diskettes)

That 10% is including old phones, tablets, computers, USB sticks, and external backup drives. I suspect old tablets and phones are going to make up the bulk of forgotten passwords, but the government is going to request every password for every device.

I personally have at least one Truecrypt volume whose password I've forgotten.

It contains a year or so's worth of journal entries, so I keep it around in case inspiration strikes, but so far I've had no luck opening it.

Were I investigated for a crime, it's not implausible that the police might take my hard drive and come back saying something like "here's a list of encrypted volumes we found, open them", and in at least that one case, I simply cannot.

know something have someting. password and key file. compromised kill file.

face id is something you have but is not very secure in compelled situations which does not have to mean police.

I'm actually one of those paranoid doofus. I have a few 2 TB backup hard drives encrypted with Truecrypt (before the Truecrypt devs decided to abandon the project), and I can't remember the password...

I tried to brute-force it using John The Ripper, but after a few hours trying to configure it with a dictionary, I just gave up. I'll need to get back to it some day !

Fun story. Back when I was a bit younger, I once forgot the 4-digit PIN of a cash card after a heavy night of drinking, even though I had used the card for many, many years almost daily. It was just gone, no matter how much I tried to remember it. (Then, getting a new card took 3 weeks or more, so I tried a lot.)

My guess is that some information is stored in the brain chemically in few brain cells, and when they're gong, it's gone.