Hacker News Reader

Comment by tyingq | Hacker News Reader

I'm surprised there isn't a "ready to go" solution with a duress passphrase that boots a plausible, but "clean" system.

It's not quite ready to go, but it's doable with TrueCrypt/VeraCrypt: https://www.veracrypt.fr/en/VeraCrypt%20Hidden%20Operating%2...

Why is it not ready to go? I used truecrypt hidden systemvolume years ago?

I do not anymore, but did it decreased?

TrueCrypt shuttered in 2014, though an independent audit didn't find any significant issues in 2015. [0]

VeraCrypt is one of the main forks that has picked up popularity, and has addressed some of the minor concerns of the audit.

The hidden volume hasn't had a high degree of success when it comes to deniability [1]. Some leaks closed, probably not all. With the design, it may not actually be possible to close all the leaks. (Especially as "Stoned" can break the full-disk encryption).

TrueCrypt doesn't use the TPM (and nor does VeraCrypt), because the authors didn't believe it added any security whatsoever (as it can't defend against a hardware keylogger, despite making coldboot attacks harder).

TrueCrypt is vulnerable to coldboot, evil maid and the "Stoned" bootkit. Depending on your security concerns, that might be fine, it might not. Other solutions may be better when dealing with those attacks.

[0] [PDF] https://opencryptoaudit.org/reports/TrueCrypt_Phase_II_NCC_O...

[1] https://yro.slashdot.org/story/08/07/17/2043248/schneier-uw-...

The "plausible" part is what seems not out of the box to me. Some easy way for the decoy image to show recent real looking activity, and an easy way to use the real image. Probably some integration with a VM or container.

I took ready to go to mean "run a command and it spins up a plausible fake system". The tech of TrueCrypt/VeraCrypt, AFAICT, seems sound, but maintaining the contents of the fake system (so it's not an obvious decoy/placeholder) takes more work.

Deniable encryption is part of a few encryption solutions (probably more than listed below). [0]

[0] https://en.wikipedia.org/wiki/Deniable_encryption#Software

Not really ready-to-go, but can be set up in entirety in like half an hour with VeraCrypt

Well, you would probably want some stealth that doesn't provide that makes it less obvious. Like maybe the duress passphrase decrypts everything except a docker container you use for sensitive work, replacing it with a vanilla docker image.

Edit: Ahh, read up a but. I wasn't aware "veracrypt hidden volumes" are already pretty stealthy. Would probably require some work to make it plausible though...like recent faked web browsing history.

The VeraCrypt guide recommends "You should use the decoy operating system as frequently as you use your computer. Ideally, you should use it for all activities that do not involve sensitive data." You don't need to fake it per se, but section off what needs to be in the hidden operating system (rather than a standard VeraCrypt partition). You are therefore revealing real, thus plausible, information, but not the actual subset you want to hide.

Are we going too overboard hiding our fetish video collections? My family members just leave thier dvds lying around, meanwhile Im encrypting every hd I can.

you'll still have to explain why there is a huge blob of seemingly random data on your hard drive if someone looks close enough.

With whole disk encryption the whole drive is seemingly random data, that's the point.

Last i checked, you don't have to explain sh!t. Besides, I would just tell them i boot from a live cd only to prevent system compromise..

> Last i checked, you don't have to explain

Exactly. One of my favourite vids is Don't Talk To The Police, it's the right thing to (not) do.

https://www.youtube.com/watch?v=d-7o9xYp7eE

The common plausible explanation is you securely erased the disk or partition before. This would produce the same randomness signature.

Reply on news.ycombinator.com