My understanding is that people who torture you don't know what you don't know; so they don't know when to stop. As such, they'll keep torturing you way past the point where you've admitted to everything you know. This is why information obtained under torture is considered unreliable: eventually you'll just say anything to stop the torture; further admissions will support the use of torture as an information extraction tactic, and then lead to more torture.

> if sufficiently motivated, there's no reason that an authoritarian state wouldn't just keep torturing you anyway.

Sure, but it helps to make it look like you're someone not worth torturing in the first place. The same look would happen when you decrypt your TrueCrypt partition.

Large unused sections on the laptop with random data is a bad look for someone trying to say they're not a spy.

If it were me, I would do something more like bring a laptop with a bunch of biblical research and ask everyone in the checkpoint, if they've taken Jesus Christ into their heart.

This of course assumes that in this instance the authoritarian regime just finds these sorts of religious people annoying and not dangerous. I wouldn't do this coming into Iran, say.

It seems like there's something like a way to measure the different mechanisms in terms of how inherently decoupled they are from their surroundings. So, a the fact you have to send messages to my server in a particular format is one type of obscurity- but it's highly non-incidental, linked to many different parts of the world (i.e. it's some common network protocol) and more easily investigated (you could get interesting different responses by vary what string of bits you send).

In comparison, which particular password I use can be very highly decoupled from the rest of the world and my architecture, which makes it vastly more (reliably) obscure.

Somewhere inbetween "you have to know my server exists to send 'login:admin password:pass' to it" and "the volume's encrypted with a 2048-bit cypher generated from atmospheric entropy" is, maybe, a useful middle ground.

Hidden volumes seem like more of a defensive meta-obscurity, in that they obscure your metadata (your ownership of a particular piece of encrypted data).

The problem is the level of scrutiny. Against some attackers, decoys have very very nasty game-theoretic failure cases.

Specifically- there's no limit to the number of decoys that could be on a disk. So you can get into the situation where you've decrypted every volume that exists, under coercion, but your adversary believes there are more volumes remaining.

By design, you have no way to prove that there isn't more hidden data on that disk. This is unlikely to end very well for you.

That just raises the bar for how much they need to want it. It doesn’t eliminate it.

Depends on the border / country.

All things are fungible

As far as I know, every country asserts the right to thoroughly inspect anything that crosses its border. There may be a few exceptions, and it may not matter in a practical sense for situations like (e.g.) within the EU, where you don't actually have to go through customs when you cross the border, but in the general case, it's true.

Presumably the other key holders are in a different jurisdiction.

The trick is to ensure you are never near all the people who know the secret when there is the possibility of trouble. That makes kidnapping everyone harder.

Of course if you really worry about such things you shouldn't be trusting the other people you are working with either...