Hacker News Reader

Comment by fitblipper | Hacker News Reader

I understand how "clever law hacks" like warrant canaries are not clever when faced against actual law enforcement practices. I say this to try to explain that the following isn't meant to be a clever trick and instead is meant as a reason why I worry about these kinds of law.

I have a very long passphrase that I only have to enter at machine boot up time. After entering the pw once the password manager remains open in cache and can be opened with a much shorter and easier to remember password. Because I do not restart my phone or devices frequently I don't need to enter my password often and so my very long complicated password isn't used often. My practice has been to automatically restart my phone whenever I am approached by a police officer. This has happened maybe once in the last year or 2.

If I live in Ireland, am I screwed when the stress of being detained causes me to forget my very long, complicated, and infrequently entered password?

View on HN

I'm genuinely wondering how someone could implement a system that functions like a dead man's hand where the key to recovery (despite entering the valid password as required by law) which lies outside of the jurisdiction of that government, or relies on the data being unavailable for a long stretch of time.

>"If I live in Ireland, am I screwed when the stress of being detained causes me to forget my very long, complicated, and infrequently entered password? "

As for this part, I've become a cynic after learning so much about how courts actually function on a daily basis. There really isn't anything stopping a judge from simply finding you in contempt of court - even if you legitimately did lose your password. Ultimately, if the judge wants to, they can easily drag you through the mud and you have virtually no recourse.

Edit: I know Apple has a feature that disables FaceID that acts like a 'panic' button. How do the courts deal with that?

Sometime during quarantine I had an evening thought excercise about clever password choices in this context. It was a fun game, and would be a cute scene in a movie or a book.

Ultimately the password `fuck you cop I'll never tell` is a fun idea, but little value. Complying without appearing to comply might change up the game a bit, but you're still screwed.

_edit_ it is kind of fun to think of a password so offensive that it doesn't matter who asks you, they won't believe that's your password. Technically might buy you some time before they figure it out.

The way the law is worded (see my other comment), the police can force you to do whatever is necessary to unlock the device by any means at your disposal, not just disclose your password. While this would be technically a terrible idea on their part for a number of reasons, having a clever password would not be helpful.

> a password so offensive that it doesn't matter who asks you, they won't believe that's your password.

If they don't believe it's your password, then you haven't really avoided the punishment for not disclosing your password (although you might take some comfort from a kind of moral victory, having told the truth and complied with the letter of the law).

Instead of coming up with a password that offends the police, a better approach is to come up with one that interests them, specifically a detailed admission of a crime. For example, the password could be of the form "I killed John Doe, and buried the body in my garden".

Assuming your jurisdiction has protections against self-incrimination, and you can convince a judge that your password really does contain such information, they may have to choose between not learning your password, and giving you some sort of immunity deal.

Of course, if this approach leads to innocent citizens routinely committing crimes just to come up with a unique password (or worse, criminals baiting police into giving them immunity in return for access to dummy encrypted data) then the only law that will be followed is the Law of Unintended Consequences.

>Assuming your jurisdiction has protections against self-incrimination, and you can convince a judge that your password really does contain such information, they may have to choose between not learning your password, and giving you some sort of immunity deal.

I think it's quite unlikely they'd give immunity, especially when they could just instruct you to unlock the device and hand it over without telling them the password

I'm assuming the offensive password works in a situation where you have a deadman's handle. So then a month later you can say "I told you my password was '$offensive-phrase' and can prove it was, now you need to release me" (presumably after your lawyer acquires the audio from the interview to back up your assertion).

I wonder if its possible to easily set up a phone or other device with a multiple password/ login system that depending on the credentials could either show something benign or wipe the device. I'd expect such systems to become more popular (and make the main result of these new powers be that police have a new tool to harass unsophisticated and already downtrodden folks, rather than actually to disrupt any serious crime)

Check out the rubberhose file system.

https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29

Is there some more modern version of this?

Okay, I know it's very keyboard-warrior-eqsue, and I don't know how I'd really react if actually faced with this situation, but I think this is something I'd be proud to sit in jail over.

Ask me after a month/week/day/hour of course, but I hope I'd be strong enough to deal with this appropriately.

> My practice has been to automatically restart my phone whenever I am approached by a police officer. This has happened maybe once in the last year or 2.

In the United States (where I live) this seems risky. I think most here would prefer their phone to be on and readily available for filming in case they need to film the police encounter. We have a lot of cops spazzing out on people.

Yes, I honestly think you are screwed.

We're going to start needing "burn the battery on demand" mods.

Please don't bring these on airplanes.

You can use TC hidden volumes that will log you into different volume depending on entered password. It is not possible to detect that a volume has hidden volumes.

Something like this should exist natively in Android and other operating systems, but obviously there would be a push back from governments.

Reply on news.ycombinator.com