Hacker News Reader

Hacker News

Comment by cookiengineer | Hacker News Reader

Full thread

cookiengineer

There's always LUKS to cover this scenario: Nuke Keys that get activated with a second password. [1]

[1] https://github.com/roema/cryptsetup-nuke

View on HN

The adversary can easily just copy the encrypted data before trying to decrypt it.

I think the idea is to have them enter the password that destroys the data.

That may have worked 10-20 years ago.

These days there are established procedures and protocols that prevent this.

What protocols stop a person from removing the drive from your machine, and imaging the drive?

Not even just that - in addition to imaging, write blockers should be used for evidential integrity as well.

I think that's the point of that comment. Police have procedures now to prevent a nuke script from being effective.

If only you could run your own code on the drive controller. Start obliterating data at random if the disk isn't initialized properly.

I think my point is that destroying one copy of the data is pointless when other copies exist.

Destroying 1 copy pretty much guarantees someone is going to go find that $5 wrench and explain to you how disappointed they are.

If your threat model is the police, a wrench could be a best case scenario for you. If you can prove the police took a wrench to you during an interrogation you're definitely getting the case thrown out.

With police you can start a Twitter mob if you're lucky but there are ten thousand other George Floyds out there that didn't get any justice when police took wrenches, tasers, knees, guns to them.

And that doesn't really apply to the CBP and the CBP equivalents of other countries. They're ruthless and can lock you up in cages, there isn't really the opportunity to start a "case" until you're past the CBP. If you aren't a citizen you sadly don't have access to a lawyer if the CBP wants to hit you with a $5 wrench, because you aren't even in the US yet.

LOL. Yes, possibly, but think of the time. I didn't break when the cops put a loaded gun to my head or threatened me and refused me a lawyer. I broke an hour later when they decided threatening my wife would be a better plan.

It took 7 years of sitting in jail to get the judge to watch the video and throw shit out.

If violence was an option in this hypothetical, it would have already been used to get the password anyway.

One, the wrench can be metaphorical. If you brick the device that's antagonistic. Getting you on a petty crime, as a cop, or getting $50 from your wallet as a criminal, may stop them from looking. Being combative results in retribution, and as we all know cops can be petty, and selective enforcement of rules is one of the hallmarks of Institutional sexism/classism/racism. If using Crypto While Black isn't already a thing, it's gonna be, and there's nothing you and I can do to stop it. Slow it down, absolutely, but stop it? Not without help from our kids and possibly grandkids.

This isn't a chess match between equals. This is someone who can ruin your life just to make a point. Even keeping you in custody for a day or three can screw up a lot of people.

The Lockpicking Lawyer put it pretty well recently. The people who make locks are following rules that nobody else is beholden to follow. The designer looks at the parts and thinks about their purpose. Their design. The picker is looking at what they can make the thing do, not what it's 'meant' to do.

They are repurposing things, to circumvent the wishes of the manufacture and the consumer. That's where the wrench comes in. That's where cloning the device comes in. That's where giving the adversary a fictional win to regain your liberty comes in.

Again, if it's an option, it's more like violence would have been used to get the password, and further violence against your family/loved ones if you were antagonistic.

Real life scenario:

https://www.yahoo.com/now/dutch-bitcoin-trader-suffers-bruta...

This is why plausibly deniable encryption is such a boon. If you have something somewhat valuable behind some weak encryption or in plaintext and a big blob of mystery on your device it's a lot easier to make the claim that you've surrendered everything without giving up the game.

If they know you're hiding something, for certain, they'll go to much further lengths to find that out compared to suspecting you might be hiding something and finding some other stuff you'd obviously like to hide. If you've got an envelope with 100k in your pocket and you get mugged throw your wallet at the dude as quickly as possible and just book it - chances are that the mugger will either: A) consider the risk/reward at this point to be too dangerous since they've already got a nice bit of cash or B) assume you're just scared and have nothing else. If you say "Hey, I just threw you 200$, I'm going to run off with this 100k now" you're definitely not going to have a good day.

You're right, it's not a silver bullet but it is another defense for the probable cases that they didn't make a copy.

What cases would those be? Any law enforcement or customs agency will make copies.

I think the point you responded to was talking about copying the encrypted data before attempting to unlock it.

with LUKS you can just use a detached header stored on a USB thumb drive. Then just toss the thumb drive.

But this isn't plausible deniability. You still have a hard drive in your possession and it's still covered by random data. Better deniability: always use an external drive and then distance yourself from the drive. You want plausible deniability of the entire drive to the extent that no one even suspects you of being the owner. Or, have such little sensitive data that you can use steganography to hide it in an image or video file. Just don't put the steganography tools on the same computer as the hidden data.

Anything else is pretty much a joke.

The whole concept of nuke keys is snake oil unless they're implemented with something like a TPM or HSM, since otherwise the attacker can just restore the pre-nuke image if you set it off.

While I agree with you with the snakeoil argument, I also have to say:

TPM chips are useless because there's already tools available to listen on the SPI bus for encryption keys. [1] [2]

It's only a matter of time until other key formats (other than Bitlocker) are supported.

I think the only way to secure the drive is being able to write your own drive controller firmware. But even then HDD plates could be just "swapped into" another HDD.

[1] https://www.saleae.com/

[2] https://github.com/FSecureLABS/bitlocker-spi-toolkit

That attack isn't relevant in this case, because it only lets you steal the keys if the TPM chooses to release them to the CPU, but if you don't know the right PIN, or use a nuke PIN, then it won't do so.

IANAL but I'm pretty sure this would count as destruction of evidence

Thank you for this I've always wanted something like this.

Reply on news.ycombinator.com