Hacker News Reader

Comment by TMK | Hacker News Reader

Great. I feel that full-hard disk encryption is necessary for our own privacy safety. If I had problems with Cops I would probably be shutting down my PC always before letting anyone in, though I already have quick auto-shutdown system with my SD card. I unmount my SD card and the PC shuts down and can not be logged in without the card if the SD card is not mounted.

View on HN

I'm not sure what the benefit of the SD card is in this case -- something physical, you can be legally compelled to hand it over, since it's a physical object.

It's much easier to make a SD card unavailable (destroyed, "lost", etc.) vs. an entire laptop, and you wouldn't be as vulnerable if a third party got a hold of the laptop (since all the valuable data is sitting in your wallet (on your person) instead of the briefcase (in the seat next to you)).

Well In my case the data actually is in the laptop and encrypted, but the SD card only disables logging in on the PC, even if they crack my password.

Unless your SD card contains something vital to access of your data (encryption key, etc), all that setup does is protect your data from people who try to use your laptop in a coffeeshop while you're in the john. Still nothing stopping one from taking the entire laptop, removing the drive, and mounting it in another system.

The encryption key could be a function of his login password and it could be stored in-memory after he is logged in. The issue is to have a trigger which wipes it from memory by logging out the current user when the police shows up, and unplugging the SD is a nice trigger for that.

That's at least what I imagined, his setup might be completely different (a keyboard combination for logging out might also work better).

Basically the SD card contains encrypted key which is required to be mounted while logged into the PC. If I pull the card away the PC will automatically shutdown.

if the SD card is not mounted when the user logs in the system is automatically shutdown too.

Basically the SD card only fights against using the computer. You of course could remove the hard drive and mount it in another computer, but that is why the whole drive is encrypted.

Also, SD cards are really really sturdy. You can drive a car over them, and I know from experience they can survive a fire.

Maybe if he'd use a micro-SD, he could swallow it. Or hide it pretty much anywhere cause it's the size of a fingernail. Dump the empty micro-SD/SD-adapter into one of those typical "computer paraphernalia" boxes always found on any desk, you know, the one that also contains an aged USB stick, three paperclips, a PS2-USB adapter, post-its, ear-phones and some USB cable, and nobody will expect a thing.

Yes. It's Micro SD with to SD-Card converter.

> and I know from experience they can survive a fire.

LOL. More details please.

Well a couple of years ago, my house burnt down. I was "lucky" with only a melted flatscreen monitor and further mostly just smoke damage (which insurance still reimbursed as total loss, yay), my flatmate, where the fire started, less so. His part of the apartment, the next day, pretty much was a blackened cube with bits of black debris on the floor, what used to be furniture, his computer, books and audio equipment[1].

In the rubble we found his camera, which was of course useless if not because of the heat[2], then because of the water damage from the fire-fighters.

Inside was a 2GB SD card and it still worked.

So yeah, if for some strange reason you can't keep your backups off-site, nor in a fire-proof safe, store them on a SD card in a camera :-)

[1] He also wasn't insured, making the story even sadder. Fortunately he just landed a pretty good job, also he met his current girlfriend while staying at his parents until he found a new home. So some good came of it, I suppose. [2] Glass windows melted, can you imagine? Looks like icicles. I later asked a glassworker friend, she said that means it must at least have been 800 degrees Celsius.

Woah, that's pretty sad, but kinda cool that the SD card still worked after that.

Yes I know I can legally be compelled to hand it over, but it's a Micro SD to SD card converter. The Micro SD card can be quite easily be broken. I've tried. I could also make the script to automatically delete all necessary data if the system was booted without the card.

Anyone who confiscates a machine and then proceeds to boot it without removing the harddisk and imaging it first are total idiots...

What did you use for the SD card solution?

I wrote a small script to keep checking if the SD card is mounted and if a certain key file exists in the SD card.

This script is auto-started before my gnome Login screen.

Couldn't someone: a) physically remove your hard drive b) mount it in a different machine c) find your SD checking script d) figure out what key file you're checking for e) write that key file to a new SD card (or otherwise circumvent the check)

This assumes that your HD isn't fully encrypted, in which case you'd be pretty well protected. It does sound like a nifty way to auto-logout quickly though...

The HD is fully encrypted and the system does not only check if a file exists, but if the file in the SD card contains specific key, which is not stored in the system, but it's my own encryption implementation for the key so I'm not certain how secure it is.

a) Yes they can. b) Of course they can do that if the HD is not encrypted or the encryption is broken. c) Yes they can do that, but why would they do it if they already broke the hard drive encryption? They could just delete the script. d) Well yes surely they could do this.

Anyway my only goal implementing the SD card shutdown was to secure the system from friends who want to invade my privacy and thief's. Basically I can do auto login to my admin account and if the SD card is not mounted it shut downs.

Couldn't they just force you to give the decryption keys ?

Not if you forgot it.

Actually in the UK you can be detained indefinitely even if you plead that you forgot it.

That scares me. I've forgotten half my Truecrypt passwords. I guess I should give up and delete those archives.

Plead the Fifth!

I think you're joking, but for what it's worth, that doesn't work. You can claim that the encryption key itself contains self-incriminating data, but then they'll simply say "ok, we completely understand. Go ahead and type it into your laptop and decrypt the data and you don't have to reveal the key."

right to remain silent. Orally, in writing, keyboard typing, or through any other means of communications.

Your honor, it has been more than six months since I was arrested and I can no longer remember the encryption key. All I can remember is that it twenty random letters/numbers.

Even if you lie in court it is very difficult to prove it.

A broad interpretation of the 5th would mean you don't have to assist the authorities in any way in convicting yourself of crime.

Plausible deniability http://www.truecrypt.org/docs/?s=plausible-deniability

Well they could, but why would I give them If I seriously had something dangerous in my PC? Though I've secured my system more for theft, though It would be good to have guest account which could login normally, so that the thief would not just reformat the drive right away and I could actually trace the thief when he's using the PC before reformatting like some of the success stories, but more than that I don't want my files to be seen.

UK jails schizophrenic for refusal to decrypt files http://www.theregister.co.uk/2009/11/24/ripa_jfl/

Reply on news.ycombinator.com