Hacker News Reader

>Everyone has cracked software, pirated movies, & torrents

That's a bit of a leap, really.

Also, Truecrypt's deniable encryption here doesn't seem like it would help, since they're talking at the computer level. Presumably, a power on or hard drive password. Assuming there's only one volume, you put that one in and the attacker has the keys to the kingdom.

Besides that, most averages joes wouldn't go through this kind of trouble. If you're running in opposition to a ruling power who might, say, launch a missile at you from 30,000 feet while you're in foreign territory (not naming any names here), then you probably already know to cover your ass.

On the other hand, an average joe thinking that they're cute by giving up the password to the concealed volume will only land a contempt charge when the file access times are checked.

TrueCrypt supports Hidden OS partitions much like its normal hidden containers and it asks for these passwords at boot.

You could enter one password and have it boot into a boring Windows XP environment while the true password would boot to your actual environment with all your secret files.

There's the file time problem, though. Okay, let's say you're Joe Randomguy and you keep two XP partitions. One that you actively use and might have all manner of contraband on it, and another "boring" one for showing any would-be snoopers.

It's Jan 2012. What do you think is going to happen when they see that the one you gave up the code to hasn't been touched since July 2011?

Does Truecrypt have an option to not record date/time stamps on volumes, or better yet, scramble them?

Standard practice is to use the one you don't care about for things you don't care about (which for most people, will be most things. Web browsing, gaming, emailing the aunt, whatever).

Timestamps are going to be at the FS layer or higher, not much Truecrypt can realistically do about that..

How do you prove in a court of law that a.) those timestamps are correct and b.) I have definitely used it since July 2011?

Truecrypt does have an option to disable file time updates on file volumes. Also for ext at least, you can mount with nomtime, noatime, noctime and completely disable file times.

How does preventing the filesystem from writing timestamps solve anything? We're talking about the 'boring partition' having timestamps that suggest that you haven't used it in months (i.e. really old timestamps), when there is probably evidence elsewhere that you have used it (e.g. emails that you've sent since those timestamps).

just write false timestamps to the FS saying it was used more recently?

Or scramble them altogether. Every write to the filesystem through Truecrypt's driver results in a completely random (but still valid) ctime/atime for that file.

I can't readily think of any Windows processes this would break.

I think it is quite a leap to assume that anything more than a minority don't have things like that.

That's not a leap at all. Many people don't have things like that, either for moral reasons, or there just don't care. Of the four computers I maintain for others, none of them has anything on your list.

You can despise the MPAA without downloading movies. Just as you can desire privacy without committing any crimes.

Many? Yes, I agree. Most? I personally highly doubt it. I don't think I've known a single person since the late 90s who doesn't on at least rare occasion download or otherwise acquire unlicensed music.

Sure there are some, and when you consider the population of the world is several billion that "some" can become "many" without really saying anything about the majority.

> I don't think I've known a single person since the late 90s who doesn't on at least rare occasion download or otherwise acquire unlicensed music.

That may be a matter of definitions. While I wouldn't say I have any unlicensed music, I might if you count my YouTube cache file.

Not having even one pirated anything (song, movie, show, book or software) on any of your machines is not the norm at all.

Ever right-click, Save As on an image you didn't have the rights to?

Ever copied and pasted an article published by someone else, and saved it to a file?

During your online conversations, have you ever written something negative about another person?

Do you have any data that you are contractually obligated to keep a secret, possibly relating to agreements signed with employers or clients?

Note that even data in your browser cache can be used against you[1].

Under a microscope, everyone is a criminal.

[1] http://news.cnet.com/Police-blotter-Child-porn-in-Web-cache-...

In support of the notion that Under a microscope, everyone is a criminal I'll add this data point.

The police raided the house of a veteran here in town a few months back for possession of small amounts of marijuana. The veteran opened fire and during the ensuing shoot out one officer died and five more were sent to the hospital. The news continuously talked about this veterans limited criminal history.

Ultimately he had a speeding ticket and had been charged with something like jay walking which was dismissed. That was his limited criminal history.

I completely agree that if you look at someone close enough, almost all will have limited criminal histories.

None of the things you mentioned are, in themselves, illegal.

Saving an image or an article to your hard drive is not illegal, but redistributing it can be. Writing negative stories about other people is (in practically all cases) not illegal, either. Nor is having secret information.

Unless the majority secretly has an ungodly amount of child porn in their web cache I don't know about, I am not very inclined to believe that everyone is a criminal under a microscope.

I'm curious what the courts would say when told that it is possible to have a hidden inner volume that is impossible to detect and when I hand over my key it may just be the outer containers, not the hidden inner container that I have unlocked.

That is like saying that you are guilty but there is no way to prove it.

I agree. However, having the capability to have an undetectable hidden innner volume feels like it makes a lot of this moot.

That is, as long as the inner volumes remain truly undetectable.

The best way to hide something is with misdirection and dead ends. It's by letting someone win a little but not all the way.

If you're a straight male just make a second inner hidden volume and put a ton of gay porn on it. After a few days of arguing with the court just reveal your password to it and they'll think "oh shit, this is what he was hiding. Well nothing to see here, moving on. That's all."

This is the best comment really... I brought up Truecrypt's Hidden OS feature a while ago (here: http://news.ycombinator.com/item?id=3415658 ) and apparently in the UK you have to somehow prove the non-existence of such a thing. If you can't get them to leave you alone through such above trickery it becomes a fairly simple calculated choice deciding whether obstruction of justice is a less harmful penalty than what they want to find and charge you for after decryption.

genius.

I really like this idea but I think it is important to ensure that whatever XXX material you have, the actors are clearly over 18. Lord knows it may make your standing far worse if you have anything pushing the line.

So, 30+ year old models in your Safe For Government/get out of jail porn directory.

Also make sure the XXX material is fully paid for and licensed, or they'll no doubt slap pirating charges on you for your porn collection.

That's probably not feasible these days. Commercial porn sites only offer licenses for streaming, not downloading.

<.<

>.>

...I always use that method when trying to get out of trouble. Shhh.

My gut reaction to this article was that something like what you've described must exist, although I wasn't certain if it was possible to completely hide a volume from an intimate inspection. What tools are you referring to?

Truecrypt: http://www.truecrypt.org/hiddenvolume

Without the right password, there's no way to tell if there's an hidden volume, since the result of the encryption is indistinguishable from pure random data.

The jurisprudence in this area has to evolve. In a house, for example, the police might be able to search your house because they have a warrant, or they might be able to search your house because of any other exception to the warrant requirement. In all of those cases, police can only search for discrete things--as in, they probably couldn't turn over your bed, unless they thought someone was hiding under it, or the warrant they got suggested that they could. The "plain view" doctrine might indicate that something clearly illegal in plain view could be seized, but this is somewhat narrowly tailored.

If digital jurisprudence evolves the same way, perhaps a warrant (or discovery request) could be obtained to search within a single folder only, but not another, or the like. Perhaps there are cases out there like this already--but possibly a whole body of jurisprudence needs to evolve to deal with these issues.

If we build laws around files and folders, I can't wait to see what happens when filesystem design changes and there's no such thing as a 'folder' anymore.

Right, well that underlies the exact problem--things change faster that law makers and/or the jurisprudence can accommodate to.

> Everyone has cracked software, pirated movies, & torrents.

I don't have any of these. I'm not being contrary, just saying you should update your view that everyone has these things.

"Everyone", in common language, is not equivalent to the mathematical "all elements in the set". It just means "almost everybody, excluding very few people that might as well be statistical error". Actually, even 95% of the people qualifies as "everyone" for all practical purposes.

You might want to take a look at this: http://tirania.org/blog/archive/2011/Feb-17.html

Are you SURE you don't have any of these? That's one of the interesting things I've learned over the years. You may THINK you don't have any, or that you have never gone out of your way to get such. But that presumes that when you visited YouTube that the unlicensed excerpt you watched wasn't cached on your computer, and won't be found and used as evidence against you. That a friend or family member never borrowed your computer for a couple minutes to check email and left a copy of an attachment they shouldn't have had. And so on...

Oh, and you think folks who have no problem casually planting a bag of something in your car would have a problem dropping some files on your computer if they think that would help?

I'm not being contrary either, but to claim that you have nothing to hide could be seen as perjury for someone who wants to make sure they get you of something. And in this day and age I suspect the odds that you have something is higher than you may believe.

...unless Chris Norstrom is your real name and they know how to use a search engine to find this post.

Remember, who we're talking about here. They're not exactly CSI agents.

If someone really wants to smuggle data or keep it secret they WILL find a way. They could just cram it all on a MicroSD and put it under their tongue, or between their butt crack, super glued behind their scrotum, lodged up into their vagina, buried in their rectum, etc.... The methods are endless.

This won't catch terrorists or pedophiles, it'll just catch innocent people like your mom who have some illegally downloaded songs on their laptop.

Or simply use the internet.

This is digital data we are talking about, there are much more effective means of moving it about.

You could even get a MicroSD card, stick it in your phone, and carry it across that way.

Stick it in your phone? Your phone is still liable for a search. Get a MicroSD card and stick it in an orifice.

> Everyone has cracked software, pirated movies, & torrents.

I make it a point to not have pirated movies. I torrent linux distributions and free music (OC Remix); and I buy my software or use free alternatives. It may be true that most people have cracked software, pirated movies and [illegal] torrents, but it's not everyone.

I don't even think most people have those things. Many, sure, but while I am on your end of the spectrum (free software, etc.), many people don't care, or can't be bothered to get those thing, morals aside.

This sounds airtight. The analogy with the physical safe is completely destroyed by True Crypt's hidden partitions.

Any lawyers want to comment on this ?

> This sounds airtight. The analogy with the physical safe is completely destroyed by True Crypt's hidden partitions.

Because it's impossible for a safe to have an extra hidden compartment?

http://16s.us/TCHunt/index.php

Finds hidden TrueCrypt volumes... :(

No, it doesn't. This finds files suspected to be TrueCrypt volumes and it does so by looking for certain heuristics. If your file passes a chi-square distribution test it is likely to be a TrueCrypt volume. If I create a file with a bunch of random data TCHunt would also likely peg it as a potential TC volume.

However, it does not detect the existence of a hidden inner volume.

The fact that you have truecrypt installed on your start menu is a dead giveaway.

No, he has a plausible deniability plan.

Truecrypt is also excellent full disk encryption in case your computer is stolen

I use truecrypt to encrypt lots of legitimate stuff. All my financial data is on a truecrypt volume on DropBox. And I suspect that folks with something to hide wouldn't find it hard to hide trucrypt itself.

where you going to hide it? In another truecrypt volume?

It would be easier just to only use it via a VM booted from a Linux Live CD.

> The problem here is what are they going to find that ISN'T Illegal?

This isn't really a problem. Cops can get a warrant to search your house, and I'm pretty sure they'll find some things that aren't illegal, but are very personal.

If you restrict evidence finding procedure to those in which only evidence (and nothing else) can be found, then I'm pretty sure you'll end up with no evidence.

do people here honestly believe that its not okay for cops with warrants to search someone's encrypted hard drive because they might find something that's not illegal?

Many people have secrets that, if disclosed, could ruin their lives even though they are not illegal. For example, a politician with politically unacceptable activities. I'm sure you can come up with examples, such are regularly reported on the news.

How is that different from finding naughty stuff in the closet while searching for the murder weapon?

It is never okay for my privacy to be compromised. I don't care if they have a piece of paper that says that I'm not supposed to care.

This has nothing to do with things that may or may not be "illegal".

How do you propose police execute a search warrant in someone's house? Or should the police never be allowed in your house under any circumstance?

"Or should the police never be allowed in your house under any circumstance?"

The only circumstance is with my consent.

Unfortunately I cannot prevent physical intrusions. When it comes to security of data however thankfully things have been improving.

Sometimes the police might need to enter someones property or get access to data to stop crime.

Whilst I think that of course people should stand up for civil liberties etc we have to bear in mind if we completely neutered the police your civil liberties aren't worth shit as a criminal can just take them from you as nobody has enough power to gather evidence against them.

You then risk people turning to mob justice with no due process whatsoever.

In a world where I have an absolute defence against the invasion of police officers, I also have protection against criminals. The "real world" version of cryptography does not of course exist, but nevertheless I subscribe to the belief that all transactions should be voluntary.

Police can serve warrants to search my home. There is nothing I can do to stop them, and I won't attempt to stop them (since I value my life). However that does not mean I consent or approve. "They have a warrant", provides me with zero comfort.

tl;dr: Police are going to keep being police without my approval, so I don't see why my system of ethics needs to give them room to operate.

this an absolutely ridiculous position. if you are charged with a crime, police absolutely do and should investigate for evidence, which includes breaching your privacy. the entire of idea of finding evidence is to breach your privacy.

without this, almost no crimes would have enough evidence to go to prosecution. that includes stuff that you don't care about, like privacy, and maybe stuff you do care about, like murders and kidnapping