Hacker News Reader

Comment by p1mrx | Hacker News Reader

As a thought experiment, I was wondering how to store something in a box/envelope, and know if someone else has looked at it.

My conclusion was to search for "holographic tamper" on AliExpress, and carefully examine the photos to find models where each sticker has a number and a differently-aligned background pattern. Prices are around $5 for 250.

Then you could use several stickers to seal whatever container, and take photos to record each sticker and its pattern. There are ways to exploit this system, but it probably helps against a non-sophisticated attacker.

View on HN

State of the art is a bag of beans:

https://dys2p.com/en/2021-12-tamper-evident-protection.html

I wonder if there's no attack on these. I think I'm fantasizing, and I suspect this won't work, but: Inject the vacuum-sealed package with a thermal plastic/resin that keeps the beans in position. Then cut open the solid beans and extract what you need. Once you're done, re-assemble, re-vacuum and then heat while applying vacuum to remove the resin.

Resins aren't always perfectly still when curing. Especially if you need large volumes of the stuff. Not to mention, time becomes a factor pretty quickly. The faster the cure for the resin, the more exothermic it is (along with higher risk of thermal runaway), which increases the chance of shifting.

Not to mention, you'd also need a really effective solvent for resin that doesn't also happen to be a solvent for whatever the mosaic is made of. Perhaps the mosaic is made of resin beads.

All that being said, it's virtually guaranteed that a valid attack on these methods exists. There's no such thing as perfect security. It's always a case of evaluating your threat model to make security attempts that thwart a constantly moving array of types of attack.

I'd go for injecting non-electrically conductive liquid that can both freeze and evaporate, freezing the liquid, remove electronics, tamper, replace, pull a light vacuum and air to remove liquid/allow evaporation

> There are ways to exploit this system, but it probably helps against a non-sophisticated attacker.

The LockPickingLawyer on youtube demonstrated that you can just unglue the commonly used tamper seals with a bit of alcohol and reapply them when it had time to evaporate. Someone watching his channel wanted to use a lock sealed with them as proof that LPL was picking locks off camera first and all he got was proof that the seals where useless.

https://youtube.com/watch?v=xUJtqvYDnkg

Video in question: https://youtu.be/xUJtqvYDnkg?si=RgpKWJC81V7NVtUd

The past few years at DEF CON, there's been a "village" where you can practice (or watch others) defeating such schemes: https://info.defcon.org/village/?id=67

How about glitter nail polish?

https://news.ycombinator.com/item?id=6986327

Yeah, that may be a better idea. I see that some brands of nail polish use coarser flecks that would be easier to compare visually.

That's so funny, I once long ago worked on a project that suspended retro reflective beads in a solution to get unique patterns, this is a very simple variation on that theme and probably a more effective one.

Go old school with a wax seal and a signet ring.

You need multiple color wax and a photo of the pattern for that to work.

Kind of depends on what you mean by sophisticated.

X-Ray imaging has gotten surprisingly affordable: https://www.ebay.com.au/itm/386247465197 (honestly I was looking for canister X-Ray machines which are a bit safer for this, now I'm seeing these things and thinking "is my search for a way to find joists in walls actually over?)

Reply on news.ycombinator.com