Hacker News Reader

Comment by ck2 | Hacker News Reader

Password protection won't work against the "rubber-hose" method of obtaining it.

You assume governments are going to play nice. Even if they don't physically torture you directly for it, they will just put you in a 6x6 cell without windows for a couple years "pretrial" until you are ready to talk, or go insane.

This isn't some hollywood movie where you get to give a bad password and that distracts them for a minute and they let you go. They will definitely verify the data or go back to torturing or lock you up. How do you think a judge is going to respond to someone who tries to fool them?

View on HN

Suspect has a stash of illegal pornography. He encrypts that. He then encrypts some embarrassing, but legal, pornography. When he's asked for the key he can hand over the fake key.

Before they ask for the keys they should have enough information to know how bad the files are, so you're right in that respect. "We know what kind of stuff you have, so decrypt it and we can punish you for what you actually have, or face five years for not decrypting". But don't forget that sometimes they have no idea what the file is, or if the person is involved in any offending behaviour, and they've found the encrypted file after some other investigation.

In that situation it'd be handy to give them a fake key for fake data.

(None of this is to suggest that this tool is any good for that purpose)

IANAL (thank goodness) but now you've given a false utterance to an officer of the court.

Which in itself is a crime, even if your "stash" was legal.

Remember cops are allowed to lie, you are not, which is why you don't talk to cops.

(and I sure wish we had better examples)

If they ask for a password to decrypt the file and you give them a password that decrypts a portion of it, is that a "false utterance"?

Yes. Courts take poorly to people playing "clever bastard" games. You couldn't really argue that you didn't know exactly what the court really wanted.

Ideally you'd be able to wrap up your weird fetish self porn along with your subversive documents. If they 'ask' for the password, you give them the password for your fetish porn and break down in tears telling them you're a pervert. Then they have a decision, are you telling the whole truth? They don't know if they don't know anything more. Unknonw unknowns.

What about the unpleasant scenario where all you have in your encrypted archive is your porn and they keep torturing you to extract the details for the hidden content when it doesn't actually exist?

Any empty space in a TrueCrypt file that isn't being used for files visible at the top level could presumably contain hidden content - how do you prove it isn't?

Good point. You can't I guess. But when the government starts doing this, we've degraded to a state where you are tortured until you confess, regardless of whether you did it.

If you live in the United States, you live in that state – it's just unevenly distributed.

(Beyond the obvious Gitmo examples, consider the long list of wrongful convictiobs based on coerced confessions / testimony – I'd sleep easier if there was consistently harsh punishment for those responsible)

Yes. Welcome to 21st century government paranoia, control and self service. Never forget, they only do this to protect us...

Which is true. The public go completely OTT bat shit mental the split second something happens, and governments respond with equally bat shit mental policies. And "we" love it. "We" vote for it.

When the general public say no on mass it will stop and be reversed. Sad fact is, "we" support this, torture and all, as long as we have money for throwaway Chinese consumer garbage.

This 6x6 cell will keep you safe from terrorists.

Wait, we vote for it? There isn't a single political party whose digital agenda I agree with, how am I supposed to vote better without going into politics and starting a political party myself?

Well, you obviously can't prove that there is no more data. However if you have a standard encrypted file, the government knows that there's something you're not telling them. However if you've already given them one key, they can't be sure that there's any more keys for you to give. So they don't know whether to give up.

You can get more secure and have 3 levels, 1: backup of important, sensitive documents (like a scan of your passport & banking details, which you obviously just don't want to leave lying around), 2: Homemade fetish porn 3: Subversive materials.

I'm guessing this is more like "the HMRC wants the password to this volume containing my company's second set of books, I'll give them the password to the mildly-embarrassing fake volume of fetish porn I've hidden in there".

Following that logic, I should never lock my door because the government owns tanks. And who knows? In some instances, the data might be more valuable than living.

Can you really have to wait a couple of years in jail for a trial (in the US)?

I don't know, but with terrorism accusations I suspect you can in the US. Not sure about the UK or The Netherlands.

I imagine that someone would go to a judge and ask the judge to order the suspect to hand over decryption keys. Not handing over the keys becomes contempt of court. So maybe you just go to prison for three months at a time, and are asked every three months of you're willing to hand over the keys or not.

Yes, if you are stuck with a public defender one of the first things they do behind your back before you realize it is waive your right to a speedy trial.

https://www.google.com/search?tbo=1&prmdo=1&q=public...

Or if you are Kevin Mitnick.

How's 30 years?

http://cjonline.com/news/2012-11-29/kansas-man-waits-more-30...

Mitnick actually got a Hollywood movie, if you recall :)

Though I don't think they covered the 4.5 years he spent in there without trial (I don't know for sure, haven't seen the film).

> Password protection won't work against the "rubber-hose" method of obtaining it.

http://xkcd.com/538/

True, your well-being is much more important than any data. However they may also lock you up for years when you truly lost your password, so this tool can aid in that.

Reply on news.ycombinator.com