Ask HN: Review our startup: Deniable Video
deniablevideo.com
deniablevideo.com
At worst, they've implemented a cryptosystem that, having never been peer reviewed, is vulnerable to basic attacks. Since I can't find out who the authors are, and they use both AES and Serpent with listed key sizes instead of talking about how the design works, I tend towards skepticism.
Finally, I'm with everyone else wondering why deniability is something the market cares about.
There's a balance to be struck I think - you can't look too Netscape 4.0 but I'd, if anything, be made suspicious by an obvious focus on marketing bling. I would have thought this site is a little drab but serviceable enough, decently put together, certainly enough to avoid losing credibility.
For the journalism uses, the product does not seem to be enough. When the authorities ask you to show them what video you've taken, you need to be able to use a secondary key that reveals your interview with the Ministry of Information's Official Spokesman, but conceals your interview of an opposition leader and your video of an anti-government protest.
Site Design: Needs lots of work. It seems like an infomercial product. I think branding is key here, especially if you're looking to charge 6k.
Price: 6k is a nonstarter. If the equipment were expensive and margins were tight, I'd understand. Everyone wants hardware to be cheap and it's hard when you don't have economies of scale yet.
Implementation: Lots of different devices and I'm sure there's a certain level of complexity to this. I think you're on to something with the security aspect. I would try to make it a lot easier and a lot simpler. The 100gb of space is also way too low. I haven't looked through the specs, but SATA 2.5s with 500 are readily available. If you can somehow cram a 3.5 inch, you can get up to 2 tb.
Could this be done via the cloud? IP camera, sheeva plug, and encrypted recording to an overseas server? Require the private usb key to be used in conjunction with any software system its loaded on. You could charge a small up front fee for the camera+sheeva plug and recurring fee for recording. Kind of a TiVo for personal security.
</end ramble>
As long as the encryption methods used produce data which cannot be differentiated from pseudo-random data, then it's impossible to tell whether there's any video on there at all.
Pretty neat. :-)
Does your product provide this level of deniability? I would venture a guess that the answer is no (after all, there is a box with a big "DV" on it). If not, what do you mean by the word deniable?
Regarding the "contempt of court" threat, they need to implement hidden volumes, like TrueCrypt does, and that will be addressed.
Thus, you can simply say, "Well, sure, I've got the box, but it hasn't been recording anything", and nobody can prove otherwise.
I'm still reading the site to see if I can understand the technical basis for their claims.
They address the coercion (either by law enforcement or guy with a gun), by allowing you to make hidden volumes inside the main volume. You open the main volume, filled with data you don't care about, and they never know that a hidden volume resides deeper.
I see no reason that this same technique wouldn't work here. You record some boring video on the main volume, and record your main video on a hidden volume.
Ah, found one link: http://www.schneier.com/paper-truecrypt-dfs.pdf
1. If the hard drive is making a lot of noise it is probably recording video.
2. This is security through obscurity. The data is not being encrypted in a standard way. But the binaries on the computer that are used to decrypt the data can be decompiled to discover this obscure method. At that point you have no advantage over other encryption programs.
If you want to be deniable get rid of the hard drive and require an internet connection. Then when someone gets your "DV" unit and asks where the video is you can say it was set to live streaming mode and is never recorded.Not sure what the software updates include but for the hardware I would expect live-time warranty or at least something reasonable, like 5 to 10 years.
Other than that. Nice product.
Left align your text. Follow the advice of this book by Robin Williams:
"Find a strong alignment and stick to it."
"Avoid using more than one text alignment on the page (that is, don't center some text and right-align other text).
And please try very hard to break away from a centered alignment unless you are consciously trying to create a more formal, sedate presentation. Choose a centered alignment consciously, not by default."
- The Non-Designer's Design Book: Design and Typographic Principles for the Visual Novice. http://books.google.com/books?id=n1AuwXafMO8C&lpg=PT42&#....
Take a look at the chapter above she shows some good examples of how to integrate images into a layout.
My first thought is why isn't there end-to-end digital signing from the camera to the monitor. Sure, you could probably still fake it out by getting into the camera and reading the key from ROM or whatever, but that's a hell of a lot harder than just tapping a cable.
$6k is a lot for what on 1st impression 'looks' to be targeting the lower end of the security imaging market. You can buy three HD Axis IP cameras for that money. Speaking of cameras, you don't show or give any specs which is really strange when you're asking for 6k
the more I read your site the more I can somewhat understand the price, but if I was just a customer - you would have lost me in 30 seconds; your landing page doesn't convey your product's 6k of value
Still, kudos for not coming up with yet another web app
I think a screencast would be good to explain what it does and how it works.
If it takes $6K to convince the wife to break out the whips for the camera, I think there's plenty of guys that would do it.
Why would I need continuous audio/video recording?
I would have concerns using something like this, if someone ransacked my place of business or whatever (and it looks like this is targeted towards people who might have that sort of problem), it would be problematic if I couldn't view the video it recorded just because I didn't have the USB key anymore.
It would also bug me that I couldn't store an encrypted version of my videos for backup (of course I could encrypt them myself, but that kind of defeats the purpose of this device). So if I wanted to have some redundancy I'd have to store un-encrypted backups of my data, or be at the mercy of someone stealing my device.
For $6,000, I'm afraid I'd pass on this.
It looks like there's no reason why the camera and the device have to be within a certain number of feet of each-other, other than limitations in cable and such. So, you could lock the device inside of a safe constructed specifically for it, or inside a wall, or something. (I actually have a client with a real "false bookcase", and that would be an idea storage area.)
I bet they could upgrade their software to allow you to download a copy of your encrypted video. They've yet to release their specific algorithms used, but I don't see anything that would prevent that based on their diagrams and text.
Having multiple languages seems a bit odd if large swaths of content aren't translated. "Cette page est disponible seulement en anglais" being followed by an entire page of English text doesn't help credibility.
Your logo seems like it'd fail pretty hard for individuals with red-weak color blindness.
The 'deniable video operation' flowchart is more complex than what I want, for understanding how it works.
If the thing is supposed to be deniable, I might prefer a plain black plastic, or aluminum enclosure to a giant DV logo'd one.
The targeting seems very broad... and some of it seems a bit misinformed. As an example, there are substantial SEC rules when it comes to communications and the records thereof, but you have two trading-related examples in commercial.
I'd like a clear example of how it is that:
a) if my wife asks me for my password, she will get the pictures of her and I... not of the woman I met on ashleymadison. (purely hypothetical, honey.)
b) if a government asks me for my password, they will get something plausible, but not everything...
I guess it's just not clear to me what it's really good at, except that it's a camera, and a hard drive, and it uses ogg vorbis and chunks to... do something.
edit: It also conflates what appear to be the two major features (encryption, and data hiding), and it's not obvious to me what quality the resulting video will be, nor what I'd have to do if I wanted to use it in broadcast.
Also, I felt like I had to read a lot of the website to know what the product really did. I might've got the gist faster if the front page said something like: Deniable Video. * Records, Encrypts and Hides Your Video. I really didn't know what "personal video security that's loyal to you" meant.