Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Review our startup: Deniable Video

deniablevideo.com

Post reply on HN
Print view View original

21–30 of 45 posts

Re: Ask HN: Review our startup: Deniable Video

#21

Post by andrewcooke »

_cbsz wrote: post #4
notmyname wrote: post #2

Generally when I hear the term "deniable" used with something security related, I think of something like the hidden volumes in True Crypt: something that I can't be proved to have. Does your product provide this level of deniability? I would venture a guess that the answer is no (after all, there is a box with a big "DV" on it). If not, what do you mean by the word deniable?

Ditto. I'm a grad student studying security, and I'm not convinced that this is deniable. How will you deny the DV box (or even unlabeled camera & microphone) in your meeting area when the feds suddenly raid the place? How will you deny the private key on that USB drive you are very very careful to store securely, lest you lose the ability to view the video? I believe that history predicts that once the existing of t…

but to some extent that's no different to the problem of having truecrypt (for example) installed on your computer - you have to explain that. of course, in the case of truecrypt you can have multiple (edit: hidden) volumes - i guess the equivalent here might be to have an "innocent" video that can be unencrypted. even then, though, it will be clear that the time isn't current, so if there is any "on" light, or disk activity on recording, that could be used as evidence that other data exist....

Re: Ask HN: Review our startup: Deniable Video

#22

Post by mooism2 »

For most of the uses on your "Purposes" page, you don't need the deniability, only the encryption. So this is overkill.

For the journalism uses, the product does not seem to be enough. When the authorities ask you to show them what video you've taken, you need to be able to use a secondary key that reveals your interview with the Ministry of Information's Official Spokesman, but conceals your interview of an opposition leader and your video of an anti-government protest.

Re: Ask HN: Review our startup: Deniable Video

#23

Post by robotrout »

_cbsz wrote: post #4
notmyname wrote: post #2

Generally when I hear the term "deniable" used with something security related, I think of something like the hidden volumes in True Crypt: something that I can't be proved to have. Does your product provide this level of deniability? I would venture a guess that the answer is no (after all, there is a box with a big "DV" on it). If not, what do you mean by the word deniable?

Ditto. I'm a grad student studying security, and I'm not convinced that this is deniable. How will you deny the DV box (or even unlabeled camera & microphone) in your meeting area when the feds suddenly raid the place? How will you deny the private key on that USB drive you are very very careful to store securely, lest you lose the ability to view the video? I believe that history predicts that once the existing of t…

Regarding the "private key on the USB drive", I think the USB drive contains their software. Your private key is typed in at a password prompt.

Regarding the "contempt of court" threat, they need to implement hidden volumes, like TrueCrypt does, and that will be addressed.

Re: Ask HN: Review our startup: Deniable Video

#25

Post by tptacek »

At most, this device seems trustworthy exactly to the extent that you trust that hardware hasn't been tampered with. Since there's very little information about how the tamper-proofing works, I tend towards skepticism.

At worst, they've implemented a cryptosystem that, having never been peer reviewed, is vulnerable to basic attacks. Since I can't find out who the authors are, and they use both AES and Serpent with listed key sizes instead of talking about how the design works, I tend towards skepticism.

Finally, I'm with everyone else wondering why deniability is something the market cares about.

Re: Ask HN: Review our startup: Deniable Video

#26

Post by tptacek »

run4yourlives wrote: post #15

Sounds like it solves the "Oh noes they stole our sex tape" concern most celebrities seem to have these days...

How do you figure? The sex video didn't get stolen directly off the tape; the real vulnerabilities are later in the chain of custody.

Re: Ask HN: Review our startup: Deniable Video

#27

Post by tptacek »

thaumaturgy wrote: post #11

Ah, I see. They've separated the storage of software and the storage of video into two separate devices. The unit arrives with its video storage area filled with "random" data, and then the encryption process for the video writes into the video storage area. As long as the encryption methods used produce data which cannot be differentiated from pseudo-random data, then it's impossible to tell whether there's any vide…

You mean: unless there's some physical way to determine the recency and timing of writes to the storage media.

Re: Ask HN: Review our startup: Deniable Video

#28

Post by thaumaturgy »

robotrout wrote: post #19
thaumaturgy wrote: post #5

Earlier quoted context omitted.

This is answered directly on their website. They record the video in a way that supposedly makes it impossible to determine if video has actually been recorded at all. Thus, you can simply say, "Well, sure, I've got the box, but it hasn't been recording anything", and nobody can prove otherwise. I'm still reading the site to see if I can understand the technical basis for their claims.

This is exactly the same premise as TrueCrypt. Nobody can know if there's anything on a TrueCrypt volume or not. They address the coercion (either by law enforcement or guy with a gun), by allowing you to make hidden volumes inside the main volume. You open the main volume, filled with data you don't care about, and they never know that a hidden volume resides deeper. I see no reason that this same technique wouldn't…

IIRC, some minor vulnerabilities to TrueCrypt's DFS were found.

Ah, found one link: http://www.schneier.com/paper-truecrypt-dfs.pdf

Re: Ask HN: Review our startup: Deniable Video

#29

Post by sailormoon »

goodside wrote: post #20

My first impression: I love the idea, but I'd never give $6,000 to a site that looks like yours. I generally don't like criticizing without some constructive advice on what to fix, but in this case you don't need tips from random commenters, you need professional graphic design talent. A lot of startups could forego that at first, but not if they're selling $6,000 of equipment to an audience that's pre-selected to be…

What exactly put you off? I mean, it's not the best site I've ever seen, but I hardly had the visceral reaction against it you seem to have experienced.

There's a balance to be struck I think - you can't look too Netscape 4.0 but I'd, if anything, be made suspicious by an obvious focus on marketing bling. I would have thought this site is a little drab but serviceable enough, decently put together, certainly enough to avoid losing credibility.

Re: Ask HN: Review our startup: Deniable Video

#30

Post by astine »

goodside wrote: post #20

My first impression: I love the idea, but I'd never give $6,000 to a site that looks like yours. I generally don't like criticizing without some constructive advice on what to fix, but in this case you don't need tips from random commenters, you need professional graphic design talent. A lot of startups could forego that at first, but not if they're selling $6,000 of equipment to an audience that's pre-selected to be…

Um... As a paranoid person, good web design is going to do nothing to allay my fears. A good track record or independant verification might on the other hand. Also, I like the design.
Post reply on HN