Live data from Hacker News

Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

bleepingcomputer.com

11–20 of 284 posts

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#11
"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content."

If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#12

`Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content.` Well there's the reasoning

that makes 0 sense, if the files are encrypted they cannot be a match

Yeah, what gives? "We encrypted childporn.mpg with the password 'supersecure123', and once encrypted the file hash came out the same as one of the files. But we have no idea what his password is!"

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#13
post #4

The accused crime is heinous and there is some evidence against him stated in the article but common, an indefinite jail sentence with no conviction? Then people wonder why the country elects Trump to shake things up. This guy should stand trial or be let go.

Trump quite explicitely promised to double on police and prosecutor power. If what you want is better protection for accused, Trump is last person you should vote for.

He is probably not voting trump, only stating than when things go nuts, people do nutty things.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#14
post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

> Do they encrypt known CP files with the FileVault key and then compare?

This shouldn't work because if they had the key (which should be encrypted with the password) then they could also just decrypt the rest.

Somebody on IRC said that maybe the encrypted filesystem saves hashes of the files unencrypted, but not sure if Apple's FileVault does this.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#15
post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

Something doesn't add up in this story. Encryption and hashing are different processes with different algorithms - SHA vs MD5. For example, IPSec VPNs hash a packet with MD5 to prevent tampering, then encrypt the hash with SHA256 to prevent viewing. (Because the message could be modified while encrypted, were it not also hashed.)

Isn't the point of encryption that it doesn't create a reliable hash - that 2 identical files will appear different while encrypted, as part of the larger encrypted drive?

Or are encrypted-hash collisions possible when small files are encrypted individually?

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#16
post #9

`Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content.` Well there's the reasoning

Serious question for those who know about crypto, do drive encryption systems allow to retrieve hashes for the encrypted files?

I'm also curious if this makes sense?

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#17

`Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content.` Well there's the reasoning

that makes 0 sense, if the files are encrypted they cannot be a match

I think there can be a match but it's a spurious match.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#18
post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

[deleted]

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#19
post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

> Do they encrypt known CP files with the FileVault key and then compare? This shouldn't work because if they had the key (which should be encrypted with the password) then they could also just decrypt the rest. Somebody on IRC said that maybe the encrypted filesystem saves hashes of the files unencrypted, but not sure if Apple's FileVault does this.

Storing hashes of unencrypted files, would that allow FileVault to verify it was decrypted without error?

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#20

`Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content.` Well there's the reasoning

that makes 0 sense, if the files are encrypted they cannot be a match

From what I understand, they have basically the logfile or other metadata from the program he used to download/manage these files, which contains the hashes. The encrypted drives in question are external drives, not the OS drive.
Post reply on HN