Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 284 posts

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#41

Post by hndamien »

Neverbolt wrote: post #32
stephengillie wrote: post #15

Earlier quoted context omitted.

Something doesn't add up in this story. Encryption and hashing are different processes with different algorithms - SHA vs MD5. For example, IPSec VPNs hash a packet with MD5 to prevent tampering, then encrypt the hash with SHA256 to prevent viewing. (Because the message could be modified while encrypted, were it not also hashed.) Isn't the point of encryption that it doesn't create a reliable hash - that 2 identical…

There are several misconceptions in this comment, first and foremost that SHA is encryption, which it is not. It is a hashing algorithm, not unlike MD5, though "stronger". Secondly, when you have two files that are exactly the same and encrypt both with the same key, method and parameters then both will have the same hash. ( Though I could imagine Apple doing stuff with padding, and other parameters to make this not…

With the same key is a very important distinction there.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#42

Post by simonbarker87 »

Given the could convict him right now, my guess is that they are trying to bargain in some way to get access to the HDDs as a way to 1) try to find the children being abused and 2) access a wider ring of child absusers etc.

Given the legal grey area this all appears to be in and the potential upside of getting in to the HDDs this seems like something the authorities would be ok doing while the law catches up.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#43

Post by ship_it »

ZenoArrow wrote: post #34

One potential option: 1. Install a hardware keylogger (software keylogger wouldn't work) in the laptop. 2. Release the defendant. 3. Get a warrant for the arrest of the defendant for CP-related crime. 4. Decrypt the laptop with the password recovered from the keylogger. All of this depends on the suspect using the laptop again, but I'm guessing they'd want to recover the contents on the laptop.

> Install a keylogger: Ok, check. Keylogger installed.

> Release the defendant: If this is judges decision, he can't be in court again for the same crime.

> Get a warrant for the arrest: Again? Isn't he released? As such, gov must not return laptop with backdoor either in hardware or software mode.

> Decrypt the laptop: Even if all above matched, you think he'd use the same laptop again? If he has a bit of brain, I think he wouldn't.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#44

Post by [deleted] »

chatmasta wrote: post #39
Neverbolt wrote: post #32

Earlier quoted context omitted.

There are several misconceptions in this comment, first and foremost that SHA is encryption, which it is not. It is a hashing algorithm, not unlike MD5, though "stronger". Secondly, when you have two files that are exactly the same and encrypt both with the same key, method and parameters then both will have the same hash. ( Though I could imagine Apple doing stuff with padding, and other parameters to make this not…

Right... so for the authorities to "compare" the hash of an encrypted file with that of a known original, they would need to encrypt the original with the same private key used to encrypt the encrypted file. If they had that private key, wouldn't it be sufficient to unlock the drive? They wouldn't need his cooperation to decrypt the drive if they had a private key. So it seems like a catch-22 compelling him to decryp…

[deleted]

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#46

Post by cabaalis »

geofft wrote: post #40
jancsika wrote: post #29

There's a better article in Ars: https://arstechnica.com/tech-policy/2017/03/man-jailed-indef... From that article: > The court also noted that the authorities "found [on the Mac Book Pro] one image depicting a pubescent girl in a sexually suggestive position and logs that suggested the user had visited groups with titles common in child exploitation." They also said the man's sister had "reported" that her brother s…

> "The fact remains that the government has not brought charges," Donoghue said in a telephone interview. "Our client has now been in custody for almost 18 months based on his assertion of his Fifth Amendment right against compelled self-incrimination." To be clear (and I am pretty sure the public defender knows this, but is just phrasing it like this for public perception), the prosecution's position is that the Fif…

So much for that whole constitution thing anyway.. They can just create some "act" that overrides it! And nobody will complain because the person affected is the bad guy, until they come for them.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#47

Post by djsumdog »

jancsika wrote: post #29

There's a better article in Ars: https://arstechnica.com/tech-policy/2017/03/man-jailed-indef... From that article: > The court also noted that the authorities "found [on the Mac Book Pro] one image depicting a pubescent girl in a sexually suggestive position and logs that suggested the user had visited groups with titles common in child exploitation." They also said the man's sister had "reported" that her brother s…

Yea, at this point they either need to charge him and take him to court with the evidence they have or release him.

There is simply no way to prove he is knowingly withholding a password vs simply forgetting it.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#48

Post by weinzierl »

xtanx wrote: post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

> If the disk is encrypted how can they match file hashes?

This is an attack, which contemporary block based FDE doesn't really protect you well from. Bitlocker, FileFault, TrueCrypt, VeraCrypt basically operate on one disk block at at time and this means they cannot hide data patterns well. Or as Thomas Ptacek put it in his article "You Don't Want XTS" [1]

>It’s ECB-like. It can’t do a perfect job of providing privacy.

This is also why Thomas Ptacek and others are advocating that FDE is not a complete replacement for file based encryption.

> But that’s the big problem: sector-level encryption sucks. It’s messy, provides fewer security guarantees than conventional message encryption, and makes tradeoffs tailored to the challenges of encrypting disk sectors.

> Sector-level crypto is last-resort crypto.[1]

The Wikipedia article about ECB[2] (which is not used in current FDE) has a dramatic example where the image of the Linux penguin is clearly recognizable in the ciphertext.

[1] https://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/

[2] https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#50

Post by djsumdog »

stephengillie wrote: post #15
xtanx wrote: post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

Something doesn't add up in this story. Encryption and hashing are different processes with different algorithms - SHA vs MD5. For example, IPSec VPNs hash a packet with MD5 to prevent tampering, then encrypt the hash with SHA256 to prevent viewing. (Because the message could be modified while encrypted, were it not also hashed.) Isn't the point of encryption that it doesn't create a reliable hash - that 2 identical…

I would assume they have evidence, maybe via a warrant to his ISP, that showed the transfer of files with hashes of known illegal content. They might have evidence content was transferred to a computer on an account in his name, but they most likely do not have evidence of his actual possession of illegal content.
Post reply on HN