Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Australians who won't unlock their phones could face ten years in jail

nakedsecurity.sophos.com

Post reply on HN
Print view View original

101–110 of 167 posts

Re: Australians who won't unlock their phones could face ten years in jail

#101

Post by jkaptur »

cryptonector wrote: post #69
squarefoot wrote: post #55

Plausible deniability. The system should allow two (or more) passwords, one unlocks only the important stuff and one unlocks much less dangerous stuff while destroying any evidence of the first, including the multiple passwords protection layer. To add some credibility, the less dangerous data should contain something one could get in trouble for but not enough to have his life destroyed. As an example, if after bein…

LEO are not stupid. If you are using tech with this feature then they'll ask for both passwords.

Some thinking along these lines: https://web.archive.org/web/20100820175505/http://iq.org:80/...

Re: Australians who won't unlock their phones could face ten years in jail

#102

Post by packet_nerd »

grosjona wrote: post #24
jasonbarrah wrote: post #22

Earlier quoted context omitted.

"Arguing that you don't care about the right to privacy because you have nothing to hie is no different than saying you don't care about free speech because you have nothing to say." -E. Snowden

I disagree with that statement because they have fundamentally different purposes. Free speech affects my ability to improve society. Right to privacy affects my ability to cover my own ass.

> Right to privacy affects my ability to cover my own ass.

Actually this isn't the most important reason for privacy.

Privacy and other basic rights do very little for me as an random law-abiding dude. I don't break laws, so don't have any reason to cover my ass. I don't have much to say, so not being allowed to express my opinion doesn't seem like that big of a deal. Even in the doomsday scenario where evil totalitarian dictator takes over the country and mass-surveils everyone and otherwise stomps on our rights, it probably won't be that big a deal to lowly me.

The most important reason for protecting individual privacy is to protect the future of society and civilization itself. The average dude in Nazi Germany and Pol Pot era Cambodia probably barely noticed his loss of individual rights as far as daily life was concerned. Mass surveillance enables mass control, and the worst atrocities in history have all happened in environments where individual rights - including privacy - were disregarded. It's bigger than just me. It's about protecting society itself and giving my children a decent world to live in.

Re: Australians who won't unlock their phones could face ten years in jail

#103

Post by kirrent »

d0lph wrote: post #98
josephagoss wrote: post #64

Earlier quoted context omitted.

Regarding your example of this person being forced into a mental institution, are you able to provide a source? I'm interested in learning more especially as I'm living in Australia, this is quite terrifying indeed.

I did a search for "Fiona Wilson Australia fixated" and got back a few articles, not familiar enough with AU news to determine what is tabloids and what is not. Please post if anyone finds something reputable.

Did the same search. Everything is a tabloid or worse. Nothing reliable.

Re: Australians who won't unlock their phones could face ten years in jail

#104

Post by stale2002 »

cryptonector wrote: post #100
stale2002 wrote: post #78

Earlier quoted context omitted.

Well, then you give them your second password, and it is fine, because you actually have 3 passwords. The police can't just keep saying "we didn't find anything, therefore you MUST have ANOTHER double secret password!". At that point you are indistinguishable from someone who is innocent.

The device is rated 1TB. Given all of the passwords you gave us we can account for .5TB and we cannot find a free-space map. Ergo there is at least one more password that you're not sharing with us. Seriously, other people aren't dumb.

That's not how partions work for these things. And the people who wrote these security systems thought of exactly this attack vector.

If you create a passworded partion, it adds a bunch of extra unused space, that MIGHT be another passworded partion, or might just be random empty space.

IE, maybe you have 3 passwords and 200 GB of extra space, or maybe it is actually 4 passwords and 150 GB of extra space that is random bytes.

These 2 situations are identical and cannot be differentiated.

The police tell you to access that 150GB of extra space, and it is impossible. Because it's random bytes, and there really isn't an extra partition.

Re: Australians who won't unlock their phones could face ten years in jail

#105

Post by DanBC »

stale2002 wrote: post #78
cryptonector wrote: post #71

Earlier quoted context omitted.

If LEO find you're using Truecrypt, do you think they'll not realize that you might have a hidden drive and ask for that password too??

Well, then you give them your second password, and it is fine, because you actually have 3 passwords. The police can't just keep saying "we didn't find anything, therefore you MUST have ANOTHER double secret password!". At that point you are indistinguishable from someone who is innocent.

> The police can't just keep saying "we didn't find anything, therefore you MUST have ANOTHER double secret password!"

You might want to watch "Making a Murderer". Or, for the UK equivalent, have a look at the Cleveland Child Abuse Scandal (where social workers were asking children questions like "Tell us the truth, you're not going home until you tell us what Daddy did to you").

The police can, and do, subject people to coercive interrogation techniques. These techniques have been designed to extract a confession, whether you're guilty or not.

Re: Australians who won't unlock their phones could face ten years in jail

#106

Post by eftychis »

ShorsHammer wrote: post #53
kodablah wrote: post #6

Also concerning is what they are doing towards companies (pardon the tangent): > It covers [...] device vendors [...] as long as they have "a nexus to Australia" > But what if the suspect stores the keys themselves? In that case, the government would pull out the big guns with a second kind of order called a technical capability notice. It forces communications providers to build new capabilities that would help the…

The article mentions both child abusers and terrorists yet the laws will rarely be used for that. Mandatory metadata retention was also bought in for the same reasons and has barely appeared as evidence in any subsequent cases, despite >300,000 warrantless metadata requests last year, overseen by a handful of public servants behind closed doors, in a country of 25 million people. Another very concerning law is about…

I am speechless... No literary.

The moment, I hope things are improving and people become more involved and don't stand for this ..., things like these pop up as a form of disillusionment.

Her mistake I guess was contacting the minister or the minister's circle, who are probably in on this?

P.S. It seems the whistle-blower protections in Australia are ... lacking to say the least. Anyone care to pitch in? I can find a bunch of articles with horror stories.

Re: Australians who won't unlock their phones could face ten years in jail

#107

Post by dingaling »

fredley wrote: post #2

Like a $5 wrench[1], but more socially acceptable. 1: https://xkcd.com/538/

For a couple of decades pre-XKCD that technique was called "rubber-hose decryption". I don't know why he thought it necessary to change the implement; a hose causes repeatable pain, a wrench can cause fatal damage.

Re: Australians who won't unlock their phones could face ten years in jail

#108

Post by goblin89 »

cryptonector wrote: post #100
stale2002 wrote: post #78

Earlier quoted context omitted.

Well, then you give them your second password, and it is fine, because you actually have 3 passwords. The police can't just keep saying "we didn't find anything, therefore you MUST have ANOTHER double secret password!". At that point you are indistinguishable from someone who is innocent.

The device is rated 1TB. Given all of the passwords you gave us we can account for .5TB and we cannot find a free-space map. Ergo there is at least one more password that you're not sharing with us. Seriously, other people aren't dumb.

Partition will report it’s 1TB large[0]. You should perhaps read about the software before continuing to post comments claiming it’s unfit for purpose. There is a list of considerations that a TrueCrypt/VeraCrypt user with stricter security requirements would have to keep in mind, following all of it makes it fairly difficult to discover hidden partitions. The people who wrote and maintain the software aren’t dumb either.

[0] https://security.stackexchange.com/a/58150

Re: Australians who won't unlock their phones could face ten years in jail

#109

Post by cesarb »

cryptonector wrote: post #95
lol768 wrote: post #76

Earlier quoted context omitted.

> Then the LEO just asks for the second password. But it's entirely _optional_ to use. They cannot prove there is a second password.

They're not dumb. You installed the thing you're claiming gives you plausible deniability -- it's a fair inference that you wanted just that so that you could hide something, ergo the court will just demand that password. Which means you shouldn't install any such software unless you're going to have those hidden partitions and are willing to let LE have access.

Do most users of TrueCrypt/VeraCrypt use this "hidden volume" functionality, or do they just want the basic full disk encryption? It wouldn't surprise me if users of plausible deniability were in the minority.

Re: Australians who won't unlock their phones could face ten years in jail

#110

Post by ada1981 »

binomialxenon wrote: post #94
comboy wrote: post #52

Earlier quoted context omitted.

It doesn't seem so easy to do reasonably. Somebody can compare your call log/messages to data they got from your provider. It still seems like a nice idea, but it doesn't really give you plausible deniability.

I don't think the call and SMS log is what needs to be hidden, as those are so easily accessible that it would be foolish to use them for anything very sensitive. It would be to protect more sensitive things such as email accounts, encrypted messaging, photos, documents, etc.

Right. Or getting into crypto Wallets, etc if you are held at gun point.

Having that as an option would be useful.

Post reply on HN