Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Australians who won't unlock their phones could face ten years in jail

nakedsecurity.sophos.com

Post reply on HN
Print view View original

111–120 of 167 posts

Re: Australians who won't unlock their phones could face ten years in jail

#111

Post by cryptonector »

stale2002 wrote: post #104
cryptonector wrote: post #100

Earlier quoted context omitted.

The device is rated 1TB. Given all of the passwords you gave us we can account for .5TB and we cannot find a free-space map. Ergo there is at least one more password that you're not sharing with us. Seriously, other people aren't dumb.

That's not how partions work for these things. And the people who wrote these security systems thought of exactly this attack vector. If you create a passworded partion, it adds a bunch of extra unused space, that MIGHT be another passworded partion, or might just be random empty space. IE, maybe you have 3 passwords and 200 GB of extra space, or maybe it is actually 4 passwords and 150 GB of extra space that is rand…

You're missing the point, which is that LEO and courts will (reasonably!) make the following inference:

  "MIGHT be another password-protected partition"
    ->
      "is a password-protected partition"
You can disagree with that thinking all you want, but it won't do you any good if the people thinking that are in control of your destiny.

Re: Australians who won't unlock their phones could face ten years in jail

#112

Post by cryptonector »

caconym_ wrote: post #82
cryptonector wrote: post #69

Earlier quoted context omitted.

LEO are not stupid. If you are using tech with this feature then they'll ask for both passwords.

If it's impossible to prove that you've set up the second password, they can't reasonably demand that you provide it if you deny that it exists. They could un reasonably demand a working second password and incarcerate/torture you until you either provide one or die, but that's the next level.

LEO and courts will (reasonably!) make the following inference:

  "MIGHT be another password-protected partition"
    ->
      "is a password-protected partition"

Re: Australians who won't unlock their phones could face ten years in jail

#113

Post by ada1981 »

gknoy wrote: post #51
ada1981 wrote: post #47

Has anyone created a mobile OS that has a feature where if a certain password is entered on the unlock screen that it boots up a dummy desktop while silently encrypting or erasing the phone in the background?

That doesn't seem like it would be helpful from a forensics standpoint -- if a court is asking for my password, they probably already have an image cloned from my device, so any such things seem like they would either be noticeable, or simply be ineffective.

If they have a cloned copy of an encrypted phone; and a suspect gives them a password that gives them an experience of having access to the phone, They might be satisfied with that. (Especially if they aren’t reading this thread)

Re: Australians who won't unlock their phones could face ten years in jail

#114

Post by stale2002 »

cryptonector wrote: post #111
stale2002 wrote: post #104

Earlier quoted context omitted.

That's not how partions work for these things. And the people who wrote these security systems thought of exactly this attack vector. If you create a passworded partion, it adds a bunch of extra unused space, that MIGHT be another passworded partion, or might just be random empty space. IE, maybe you have 3 passwords and 200 GB of extra space, or maybe it is actually 4 passwords and 150 GB of extra space that is rand…

You're missing the point, which is that LEO and courts will (reasonably!) make the following inference: "MIGHT be another password-protected partition" -> "is a password-protected partition" You can disagree with that thinking all you want, but it won't do you any good if the people thinking that are in control of your destiny.

Sure, but then nothing you do matters.

Imagine the situation where you really ARE innocent. Jail for life? Possible, but whether you are innocent or not doesn't change anything.

Yes, the police could just jail you for life or kill you. But that's ALWAYS the case. They'd do that to you anyway of you are innocent

Re: Australians who won't unlock their phones could face ten years in jail

#115

Post by justinjlynn »

cryptonector wrote: post #96
stale2002 wrote: post #79

Earlier quoted context omitted.

Which is why you have 10 passwords, only 1 of which has the important stuff on it. You are industiguisable from someone who has 9. What, are the police just going to keep you in jail? What if you really ARE innocent? Jail for life then, because they didn't find anything incriminating?

Free space management needs imply that at some point you must provably have all N passwords or that you're wasting some amount of space just to avoid that, but since that's dumb the fair inference is that you're not doing that, and that you have N passwords to reveal.

Tools like this do not do free space management unless you've unlocked all hidden partitions. You are responsible for that. If you fill your partitions beyond capacity, you corrupt the other data in your other hidden partitions. Of course, unless you've unlocked all the hidden partitions you care about - then it can. However, well designed tools that do this have no way of knowing if you have.

Re: Australians who won't unlock their phones could face ten years in jail

#116

Post by johndough »

jedberg wrote: post #10
grosjona wrote: post #9

I think it's fine. If you did nothing wrong then you have nothing to lose by unlocking your phone. So if you don't unlock your phone, it's an admission of guilt. People are way too paranoid. Nobody cares about what you do with your phone. Sometimes I feel like the upper classes of society (especially hypocrites who have money and a reputation to protect) are projecting their fears on all other classes. Then like fool…

Please post your email password here so we can all take a look. If you've doing nothing wrong then you would have no problem with that right?

If you have the data from breaches listed on https://haveibeenpwned.com/ you can already get access to some of his passwords (not tested of course). It seems like the "nothing to hide"-philosophy has also been applied to the password complexity.

I'd strongly recommend to use secure passwords and maybe a password manager. Further, I'd recommend using different aliases and email addresses for different websites, or at least keeping email addresses private where possible.

Re: Australians who won't unlock their phones could face ten years in jail

#117

Post by cryptonector »

cesarb wrote: post #109
cryptonector wrote: post #95

Earlier quoted context omitted.

They're not dumb. You installed the thing you're claiming gives you plausible deniability -- it's a fair inference that you wanted just that so that you could hide something, ergo the court will just demand that password. Which means you shouldn't install any such software unless you're going to have those hidden partitions and are willing to let LE have access.

Do most users of TrueCrypt/VeraCrypt use this "hidden volume" functionality, or do they just want the basic full disk encryption? It wouldn't surprise me if users of plausible deniability were in the minority.

If you could show that most users never do this, you might have an argument in court. How would you do this though?

At the end of the day, the fact that you have this sw installed will make it fair to infer that you are using this feature. You can disagree, but it's what the courts say that matters here, not what I say.

Re: Australians who won't unlock their phones could face ten years in jail

#118

Post by gambiting »

cryptonector wrote: post #95
lol768 wrote: post #76

Earlier quoted context omitted.

> Then the LEO just asks for the second password. But it's entirely _optional_ to use. They cannot prove there is a second password.

They're not dumb. You installed the thing you're claiming gives you plausible deniability -- it's a fair inference that you wanted just that so that you could hide something, ergo the court will just demand that password. Which means you shouldn't install any such software unless you're going to have those hidden partitions and are willing to let LE have access.

The problem is that you could totally have truecrypt installed and not have a second hidden partition. There is no way to prove that you do. Of course, the court could throw you in jail for not being able to provide something that doesn't exist anyway, but yeah....I'd hope that the lack of proof here would help you win the case.

Re: Australians who won't unlock their phones could face ten years in jail

#119

Post by deepspace »

d0lph wrote: post #98
josephagoss wrote: post #64

Earlier quoted context omitted.

Regarding your example of this person being forced into a mental institution, are you able to provide a source? I'm interested in learning more especially as I'm living in Australia, this is quite terrifying indeed.

I did a search for "Fiona Wilson Australia fixated" and got back a few articles, not familiar enough with AU news to determine what is tabloids and what is not. Please post if anyone finds something reputable.

Same here. The most comprehensive write-up I could find was the blog post linked below. It contains a list of references but they all seem to point to irrelevant content, or to shady-looking 'news sources'.

http://www.blotreport.com/australian-politics/are-the-though...

Re: Australians who won't unlock their phones could face ten years in jail

#120

Post by eftychis »

y-c-o-m-b wrote: post #97

It's evident citizens are not going to win the fight for privacy by trying to change policy. Voting has become nearly meaningless in the modern age when it comes to changing politics. Influencing businesses to do what's right is becoming more challenging too as this order shows they can just be forced to hand over data by authorities. I don't want the "bad guys" getting away with their activities either, but I don't…

I disagree that voting has become meaningless. The issue is that young people think and feel that voting is meaningless. Thus politicians don't really have to pay attention to what young people think or want.

(You don't vote, you don't count.)

If you don't vote, your peers don't vote. You transfer your power to other people. Think of NRA. It is a small relatively movement. But if they say to their members go vote X, 100% of them are voting X. This conviction makes a difference. Even if they have 200 votes say, those 200 people are going to make sure everyone around them is going to vote appropriately. And the numbers stack. Also, as usual in the U.S. call your representatives, create a group and take legal action through courts, etc.

You have other tools in your belt too, which you mention. These are the "oh shit". But you wouldn't want 20 years from now, to have to use them, or go to jail for using them, because they were illegal.

Post reply on HN