Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My USB Drive Has a Hidden Encrypted Vault

rootkitlabs.com

Post reply on HN
Print view View original

51–60 of 175 posts

Re: My USB Drive Has a Hidden Encrypted Vault

#51

Post by Dylan16807 »

tptacek wrote: post #49
Dylan16807 wrote: post #46

Earlier quoted context omitted.

Random is important, character set not so much. And yes when I say 2 characters I mean random ones. Even 26x26 is plenty to compensate. Or you can add one random word.

We're both saying the same thing: you can make the KDF irrelevant if you (as you just specified) use an AES key as an input. The entire point of KDF is that humans don't do that.

No, what I'm saying is: If your password was good enough for a quality KDF, then improving it to use a 50x worse KDF is very easy. If the worse one requires you "use an AES key", then the good one pretty much also required you to "use an AES key". If the good one didn't require that, then the 50x worse one also doesn't require that. Generate a single letter and slap it on the end, or human-pick two letters.

50x is not the decider between allowing a good password and allowing a bad password. It's a tiny little nudge.

Edit: To put "little nudge" another way, if you have a 1-10 scale of password quality, most steps in that scale are going to be more than 5.6 bits apart.

Re: My USB Drive Has a Hidden Encrypted Vault

#53

Post by LorenPechtel »

tptacek wrote: post #8
johnnyApplePRNG wrote: post #5

Earlier quoted context omitted.

>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everyth…

This is self-soothing, not a real security plan. It doesn't matter how competent a security agency is, because there's a whole ecosystem of vendors selling into that space; knowledge of how to attack encrypted disks like this is outsourced, and, importantly, those firms have incentives to mop up even random stuff like this, because vendors will be selected in part based on lists of how many different circumvention an…

This isn't stand-up-to-state-actors security. This is keep-state-actors-from-noticing security. They know you're guilty, they'll get it. The XKCD version of password cracking works no matter how secure your hardware.

But while states realistically can crack most anything it doesn't mean they can crack *every*thing. There are simply too many flash drives crossing the border every day.

But there is a big flaw I see: 8gb. You're carting around an 8gb flash drive these days??

Re: My USB Drive Has a Hidden Encrypted Vault

#54

Post by PaulHoule »

tptacek wrote: post #30
aeturnum wrote: post #28

Earlier quoted context omitted.

I often see comments like this on encryption related project. Depending on the reader you make what might be an essential point - but I also don't really know how useful it is to say it here. The author makes no claims about what adversaries this should be sufficient against and is completely open about their constraints and decisions (allowing you to make the critique in the first place). Basically evading a state-l…

I'm generally pretty fatalistic about avoiding state-level adversaries. So, in a sense, it doesn't really matter how one thinks a security countermeasure is going to stack up against an IC attacker. The important thing is that people understand how hard this is to do, and take that into consideration before adopting tools like these. You can easily make things worse for yourself. I think this post is a fun technical…

My first take is that it is terrible terrible opsec to talk about this sort of thing if you actually want to take it across a border or have any kind of "elevated" encounter with law enforcement or intelligence.

Like if they have good tools for profiling you from your posts they'll totally expect the OP to have some interesting hardware and stories to tell. Contrast that to just being some boring guy who has a cover story that happens to be true or the colorful character who doesn't really have anything to hide but who can keep spooks talking for hours.

Re: My USB Drive Has a Hidden Encrypted Vault

#55

Post by giancarlostoro »

johnnyApplePRNG wrote: post #5
tptacek wrote: post #3

If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…

>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everyth…

Anyone using forensic software can dump an image of your entire drive including all partitions, byte for byte copy. Just because you got away with being careless once doesn't mean this will work every time. If you don't want your files to be copied in encrypted or plain unencrypted form, don't bring them with you. You're better off re-downloading them over the web at that point.

Re: My USB Drive Has a Hidden Encrypted Vault

#56

Post by giancarlostoro »

LorenPechtel wrote: post #53
tptacek wrote: post #8

Earlier quoted context omitted.

This is self-soothing, not a real security plan. It doesn't matter how competent a security agency is, because there's a whole ecosystem of vendors selling into that space; knowledge of how to attack encrypted disks like this is outsourced, and, importantly, those firms have incentives to mop up even random stuff like this, because vendors will be selected in part based on lists of how many different circumvention an…

This isn't stand-up-to-state-actors security. This is keep-state-actors-from-noticing security. They know you're guilty, they'll get it. The XKCD version of password cracking works no matter how secure your hardware. But while states realistically can crack most anything it doesn't mean they can crack *every*thing. There are simply too many flash drives crossing the border every day. But there is a big flaw I see: 8g…

> The XKCD version of password cracking works no matter how secure your hardware.

Lavabit would like to enter the conversation.

Re: My USB Drive Has a Hidden Encrypted Vault

#57

Post by giancarlostoro »

pixl97 wrote: post #37
monster_truck wrote: post #24

Earlier quoted context omitted.

There literally are not. Anyone competent enough to be an expert witness will be able to plainly explain to everyone else how statistical analysis obviously delinates the difference between truly random noise and an encrypted volume.

Loll, you have a lot of faith in the legal system that I do not. Expert witnesses are commonly full of shit.

I heard one argue that "zooming" on an image by adding pixels with an algorithm is normal, and he's had such "evidence" used in court before. I was a little horrified as someone who has worked on digital forensic software at a former employer. Adding pixels to an image is not evidence, you're fabricating something out of thin air, especially if its drastically smaller, its even more likely to be BS.

Re: My USB Drive Has a Hidden Encrypted Vault

#58

Post by amelius »

fhdkweig wrote: post #12
amelius wrote: post #9

Earlier quoted context omitted.

Someone should write a disk formatting utility that randomizes the bits on your drive. Now you can claim that any encrypted drive (which just looks like pure noise if done correctly) is a drive that was just formatted.

Be careful in countries like UK which have laws requiring the decryption of any data they find. There are people sitting in jail because they couldn't decrypt the "random noise" on their computers.

This is exactly the point. If storing random data was the norm (formatting utilities would offer it) then it would be hard to make a case against it.

And it actually _does_ make sense for formatting utilities to offer it, as this is a good way to ensure that data is really gone after formatting (writing all 0s or all 1s could leave information at the physical layer; and any intermediate layer could not compress random data much so the data must be overwritten).

Re: My USB Drive Has a Hidden Encrypted Vault

#59

Post by tptacek »

LorenPechtel wrote: post #53
tptacek wrote: post #8

Earlier quoted context omitted.

This is self-soothing, not a real security plan. It doesn't matter how competent a security agency is, because there's a whole ecosystem of vendors selling into that space; knowledge of how to attack encrypted disks like this is outsourced, and, importantly, those firms have incentives to mop up even random stuff like this, because vendors will be selected in part based on lists of how many different circumvention an…

This isn't stand-up-to-state-actors security. This is keep-state-actors-from-noticing security. They know you're guilty, they'll get it. The XKCD version of password cracking works no matter how secure your hardware. But while states realistically can crack most anything it doesn't mean they can crack *every*thing. There are simply too many flash drives crossing the border every day. But there is a big flaw I see: 8g…

We're talking about exactly the same threat. What I'm pointing out is that state adversaries won't have to "notice" this; all they'll have to do is plug the device into a standard commercial forensics scanner product --- and we're stipulating that they're plugging the device in already (else what does it matter what bits are on it).

They pay other people to notice this stuff for them!

Re: My USB Drive Has a Hidden Encrypted Vault

#60

Post by cyberax »

tptacek wrote: post #3

If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…

One possible trick: round down the normal volume size to the nearest 1Gb and encrypt it (who doesn't use encryption today?!?) and use it for non-secret data with a password that you're willing to divulge if pressed. This is innocuous enough.

Then use the rest of the drive (~1Gb) for a hidden TrueCrypt volume with a secure key.

Post reply on HN