Earlier quoted context omitted.
Could you defeat that somehow by having rotating keys?
Wouldn't that take a very long time to re-encrypt a whole drive with a new key?
Use two drives and have them switch over every night.
Man jailed over computer password refusal
161–170 of 239 posts
Re: Man jailed over computer password refusal
#162Earlier quoted context omitted.
That's certainly true for that particular instance, in that particular implementation. But it's not necessarily the case. Take some random file and encrypt it with gpg; there's nothing obvious in the contents to mark it out as encrypted data.
tom@ubuntu:~$ gpg -c flag.png tom@ubuntu:~$ gpg -v --list-packets flag.png.gpg :symkey enc packet: version 4, cipher 3, s2k 3, hash 2 salt eae60ad4255dc4e2, count 65536 (96) gpg: CAST5 encrypted data OpenPGP encrypted data is easy to find too. It even tells you the algo used. The example is symmetrically encrypted, but it works the same with asymmetric keys. Even shows who it is encrypted for. Edit: formatting.
Here's what the gpg data looks like when using someone's public key to encrypt a file... now we know who to go hit over the head with a hammer ;)
tom@ubuntu:~$ gpg -v --list-packets file.gpg
:pubkey enc packet: version 3, algo 16, keyid 63E6E0BBB9FEE3A5
data: [2045 bits]
data: [2047 bits]
gpg: public key is B9FEE3A5
gpg: using subkey B9FEE3A5 instead of primary key 7A997B0ARe: Man jailed over computer password refusal
#163Earlier quoted context omitted.
Could you defeat that somehow by having rotating keys?
Wouldn't that take a very long time to re-encrypt a whole drive with a new key?
You wouldn't re-encrypt the whole drive; usually, the master key is stored in the first few sectors of the disk, encrypted with the login key. That way, you only have to re-encrypt a small amount of data to effectively change the entire disk's key.
Re: Man jailed over computer password refusal
#164Encryption and password privacy is an entirely unsettled area of US law. The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. So, for instance, say you had encrypted files of plans to build a bomb and detailed schematics of the White House. The judge can order you to decrypt the files…
> The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. This is a really subtle point, but in the US this is not (usually) the case, because this is still self-incrimination. You see, by entering the password, you are demonstrating that you have access to the encrypted information, and…
This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick?
Considering that the record for number of decimal places memorized for Pi appears to be 67,890 I'd argue memorizing a 128-character random sequence would be both possible and most secure. ;)
Re: Man jailed over computer password refusal
#165I've been resetting people's 8 character passwords lost due to Post-Vacation-Insomnia for ages, I'd really like to see them expect me to remember a 50 character password under stress conditions.
Use a pass phrase with correct punctuation:
"I hate the boarder checks that my home country makes me go through each time I return from Europe!"
Re: Man jailed over computer password refusal
#166A friend of mine flew back home to Canada. After clearing customs, he was one of the random people chosen to have their luggage inspected. He had his laptop on him and the customs agent booted up the computer, asked him to enter his password and then took his laptop away before bringing it back without telling him anything about it. I wondered what would have happened if he refused to type in the password.
I've been wondering about this for a while, my current idea is to wipe my computer before every trip. I keep a backup on a desktop computer that I access to while away. If this happened while coming back to canada, I'd probably still argue and see what I can do. Not sure if I'd go all the way to letting them take my laptop away for ever. They can't refuse to let you back into the country so.. at least on that point you are safe.
Re: Man jailed over computer password refusal
#167Earlier quoted context omitted.
The difference is that testimony is revealing the contents of your brain ("I saw X, I did or did not do Y, I felt Z") and evidence is revealing the contents of your car trunk. Evidence does not have its own opinion of what did or did not happen, evidence does not decide what is or is not the truth. Evidence simply exists; it is for others (giving testimony) to give evidence context and relevance.
The password is among the contents of your brain.
damn. that's a really good point, but i still think it'd fall under the 4th. A password is closer to providing a key to a locked door rather than testimony.
It would be interesting to know if there was ever a hybrid case where there was a password-protected door with a numeric keypad, and someone refused to give the pw. I'd assume in a case like that, however, the cops would just smash shit out of it.
Re: Man jailed over computer password refusal
#168Earlier quoted context omitted.
There are other legitimate reasons to not want to reveal the contents of your hard-drive besides principle or self incrimination. For instance, if you had the private information of any other people. My SO works with HIV, and recently got access to sensitive data that had to be sent on DVD via courier. Who here trusts the police to not disclose their HIV status?
Disclaimer: IANAL If you're in the Unites States, the data is probably protected by HIPAA, the Health Insurance Portability and Accountability Act[1]. HIPAA includes a clause stating that the Attorney General or their designee may issue a subpoena compelling your SO to disclose that information, but only to someone investigating a Federal health care offense. I've searched through the rest of HIPAA for keywords such…
Yup, that's the case. The question is whether or your hard drive is protected from a criminal charges subpoena. The data is kept encrypted on the hard drive, but of course the authorities don't know what's on the hard drive until it's decrypted.
Re: Man jailed over computer password refusal
#169I've been resetting people's 8 character passwords lost due to Post-Vacation-Insomnia for ages, I'd really like to see them expect me to remember a 50 character password under stress conditions.
Use a pass phrase with correct punctuation: "I hate the boarder checks that my home country makes me go through each time I return from Europe!"
"border" not "boarder"
unless that was deliberate....
Re: Man jailed over computer password refusal
#170Earlier quoted context omitted.
Do you think the NSA is going to reveal to foreign governments that they've broken AES by going after some guy with child porn on his laptop? I personally doubt it. Could the NSA cooperate with the FBI? Yes. Will they? Not if it means they can't spy on Russia anymore.
"Breaking AES" is not at all necessary. All it takes is one implementation hole, or some plaintext unknowingly cached by a program. The NSA don't merely employ scores of cryptanalysts to sit around all day to try to break ciphers (though I expect they do this too). Exploiting mistakes is their bread and butter.
And "hey guys, stop using that broken software" is not what they want to tell the people they are spying on.
Can anyone name one case where the NSA has ever testified for the prosecution?