Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiddenVM – Use any desktop OS without leaving a trace

github.com

Post reply on HN
Print view View original

31–40 of 44 posts

Re: HiddenVM – Use any desktop OS without leaving a trace

#31

Post by GTP »

semanticist wrote: post #29
GTP wrote: post #24

Earlier quoted context omitted.

There was an interesting talk at one edition of CCC that boiled down to saying those techniques work only if you have the right to remain silent. Which depends on the country you're in. And I heard that in the USA, even though you have the right to remain silent, they still have the right to put you in jail if you refuse to give out your key.

You're thinking the RIP Act in the UK where the police can get an order from a judge for you to turn over a key/passphrase and you need to either prove you don't know it or face up to two years in jail (five for cases of child abuse or national security). I'm not American but I'm pretty sure no law like that in the US would be upheld at appeal, it's pretty directly conflicting with the 5th amendment.

I heard it specifically for the USA in at least two occasions. I don't remeber the first, but the latter was in the Brett Jonson's show: in an episode, he talked about another criminal that had some encrypted material and refused to give out the key. He was put in jail until he decided to give it, and at that point IIRC he got an even longer sentence due to the proof he gave them access to. But now that I think about it, it could be that the USA had him arrested by a third country, so maybe some other state's law was at stake. But I would still not bet my safety on it. Even if you successfully appeal it, you would still risk to spend quite some time in prison.

I'm not a lawyer, but from what I remember in the USA the 5th amendment defense works only with some kinds of keys: it works with a password, but wouldn't work with a "pattern" (i.e. Android's option of drawing a pattern by connecting dots) or biometric authentication.

Re: HiddenVM – Use any desktop OS without leaving a trace

#32

Post by ratg13 »

rOOb85 wrote: post #23
_boffin_ wrote: post #22

Earlier quoted context omitted.

After truecrypt 7.1a (I think), the canary vanished. After that, didn’t it become veracrypt? Did they ever add a canary or has there been research in showing it’s not backdoored?

While it’s never been officially proven, there is a interesting story behind truecrypt. It was allegedly written by one guy (Paul Le Rou) who was a programmer turned cartel boss/gun/drug runner. But back to your question, truecrypt was professionally audited and deemed “secure”, some issues were found but none that were back doors or significant. Shortly after(might have even been during) the audit truecrypt deleted…

Wow .. what a crazy story

https://en.wikipedia.org/wiki/Paul_Le_Roux

This guy's life definitely needs a movie

Re: HiddenVM – Use any desktop OS without leaving a trace

#34

Post by instagib »

ratg13 wrote: post #32
rOOb85 wrote: post #23

Earlier quoted context omitted.

While it’s never been officially proven, there is a interesting story behind truecrypt. It was allegedly written by one guy (Paul Le Rou) who was a programmer turned cartel boss/gun/drug runner. But back to your question, truecrypt was professionally audited and deemed “secure”, some issues were found but none that were back doors or significant. Shortly after(might have even been during) the audit truecrypt deleted…

Wow .. what a crazy story https://en.wikipedia.org/wiki/Paul_Le_Roux This guy's life definitely needs a movie

I think it said there’s a 447 page book and a few articles. This plus a little probable fiction could be a long tv series.

The possibility of being Satoshi of bitcoin also. Entertaining read. Programmer -> cartel boss.

Re: HiddenVM – Use any desktop OS without leaving a trace

#36

Post by ninju »

p0w3n3d wrote: post #27

A CRYPTO NERD'S IMAGINATION: HIS LAPTOP'S ENCRYPTED. LET'S BUILD A MILLION-DOLLAR CLUSTER TO CRACK IT. NO GOOD! IT'S 4096-BIT RSA! BLAST! OUR EVIL PLAN IS FOILED!" ---- WHAT WOULD ACTUALLY HAPPEN: HIS LAPTOP'S ENCRYPTED. DRUG HIM AND HIT HIM WITH THIS $5 WRENCH UNTIL HE TELLS US THE PASSWORD. Note1: xkcd/538 Note2: I'm missing images on hacker news. I understand why they are absent here though

Full link for that like to click :-)

https://xkcd.com/538/

Re: HiddenVM – Use any desktop OS without leaving a trace

#37

Post by BobbyTables2 »

Why is there so much “branding” to Tails?

I feel like all of tails could simply be a short bash script that uses “debootstrap” to stage a Debian installation and then make it into a squashfs image that is mounted with overlayFS and a tmpfs (which is like a 3-line addition to the main “init” script).

(And yes, I’ve done this before. It’s not hard)

Instead they have a very fancy website and provide binary images without really showing how it works…

Not trying to belittle what they did, I’m sure that took a lot of work.

Just don’t understand the current fads… I feel like they’re trying a little too hard to sell a free product…

Re: HiddenVM – Use any desktop OS without leaving a trace

#38

Post by AzzyHN »

NKosmatos wrote: post #4

Nice one. I’ve been using Veracrypt for many years now, after the whole Truecrypt fiasco. Just one friendly advice… always have a decoy partition or decoy OS, otherwise it seems very suspicious to have a disk filled with random data ;-)

Does full disk encryption not look like random data?

Re: HiddenVM – Use any desktop OS without leaving a trace

#39

Post by tredre3 »

BobbyTables2 wrote: post #37

Why is there so much “branding” to Tails? I feel like all of tails could simply be a short bash script that uses “debootstrap” to stage a Debian installation and then make it into a squashfs image that is mounted with overlayFS and a tmpfs (which is like a 3-line addition to the main “init” script). (And yes, I’ve done this before. It’s not hard) Instead they have a very fancy website and provide binary images withou…

Tails provides a live ISO that guarantees that everything you do goes through Tor. It seems like a useful thing to have preconfigured. Privacy shouldn't require extensive Linux experience. And even then, I've been using Linux for decades and, whilst I could probably figure it out, I wouldn't trust myself that my setup isn't leaking packets.

Besides, all distributions do some branding (some to the point of obnoxiousness).

HiddenVM, on the other hand, I don't really understand. They make you go through tons of manual steps to achieve the aforementioned hiddenness... Might as well DIY. And their README reads like a VC pitch. "HiddenVM is an innovation in computing privacy." really? You're taking tails and telling the user to install virtualbox, veracrypt, and do the setup...

Re: HiddenVM – Use any desktop OS without leaving a trace

#40

Post by pests »

GTP wrote: post #31
semanticist wrote: post #29

Earlier quoted context omitted.

You're thinking the RIP Act in the UK where the police can get an order from a judge for you to turn over a key/passphrase and you need to either prove you don't know it or face up to two years in jail (five for cases of child abuse or national security). I'm not American but I'm pretty sure no law like that in the US would be upheld at appeal, it's pretty directly conflicting with the 5th amendment.

I heard it specifically for the USA in at least two occasions. I don't remeber the first, but the latter was in the Brett Jonson's show: in an episode, he talked about another criminal that had some encrypted material and refused to give out the key. He was put in jail until he decided to give it, and at that point IIRC he got an even longer sentence due to the proof he gave them access to. But now that I think about…

I remember a case too. They were 100% certain a hard drive contained CP but could not get the password. I'm pretty sure he was jailed for contempt until it was given out. Definitely inside the USA.
Post reply on HN