Comment by jrockway | Hacker News Reader

Comment by jrockway | Hacker News Reader

This is why I travel with a netbook that has full-disk encryption. If the government wants my laptop, they can have it for as long as they want. $300, whatever. If they want to compel disclosure of the passphrase, though, that's not as easy. Then judges and the Constitution get involved.

What I've learned from reading cases (and watching Law & Order, heh) is that if the police have evidence against you, it's easier for them to get what they want from the courts. "We already saw the child porn, we just want to check for more."

If all they have is a disk they can't read, it's going to be hard to get any judge to compel you to produce the key, especially if they can't prove you have the key. (And, in the US anyway, there is some precedent that you can't be compelled to produce the key anyway.)

The government wants more power, but the people have the power to take it away. It's just a checkbox away in your favorite OS's installer. (Well, in Debian anyway.)

With talk of 20 year prison sentences for ordering manga from Japan or talking to people on Myspace, I think it's pretty insane to not encrypt your disks. Who knows what someone else will think is illegal? I would rather not find out.

This works up until the point where it's decided that refusal to disclose your password, while not a criminal offense in any way, is grounds to prevent you from boarding your flight.

Customs is after you arrive, so whatever.

If I'm ever in this situation, I fully expect to be arrested (and released 23 hours later with no charges filed), though.

(Expect the worst and you won't be surprised.)

Customs is not after you arrive in all cases (Canada and the Caribbean have "pre-inspection" centers at most airports).

You should create your true root disk at a few levels down. If forced to reveal your password, then provide them only with the first level - maybe have it load windows 95.

I'm not that paranoid. The worst the government can do is hold me in contempt of court.

Actually I think the worst thing they can do to you involves detainment without trial and something to do with water+boards.

You read too many tabloids.

Do you use http://www.truecrypt.org/ ?

No, dm_mapper/LUKS.

But actually, I do have a Windows 7 machine, and am TrueCrypt-ing that right now. (I had forgotten about that until you mentioned it, and BitLocker is $200 I don't want to pay.)

So far, seems pretty nice. You can never be 100% sure about encryption software, but since I haven't read about the government breaking any crypto implementations and sending anyone to prison, it is probably Good Enough.

I don't worry too much because I don't think I am doing anything illegal. But it's still nice to avoid people rummaging through your stuff.

Make sure you use an adequate password with that encryption. It amazes me how many people use, say, an 8-10 character password with just lower case (and maybe numbers).

:)

Good full-disk encryption systems use key strengthening, making even short passphrases reasonably secure. Testing one passphrase on my machine, for example, takes about 1 second of CPU time. 26^8 seconds is a long time (6,000 years).

The other alternative is to brute-force the entire keyspace, which puts you back in 2^128 (or 2^512) territory but with the option of trying billions of keys a second. A few Universe lifetimes, and my .emacs will be all yours.

Oh, but I use a long password anyway. The key, IMO, is to avoid using a password you have ever used for anything else. You might not have to testify against yourself, but your employer or mail provider will be happy to cough up your password for the authorities. So don't give it to them.

Well there are 2 advantages that lets you reduce that time dramatically.

First you can use a dictionary - then munch it (with Jack or something) to create a large dictionary within the keyspace. It's surprising how much that covers.

Then you can parallel the process; I know a few commercial companies (ourselves included) with a large computer capacity for these purposes. I'd be surprised if the govt. didn't have some form of similar access.

If you can reduce the search space by a factor of 1,000 and run your cracker on 1,000 machines it makes a dramatic difference.

OK, let's assume you can try 1 billion (10^9) keys per second. Now add numbers to your keyspace (remember, no special characters or capital letters yet!), and make your password 12 characters instead of 8. Not much harder for you.

But now it takes 150 years to brute-force the keyspace.

I doubt anyone is going to devote 150 years of computer time to someone going through customs.

No clearly not. Which is why I said "you'd be surprised how many people use an 8 to 10 char password sometimes with numbers". :-)

A few Universe lifetimes, and my .emacs will be all yours.

Got it: http://github.com/jrockway/dotfiles/blob/master/emacs

Your password strengthening won't help.

The forensics guys will clone your drive, then feed huge fuzzed dictionary attacks using the same algorithm until they find something that works, and they'll do it with machines a lot faster than your laptop.

They don't have to brute-force the keyspace. They only have to brute-force your password-space.

I doubt this. Do you have a link to a paper covering this technique, or a conviction that used this technique?

Well you have information about the person including his name, perhaps hobbies, passwords from Google, Yahoo or other sites, which will provide them if they are fed some "terrorist threat, brown alert" mumbo-jumbo. In rest NSA and Choicepoint and help you on that front.

Then you just start building a customized keyspace from that information. Include some common substitutions: letters for numbers, numbers for letters. If you have other passwords, look for general patterns. Some people use long passphrases, but they have a pattern or algorithm on how they build all their passphrases! There you just might need a human expert to take a look.

In the end, yes, it is very difficult but it is still a lot better than plain brute-force.

But yeah, I doubt Customs have the equipment or knowledge to do this. That is something that NSA would do. They would have access to the best tools. I can imagine there might be some kind of very constrained cooperation between them. "You send us a disk clone + personal info of the owner, and we'll try to send you back the cracked passphrase. You don't ask as questions how we got it, and you don't even mention that we got involved at all."

You have seen this I assume? http://xkcd.com/538/

The law on this matter is, as I understand it-IANAL, that a password is a product of the mind and so it would be a violation of your fifth amendment rights to compel you to give up the password, as it would be "testimony against yourself." A password written on a piece of paper or a physical key would be a different matter. This doesn't mean they can't confiscate your laptop and/or image the hard drive to try and crack your encryption later though, it just means if you have encrypted files you can't be penalized for failing to disclose the password (probably).

This lecture from Defcon 17 may be relevant: https://media.defcon.org/dc-17/audio/DEFCON%2017%20Hacking%2...

Reply on news.ycombinator.com