Hacker News Reader

Comment by drivebyacct2 | Hacker News Reader

"the hidden volumes will still stick out like a sore thumb and clearly be encrypted data"

I thought that was the entire point of the hidden volume... that from outside you can't tell there is a hidden volume? And that from inside the fail-safe, you still can't tell there's a hidden volume? I may simply be mistaken.

---

Uh, I think you're missing the point of how the plausible deinability works. The point is that under duress you can acknowledge that it's a TrueCrypt volume, and open it up without at all exposing the hidden volume inside. It's like having a treasure chest with a false bottom where you store your good. The fact that it can't differentiate the location of hidden volumes is... paramount.

A "hidden volume" does not mean a truecrypt volume disguised to look like a normal windows file which is what this program looks for...

View on HN

You're right in a way - TrueCrypt fills empty space in its volumes with random data, and hidden volumes fill that space, and will appear random as well (being encrypted).

The question is whether, upon finding a volume which is vastly oversized compared to the non-hidden data, you believe that there are no hidden volumes. If your hidden volume is small relative to your normally-encrypted volume, your believable deniability is much better. But if the important stuff is all on the hidden volume...

I misunderstood. I see your point now, but I still see good alternatives. Use an external hard drive, easy excuse for having a large encrypted drive. Tell them you just started using it, or made it big and then never decided to use it again, etc.

Of course having an external hard drive works... as long as you're confident enough to lie well.

Hopefully you paid cash, otherwise, they'll know when you bought it. That means no NewEgg. Damn.

Then, you just need to be comfortable saying that you bought a 1TB hard drive, encrypted the whole thing (despite the obvious speed hit it'll take, which you know if you're smart enough to use TC), just to throw a few gigs of porn on it. Hopefully you have a wife or significant other, since no single guy is going to encrypt his porn. Not sure how women treat their porn stashes; it just has to be believable. Also, make sure you don't load the porn on all at once - that'll be very, very suspicious. It'll have to look like an organically-grown stash.

Given all that, if you can lie well, you might be able to convince an investigator that you (as a suspect in something) have an innocent hard drive on your hands. And you should practice, because if the cops aren't convinced and can't force you to hand over the password (due to plausible deniability), you'll probably need to convince a jury.

The oversized volume argument seems a bit silly. Does that mean owning a 1TB hard drive is suspicious if you're only using 50GB worth of space?

No, but that's not the scenario we're talking about.

If you a) have an encrypted chunk of data that's 1TB, b) when subpoenaed, hand over only 50GB worth of data, and c) are using a tool that is known of it's ability to offer "hidden volumes" to supply plausible deniability, you can be damn sure that a judge is going to find that suspicious.

The more relevant question is: is it suspicious enough to permit the judge to issue a contempt citation? Well, that's a question for the lawyers, but I'd sure as hell hate to be the test case.

I haven't used TC in a long time but don't you determine the size of the volume/container when you create it, not when you put data into it? That would mean it's entirely believable that you created a larger (1TB) volume with future use in mind but have yet only had a need for a part (50GB) of it.

This is correct, the container won't expand in size. You have to specify the size at time of creation.

Of course that's the scenario we're talking about. Having a big volume is about as relevant as a big hard drive. Would you buy a 250GB drive when the 1TB version is the same price (or less)? Of course not. Bigger is better. So why would you create a small encrypted volume when you have boatloads of diskspace to spare?

And no, that's not how contempt works. IANAL but Wikipedia says this: To prove contempt, the prosecutor or complainant must prove the four elements of contempt: Existence of a lawful order The contemnor's knowledge of the order The contemnor's ability to comply The contemnor's failure to comply

There's no way to prove your ability to comply with decrypting a hidden volume for as long as it remains hidden.

There was a post on Reddit about this a few days ago.

http://forums.truecrypt.org/viewtopic.php?t=23969 Comments: http://www.reddit.com/r/reddit.com/comments/i8dqh/true_crypt...

Reply on news.ycombinator.com