Hacker News Reader

Comment by frossie | Hacker News Reader

Personally, I enjoyed most this comment from the bottom of that article:

So let's get this straight; you don't trust your wife, you think your daughter will grow up to be a nut job, and you're worried that your close friends will turn against you. Man, I'd just hand it all over now. It sounds like you have nothing to live for anyway.

Maybe this should be a unit test for whether you are ready to marry somebody. If you can't bring yourself to trust them with your password - and trust them not to use it - you have commitment issues. :-)

View on HN

I think it's less that he doesn't trust his wife, and more that, as TFA says, "many countries's laws make it difficult or impossible for a court to order you to turn over your keys; once the passphrase is known by a third party, its security from legal attack is greatly undermined, as the law generally protects your knowledge of someone else's keys to a lesser extent than it protects your own."

I am pretty sure most law systems would not consider the wife a third party in this context (eg. see the US spousal privilege).

[By wife I mean legal spouse in general of course]

It doesn't protect her from people with a '$5 wrench' that want to get the password from her. This is assuming that 'they' figure that getting the password from her is easier/better than getting it from you.

Hired goon: "Excuse me, madame, but if you would be willing to divulge to me your husband's password, I will gladly give you this shiny new $5 wrench!"

(With apologies to "how to determine the height of a building using a barometer"...)

He might have better luck with a bar of chocolate, also it's even cheaper:

http://news.bbc.co.uk/2/hi/technology/3639679.stm

Like many security measures, he does not have a technological problem, he has a social problem. Namely, he is the lynchpin of his own security and he is very bad at estimating risks.

It is an absolute certainty that he will eventually die and his data will eventually become totally unavailable.

It would take an extraordinarily speculative sequence of events for him to run afoul of the British authorities who would then, being naturally covetous of the secrets of minor authors, abandon their tradition of spousal privilege and sue his wife for the contents.

Realistically I think he has a problem greater than either of these: assuming every bit of his data passes to his heirs as planned... then what? Does it have a comprehensible filing system? Does it have a document saying "Hi honey, if you're reading this I'm gone, the documents you need today are in ..."? And, the biggest question, is the data in there meaningful to anyone but him at all?

I'd go even further than that. I trust my wife with all of my passwords and as far as I'm concerned she can go ahead and use any of them at any time for anything she wants. It's really not a big deal. I married her, for heaven's sake. What kind of secrets do you keep from your own wife? Sounds like a Hollywood marriage.

I've heard anecdotally that the majority of people with assets (not necessarily a huge amount) hide assets from their spouses. That can be cash/stocks, but very often it's property or even companies.

You must of talked to a lot of people ;-)

... must have talked to

The anecdotes come from bank tellers. They 'talk' to a lot of people.

Things to consider:

* If he has certain things that he doesn't want his wife to see he should encrypt them separately and not give her access, even in the event of his death since they are probably things he still wouldn't want her to see (secret sicko porn collection or sex chat logs or something)

* Don't be so quick to dismiss him has having a 'Hollywood marriage.' There are plenty of marriages that start out fine and with both partners completely trusting one another that eventually fail. Preventing some finiance information (or whatever) from being viewed by your wife could be a good thing (for you) in case she makes up her mind to divorce you; but decides to peek at your finances before actually telling you about it. [Before you start talking about trusting your wife, realize that people can (and do) change and not always for the better]

* If someone in government really wanted his laptop then jurisdictions -- even foreign ones -- wouldn't matter because they wouldn't necessarily be using the court system.

* Using something like TrueCrypt with a hidden partition could work for him so that he could keep some stuff from his wife/others while leaving the most innocuous stuff behind a password that she knows. [ That said, sometimes even the innocuous stuff can be used against you -- i.e. in court ]

Your spouse is still a human being, so you can really only trust them to the extent that you can trust the most trustworthy human beings. Of course, there should be unparalleled trust between spouses, but there are still times when a password should be secret. Passwords to resources regarding one spouse's employment shouldn't be shared with the other: if not for the trust issue than simply for preventing liability. Also, while I might trust my spouse not to deliberately abuse any password-protected resources of mine, I might not trust the security-awareness of my spouse, e.g. carelessly saving passwords in browsers on public or shared machines or simply underestimating the importance of password secrecy.

Passwords to resources regarding one spouse's employment shouldn't be shared with the other

I totally agree with this: however passwords/passphrases related to my employment are not something I worry about in case of my untimely death - they are known (or can be reset) by my employer.

True, that example drifted off topic, but I was responding to the notion that there should be NO secrets between spouses. I suppose there's a difference between a secret and simple nondisclosure. Your spouse should probably know that there's something you simply can't or don't need to tell them because of security reasons.

It doesn't have to be about distrusting a person as much as distrusting that the person is security aware. E.g., most non-technical people I know have no problem with logging into their Gmail from internet cafes. You may be 100% that your wife would never screw intentionally you over and yet not so eager to share your passwords with her for that reason. Sure, you can teach her not to login from random computers, and then the difference between http:// and https:// and what it means when the browser says that the certificate cannot be verified, but it can turn out to be a quite large project.

I pity your surprise-birthday-party-less wife.

He's Cory Doctorow -- the Mary Sue characters in his fiction have massively over-inflated egos, are mostly worthless to others, are extremely paranoid and delusional, and tend to dick over everyone close to them.

In one of his short stories he has his wife and child die (who were somewhat fleshed out), and doesn't seem to care a bit.

I was thinking about this as I read the article - having even just a portion of Doctorow's literary output be write-only is a feature, not a bug.

I also liked his "liberation" speech. "I never have to worry about being mugged for my laptop". Actually, they're just as likely to mug you. They just won't get your data. Even then, all they have to do is beat you over the head with a hammer until you give them the password... and even then, all they have to do is put in a LiveCD to format your hard drive and they have a new computer. Not so liberating...

Your entire comment is predicated on him being concerned about losing the laptop. Clearly he isn't. Clearly he's only concerned about losing the data. After all, a laptop can be replaced.

With that point of view your comment becomes rather less relevant.

Doctorow is a professional writer. Is it too much to expect he write what he actually means?

To be honest, who mugs people for their data!?!

"Your bytes or your life!" just doesn't have the same ring to it.

I wouldn't suppose people would mug him for his data. But having got the laptop, the data may very well be trawled through for email addresses to spam, credit card numbers to defraud, salacious photographs for blackmail, etc. Someone who mugs you is extremely likely to pass the laptop to a fence, who will then make the most of it.

Yes, the data will get wiped and the laptop sold, but the data will also be mined to see if it's of value. I assume the author doesn't want someone going through their underwear draw.

In the UK computers must be recycled, but recycling companies are required by law to shred hard drives. It was extremely difficult to get them to save the magnets for a youth project robot building exercise.

The entire time I was reading this article I was wondering just what kind of data Cory Doctorow could have that is so important as to require this kind of thought be put into its encryption. Does he have access to some sort of nuclear secrets? It seems to me as though he's crossed the line between 'practical' and 'unnecessarily paranoid'.

Stable governments ruling over free societies are a relatively new invention. How long do you think it will be until you are at odds with your government? This seems like his main concern. For others, corporate espionage should be a significant concern.

(To the compilers of various watch lists: Peaceful odds. Peaceful.)

I'm envisioning a 22nd century Geraldo moment..."now, using this self-aware quantum computer we can finally, after many years, see inside the encrypted hard disks of Cory Doctorow, a mystery ever since a meteor fell on his lawyer's office during the reading of the will and destroyed the keys to his encrypted data!

We're loading the files...it's a huge PDF! That was a popular 21st century file format, folks...let's read...hmmm....well, obviously this isn't as exciting as we had been led to believe...er...well, back to the studio!"

mandatory ref to support your assertion:

http://xkcd.com/538/

To handle this you could have a duress code that you could hand out that would make the system appear to be decrypted but only show the files you want shown when the duress code is used. That's the way most situations like this are handled. Now if they already know you have the data, then this won't work. If it was super-secure information (national security), you could give them another duress code that deleted ALL data, rendering you and the laptop useless. They might kill you for that though.

Reply on news.ycombinator.com