News for hackers. Stuff that matters.
Re:I recommend against using biometric identification by driverdan on Tuesday September 12, 2017 @05:43PM (#15233120)
> And to be clear, a court in the US cannot force you to give up your passcode. That passcode exists in your head, and yours alone. It is your property, and won’t be used to incriminate you or strong-arm access to your data unless you voluntarily give it up.

While technically true this is false in practice. While they can't force you to provide your passcode they can force you to unlock your phone. Francis Rawls has been in prison for two years now over refusing to decrypt a hard drive.[1] The same principle applies to phones. If a judge finds you in contempt-of-court they can imprison you indefinitely.

1: https://arstechnica.com/tech-policy/2017/09/judge-wont-relea...

Re:I recommend against using biometric identification by bodz on Tuesday September 12, 2017 @05:51PM (#15233184)
To add more examples to this, Florida courts have also ruled that you can be imprisoned for not giving police access to your phone.[1]

The "police can't force you to give up your passcode" misconception stems from a case in Virginia from 2014 [2], and while that may still be the case in Virginia, it does not mean you can just say "my phone is locked with a passcode, fuck off cop" in every other jurisdiction.

1: https://9to5mac.com/2017/06/01/fifth-amendement-passcodes-pa...

2: https://9to5mac.com/2014/10/31/touch-id-police/

Re:I recommend against using biometric identification by dheera on Tuesday September 12, 2017 @07:52PM (#15234144)
Hmm, I guess I could just not carry a phone. Or just have it factory reset every morning automatically and not put any personal data on it. I hardly store anything on my phone anyway and use it pretty rarely so it wouldn't make much difference. What a world we live in.
Re:I recommend against using biometric identification by stephenr on Tuesday September 12, 2017 @10:21PM (#15235010)
> What a world we live in.

s/world/country/ fixed that for you.

Re:I recommend against using biometric identification by castis on Tuesday September 12, 2017 @07:21PM (#15233953)
That man may still be in prison, but that drive is still encrypted.

If you are unwilling to give something you know to someone, no amount of force can take it from you. Had that drive been encrypted using facial biometrics, they could have just knocked him out, glued his eyes open, and taken what they wanted.

What works, and what has been deemed legal, as you probably already know, are not mutually exclusive.

Re:I recommend against using biometric identification by nimchimpsky on Tuesday September 12, 2017 @08:39PM (#15234455)
Which is torture, so they could do that until he tells them the passcode aswell.
Re:I recommend against using biometric identification by castis on Tuesday September 12, 2017 @08:54PM (#15234560)
It's true that torturing a person is an effective way to change what that person wants. It doesn't always end with the torturer getting what they want, though.
Re:I recommend against using biometric identification by EGreg on Tuesday September 12, 2017 @10:14PM (#15234976)
Why do people assume that deniability results in more whacking?

Technology can easily be used to encrypt a hard drive to reveal different things for different passwords. TrueCrypt does it.

Plus you can have cryptographic keys stored with friends or beacons that signify you are safe. For example you hide files on your phone before a flight, and to unhide them you need your host's wifi at your destination.

Until the friend or beacon gives the ok, you can either have your phone LOCKED or have all sorts of files that are encrypted and HIDDEN. The computer can be unlocked but won't show those files.

Why isn't this technology widespread? YOU CANT WHACK EVERYONE!

Re:I recommend against using biometric identification by tdb7893 on Tuesday September 12, 2017 @11:06PM (#15235187)
This might not be a commonly held view but in my experience societal norms and values are the only thing really protecting us. If the police come after me and the courts don't stop them nothing will make a difference, even with the best cryptography all they would have to do is threaten my family and I would always unlock it. In my view technological protections of fundamental freedoms should only be temporary stopgaps for what essentially needs to be political solutions.
Re:I recommend against using biometric identification by StephenConnell on Wednesday September 13, 2017 @12:19AM (#15235506)
That's what we did with our TI86 calculators in the 90s. Fake memory Clear was the name of one app. Teacher looks and sees what looks like a formatted calculator, clears the calculator if they want, then you exit the app and access your notes, games, and apps.
Re:I recommend against using biometric identification by JumpCrisscross on Wednesday September 13, 2017 @02:11AM (#15235944)
> Why do people assume that deniability results in more whacking?

Contempt?

Re:I recommend against using biometric identification by solomatov on Tuesday September 12, 2017 @06:06PM (#15233331)
I think, at some point it gets to the Supreme court which will decide whether it's covered by the 5th amendment or not.
Re:I recommend against using biometric identification by 19guid on Tuesday September 12, 2017 @09:35PM (#15234765)
The answer is probably no.

Requiring a person to unlock a device is not prohibited by the Fifth Amendment simply because the device contains incriminating information that would otherwise be inaccessible to police.

If the police have a valid warrant to search your safe, you are generally required to unlock it for them, even if the safe contains evidence that incriminates you. If you are issued a valid subpoena to produce certain documents in your possession, you are generally required to produce those documents, even if they incriminate you. Compelled decryption of hard drives is fundamentally no different.

It is true that the act of unlocking the safe or producing those documents is itself testimonial in the sense that you are conveying the fact that you know the combination or possess those documents. But under the "foregone conclusion" doctrine, if the state already knows that implicit testimony, then it is not protected by the Fifth Amendment. It's obvious that Rawls knows the password to the drives.

There are legitimate concerns about how search warrants should apply to electronic devices. However, these are Fourth Amendment issues, not Fifth Amendment ones.

If you're interested, Orin Kerr from the Volokh Conspiracy has written several articles about compelled decryption, including with respect to this particular case [1, 2, 3].

1: https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

2: https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

3: https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

Re:I recommend against using biometric identification by DINKDINK on Wednesday September 13, 2017 @01:54AM (#15235888)
What checks exist to prevent police from planting a USB hard drive on an enemy of the state that's encrypted and then claiming the defendant won't decrypt the hard drive? The state would have a really easy time imprisoning him/her because the defendant would never be able to provide a key to decrypt it.
Re:I recommend against using biometric identification by PeterisP on Thursday September 14, 2017 @10:19AM (#15248258)
The check there is the judge and jury, which could be convinced by the defense that this is not their hard drive - unlike the case of Francis Rawls, where they haven't even attempted to contest that he knows the password. They haven't claimed that they are unable to perform the action, they're simply refusing to do it (and unsuccessfully contesting that they don't have to do this), so that's contempt.

It's kind of counterproductive to assume a singular agent "the state" in this context - all legal checks and balances essentially rely on multiple, separate, competing agents of the state controlling each other, separation of powers and all that. If police and all the judges are both on the same corrupt side then there's nothing stopping them from convicting you for murder of Abraham Lincoln and locking you up indefinitely for that, but we're working off of the assumption that this is not the case.

Re:I recommend against using biometric identification by hvidgaard on Wednesday September 13, 2017 @02:18AM (#15235961)
Nothing but morale prevents it, just like planting any other evidence.
Re:I recommend against using biometric identification by DINKDINK on Wednesday September 13, 2017 @02:15PM (#15241007)
I'd say though that if a judge can get a free pass to lock anyone away indefinitely by police planting a USB drive -- by claiming the defendant is in contempt of court -- that's drastically different in terms of payoff on evidence planting.

Planting a gun on a defendant is much harder to do than planting a USB drive. If it really was the defendant's, they probably have munition for it, there's biological contamination etc.

It seems to me there should be an onus on the prosecutor to prove that they defendant has the key and isn't giving it up before the defendant is held in contempt of court: "Here's a video showing the defendant access the banned booked on the USB drive, she won't give up the USB-decryption key!"

Re:I recommend against using biometric identification by RSchaeffer on Tuesday September 12, 2017 @10:39PM (#15235089)
Thanks for sharing Kerr's articles! I wasn't familiar with this issue, so I read them, and in my opinion, I think he's dead wrong (and the 3rd Circuit ruling). The argument that by disclosing his password, Doe is only admitting, "I know the password," which is a forgone conclusion, is nonsense. That statement necessarily carries with it a number of additional statements, including "Very few other people (if any) also have this password" by virtue of what a password is, and "I have read/write access to this hard drive," which when coupled with the previous statement, leads to the conclusion "I wrote the material on this hard drive to this hard drive." Kerr's argument is basically "Doe is only admitting to the premise" while ignoring that an entire chain of reasoning necessarily follows from the premise.
Re:I recommend against using biometric identification by siler on Wednesday September 13, 2017 @03:22AM (#15236206)
With a safe, as with any encrypted document, there are a finite number of keys. I think that invalidates the idea of possession of the password being important, at least from a "purely lawful" point of view.

Read/write access is basically physical access. Anyone with enough resources could accomplish physical access.

It's possible I'm being paranoid, but it seems like most of law is based on series of assumptions. It isn't a purely logical idea, which is why we have so much fun arguing about it. It is fundamentally the hope of writing down logic in a language that doesn't, unambiguously, contain it.

Re:I recommend against using biometric identification by jsjohnst on Tuesday September 12, 2017 @11:36PM (#15235321)
I think the safe analogy is an excellent way to illustrate the issue. Encrypting a file is essentially the same thing as locking it in a safe in what I believe is the ultimate "eyes of the law" once this gets fully tried.
Re:I recommend against using biometric identification by michaelmrose on Wednesday September 13, 2017 @03:57AM (#15236342)
Encryption is nothing like locking in a safe further in a similar situation I'm pretty sure rather than going to court they just open the safe making the example even more useless.
Re:I recommend against using biometric identification by PeterisP on Thursday September 14, 2017 @10:26AM (#15248322)
It's a bit like the safe exactly because there's a lot of actual existing precedent where they do not "just open the safe" but require the defendant to produce the key/code to the safe; and instead of attempting to breach the safe, hold the defendant jailed for contempt if they refuse to do so.

In this particular case the authorities are explicitly arguing that there's no good reason to use a different process for passwords as they currently use for safes, and this (requiring the defendant to unlock it) is the standard procedure, not drilling the safe open.

Re:I recommend against using biometric identification by jsjohnst on Wednesday September 13, 2017 @10:20AM (#15238506)
> Encryption is nothing like locking in a safe

Sure, to technical folks like us, but notice I said "in the eyes of the law". Furthermore, police can not open a safe without a court order, so guess your reply was a bust all around?

Re:I recommend against using biometric identification by michaelmrose on Thursday September 14, 2017 @02:00AM (#15245314)
Do you have a citation wherein encryption is treated like a safe or are you like most people kind of winging it?

I know they can't open a safe or for that matter a door without a court order. The point was that the comparison between forcing open a safe and forcing someone to produce a passphrase was meaningless because the apparently treacherous question of compulsion to testify against yourself wouldn't be tested when I drill could do the job.

I am not a lawyer but I know enough to know that most people in most discussions are full of it and know little. What actually is mysterious is why people believe that their nonexistent expertise adds to the discussion.

Imagine if the matter were technical and a bunch of non tech people, say the kind who get confused about ram and storage, referring to both as memory,or call the entire thing the cpu were volunteering different insights into the question at hand. It would be useless in a funny sort of way.

Re:I recommend against using biometric identification by blunte on Tuesday September 12, 2017 @06:21PM (#15233472)
Sucks to be in jail waiting for that process to play out, though. *edit typo!
Re:I recommend against using biometric identification by driverdan on Tuesday September 12, 2017 @07:52PM (#15234142)
It's likely Rawls' case will make it to the Supreme Court. Let's hope it's sooner rather than later.
Re:I recommend against using biometric identification by problems on Tuesday September 12, 2017 @07:59PM (#15234184)
Fuck, that is absolutely nauseating.

What's worse is that trustworthy deniable encryption - which would solve this - is practically non-existent now that TrueCrypt is gone.

Re:I recommend against using biometric identification by tedunangst on Wednesday September 13, 2017 @01:37AM (#15235822)
Eh... The prosecution claims, and the judge believes, that they have a list of files they expect to find on the drive. If he gives them a password and those files don't appear, the judge will conclude he gave them the wrong password, and he will stay put until the right password is produced.
Re:I recommend against using biometric identification by taneq on Wednesday September 13, 2017 @01:56AM (#15235900)
So you mean, if he floats, he's a witch, and they burn him, and if he sinks, he's innocent but he drowns?
Re:I recommend against using biometric identification by problems on Wednesday September 13, 2017 @02:02AM (#15235915)
That's not how this works. With deniable encryption, it is entirely possible that there doesn't even exist a hidden volume to find. They will be unable to prove he has a hidden volume and surely a judge will not compel him for not producing something he may not be able to at all.
Re:I recommend against using biometric identification by arde on Wednesday September 13, 2017 @02:25AM (#15235979)
Check out, for example, the case of Martin Armstrong, held for 7 years in contempt of court for not producing items he said he didn't have. Eventually he had to enter a plea agreement and serve an additional 5-year term.
Re:I recommend against using biometric identification by topmonk on Wednesday September 13, 2017 @03:24AM (#15236211)
Here is another project that is quite simple and works pretty well: https://github.com/dolanor/scubed
Re:I recommend against using biometric identification by jFlatz on Tuesday September 12, 2017 @08:11PM (#15234274)
You can get this from VeraCrypt (https://www.veracrypt.fr/en/Home.html)
Re:I recommend against using biometric identification by problems on Tuesday September 12, 2017 @08:17PM (#15234325)
I got the impression that VeraCrypt was not being run very well and that the developers didn't have much security experience based on the audit report that came out. I didn't consider it a trustworthy project. Has anything changed that?
Re:I recommend against using biometric identification by nugget on Tuesday September 12, 2017 @08:12PM (#15234279)
Isn't TrueCrypt 7.1a still reliable?
Re:I recommend against using biometric identification by problems on Tuesday September 12, 2017 @08:17PM (#15234321)
Yeah, it works well enough - some pain, have to deactivate it to do the major updates and such on Win10, but it does work.
Re:I recommend against using biometric identification by chirau on Tuesday September 12, 2017 @08:17PM (#15234323)
What if you just say you forgot the passcode?
Re:I recommend against using biometric identification by icelancer on Tuesday September 12, 2017 @09:20PM (#15234685)
Not necessarily clear, but Rawls did not use this defense. It should be effective but we are in unknown territory.
Re:I recommend against using biometric identification by yosito on Tuesday September 12, 2017 @09:55PM (#15234862)
What if you legitimately don't know the password?
Re:I recommend against using biometric identification by jv22222 on Wednesday September 13, 2017 @02:24AM (#15235975)
Perhaps there could be a way to instantly delete all iphone data with a voice command.

Something like "siri delete my iphone code alpha nine x."

Or even an undetectable command like "silly sausages" for example.

Might that stop a judge from being able to send you to prison indefinitely?

Re:I recommend against using biometric identification by otp124 on Wednesday September 13, 2017 @02:48AM (#15236062)
I would bet the judge would consider that destruction of evidence.

Disclaimer: I never studied law

Re:I recommend against using biometric identification by boobsbr on Wednesday September 13, 2017 @07:12AM (#15237168)
What if the authorities do not know what the self-erase command is? Like, inputting your password backwards, or adding 1 to every number.

What if it only erases a certain file or partition, so the phone still contains some personal data, but it's like TrueCrypts's plausible deniability?

Re:I recommend against using biometric identification by pcl on Tuesday September 12, 2017 @06:54PM (#15233735)
> The same principle applies to phones.

Do you have a reference for this?

Re:I recommend against using biometric identification by ge96 on Tuesday September 12, 2017 @06:54PM (#15233741)
That's F'd isn't that same as Bitcoin private keys too.

I suppose depends, criminal right thing is to help solve a crime or something I don't know.

Seems similar to using VPN in China. Is it illegal to protect/use your privacy.

Re:I recommend against using biometric identification by ajross on Tuesday September 12, 2017 @09:37PM (#15234782)
> Francis Rawls has been in prison for two years now over refusing to decrypt a hard drive.

People have got to stop martyrizing this guy. He's in jail because the prosecution got a fortuitous decision that says they can hold him as long as they want until he coughs up a password. They aren't fishing for evidence, nor have they used this trick on anyone else. If he went to trial on the evidence already in public, the guy would hang (metaphorically). There is no significant doubt in anyone's mind that this drive contains CP.

But the principle is the important part you say? Sure. Make a principled argument. Don't cite this guy.

Re:I recommend against using biometric identification by gervase on Tuesday September 12, 2017 @11:15PM (#15235219)
If it's been proven beyond a reasonable doubt that the drive contains CP, then why don't they just go to trial?

It seems to me that they've intentionally chosen a morally-objectionable individual upon which to build a legal precedent, as anyone who speaks in his defense can have his crime thrown back in their face.

We've heard a lot about these so-called "hashes" that prove the presence of CP. It's also pretty easy to make a probabilistic proof about the likelihood of a hash collision between two non-identical files. I would venture that if you can show mathematically that you're 99.9999999% certain that the files are CP, that would qualify for "beyond a reasonable doubt".

It's incontrovertible that if he's committed the crime for which he's been accused, he should be jailed. If they've already proven that crime, then why isn't he already serving his sentence? Or does the prosecution's case rest upon this one piece of evidence, and if so, is he therefore required to testify against himself in order to avoid indefinite detention?

Re:I recommend against using biometric identification by bodz on Wednesday September 13, 2017 @12:19AM (#15235503)
It's worth noting that despite the prosecutors saying "its a foregone conclusion", they have not actually even charged Reynolds with possession of child pornography. It seems to me that while their words say they already have proof, their actions say they don't have any.
Re:I recommend against using biometric identification by trendia on Tuesday September 12, 2017 @09:45PM (#15234823)
> He's in jail because the prosecution got a fortuitous decision that says they can hold him as long as they want until he coughs up a password.

You call it a fortuitous decision, I call it precedent.