New Zealand travellers refusing digital search now face $5k Customs fine

Re:New Zealand travellers refusing digital search now face $... by gruez on Monday October 01, 2018 @11:18AM (#18113394)

>It's impossible for any court forensic team, let alone an airport goon, to prove there is actually another partition inside the outer encrypted partition

booting into a 50 GB partition on a 512GB SSD isn't suspicious?

[ Parent | on HN ]

Re:New Zealand travellers refusing digital search now face $... by tomp on Monday October 01, 2018 @11:26AM (#18113481)

Nah both partitions are 500GB... it's just that you avoid writing (or filling up) the "outer" partition so the "inner" partition is never overwritten.

[ Parent | on HN ]

Re:New Zealand travellers refusing digital search now face $... by gruez on Monday October 01, 2018 @11:35AM (#18113610)

how do you ensure this? afaik ext4 scatters its allocations across the partition, so it's only a matter of time before an allocation for a syslog entry wipes your .ssh/id_rsa

[ Parent | on HN ]

Re:New Zealand travellers refusing digital search now face $... by yholio on Monday October 01, 2018 @11:58AM (#18113888)

Colocating both roots on the same partition spells disaster, you will absolutely clobber data when the outer system boots. I have detailed in another post that the correct way is to put the sensitive root inside a largely empty decoy data partition, and no longer write there (but you can update timestamps in place).

Needless to say, using these schemes for SSD drives requires special consideration in regard to trimming.

[ Parent | on HN ]

Re:New Zealand travellers refusing digital search now face $... by megous on Monday October 01, 2018 @11:28AM (#18113533)

Until you run fstrim?

[ Parent | on HN ]

Re:New Zealand travellers refusing digital search now face $... by swarnie_ on Monday October 01, 2018 @11:24AM (#18113454)

Find me a member of the TSA who can explain the significance of that sentence let alone catch it in practice then we can discus the viability of it.

It seems to me this would fix the larger problem most the time.

[ Parent | on HN ]

Re:New Zealand travellers refusing digital search now face $... by gruez on Monday October 01, 2018 @11:51AM (#18113814)

as someone else mentioned, the only reason it works now is that very few people does this. if this starts getting popular, i guarentee that TSA is going to check for hidden partitions, patched kernels, suspiciously clean OS, etc.

[ Parent | on HN ]

Re:New Zealand travellers refusing digital search now face $... by hfdgiutdryg on Monday October 01, 2018 @02:50PM (#18115644)

i guarentee that TSA is going to check for hidden partitions, patched kernels, suspiciously clean OS, etc.

How would they hire enough manpower smart enough to do that?

[ Parent | on HN ]

Re:New Zealand travellers refusing digital search now face $... by bigiain on Monday October 01, 2018 @10:18PM (#18118346)

They'll just buy an eyewateringly expensive tool from Cellebrite (or their ilk), then let the minimum wage goons loose with it...

"Hey Hank, the machine says we've got another hidden encrypted partition, go get the rubber hose..."

[ Parent | on HN ]

Re:New Zealand travellers refusing digital search now face $... by Tuna-Fish on Monday October 01, 2018 @11:38AM (#18113644)

The outer partition fills the entire SSD. It just happens to use a filesystem that packs its data from the beginning of the partition. So long as you don't ever use more than 50GB at a time, the inner partition is safe.

[ Parent | on HN ]

Re:New Zealand travellers refusing digital search now face $... by megous on Monday October 01, 2018 @11:27AM (#18113498)

You can patch the kernel to report the full size, I guess.

[ Parent | on HN ]