Irish police to be given powers over passwords

Re:Irish police to be given powers over passwords by mLuby on Monday June 14, 2021 @01:01PM (#27505072)

Exactly. Biometrics are awful because

1. they can be compelled by force,

2. they can be physically collected, unbeknownst to the owner,

3. they share all the risks of digital passwords, including being leaked,

4. they can't ever be changed, even when known to be compromised by 1, 2, or 3.

Much better to have 2+ passwords for deniable secrets.

    A unlocks the device. Most people only have this one "normal" password.
    B unlocks the device plus secret b, maybe some extra kinky porn so people feel they've found your real secret.
    C unlocks the device plus secret c, your real secret, maybe Bitcoin wallets or that novel you've been working on forever.

If there's software on the device that does this, it's only evidence that 1+ secret dirs might exist. It should be impossible to tell that c exists, let alone compel its disclosure via C. But if b is quite stale, that's at least a hint that c might exist.

[ Parent | on HN ]

Re:Irish police to be given powers over passwords by drvdevd on Monday June 14, 2021 @03:52PM (#27507424)

or even better ... a kernel backdoor to expose hidden encrypted filesystems and false physical disk size reporting, with a specific userspace trigger (eg: open the password manager, when this password is selected destroy the hidden filesystem(s); when this other app is opened and the phrase "X y Z" is typed, expose the hidden filesystem as a disk to userspace).

You can go on forever with this stuff, especially if you have root on the device. Which gives you some clues about the true purpose of laws like this and who thinks they are useful.

[ Parent | on HN ]

Re:Irish police to be given powers over passwords by novok on Monday June 14, 2021 @08:55PM (#27510193)

Nobody really does that in practice although. Something that catches %99.9 is pretty good!

[ Parent | on HN ]