Interestingly, one value that fits in that blank is "your head."

Still unsafe because I'll reveal it if they (e.g., NSA, CIA) torture me, threaten to kill my family etc.

Or a new technology is invented to read the human mind.

Or a technology already exists :)

"UC Berkeley scientists have developed a system to capture visual activity in human brains and reconstruct it as digital video clips..."

http://gizmodo.com/5843117/scientists-reconstruct-video-clip...

Like this technology?

https://www.usenix.org/conference/usenixsecurity12/technical...

That's the idea -- even your mind is not a safe place for a password.

As this story illustrates: http://www.bbc.co.uk/news/uk-25745989

+1. First, I wish to know what technology he used. Is TrueCrypt sufficient (with similarly strong password). Not because I have to hide anything, of course, just my wife wants me to encrypt our spicy photos, in case :)

Second, I am not sure I understand the judge decision. If the man truly forgot it, or lets say the files on USB got corrupted (can happen) and the password he is giving out does not work, then how can you continue to jail him (for that reason)? Is this something specific to UK, or are similar US cases out there?

Send me your photos and I'll encrypt them for you!

I think the law is very vague due to the people writing it now knowing much about it. I imagine they have a use case of this guy and want jail for anything other than seeing some incriminating evidence.

I guess it doesn't help that it turned out he did know the password and it had a load of incriminating stuff on.

What if I have just erased my USB-stick with good dose of /dev/random and haven't actually formatted it to any filesystem yet. Good encryption is indistinguishable from randomness, so could they blame me for not giving up password and jail me for carrying randomness in my pocket?

In many countries they can jail you for failure to disclose encryption keys – for example, in the UK you could spend two years in jail unless you could convince the court that there was in fact no encrypted data on that USB key:

http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingd...

If they did arrest you for that, but you aren't really Jack Bauer you could at least get points on hn for writing the story of "How I was arrested for carrying random data on my usb stick"

I think they will use that to put you away, if they don't believe you...

thumb screws is all anyone would need with me.

The threat of lengthy prison sentences is the more 'civilized' version of this.

Yeah. Safety and security seem to be fundamentally misunderstood by most people: they simply don't know what a threat analysis is, how to do one, or why it's important. If you can't answer, "From who?", then the answer is flatly, "No."

I have a hard time understanding why such a skill is so rare. It seems sort of useful.