I have question to those who know more about these things: Instead of hidden volumes, wouldn't it be better to have an "under duress" password?
The hard drive is encrypted and sensitive folders are identified by the user. When a password is given all contents are decrypted.
When a "under duress" password is given the sensitive folders are permanently wiped and all the (remaining, innoculous) contents are decrypted.
This stops them from finding hidden volumes or operating systems because there are none. Wouldn't that be a better model, and much harder to figure out?
Then they restore the hard drive from the cloned image they made before entering the password and ask you once more for the password. This time, with feeling.
There might be a market for keeping your keys on some service "out there". Boot your computer, type in your password, your computer sends the password to the key service. If the password is correct they send back the key, if the password is the destruct codes they delete the key.
No amount of hard-drive cloning will stop this. Paired with some other optional measures ("we delete the password unless you send an email every week" etc) and it's almost foolproof. You might still have a hard time arguing against destruction of evidence, though. I guess if your "don't delete the keys" email was "Please delete my encryption keys" you could be completely honest and they wouldn't believe you, resulting in your keys being deleted despite your complete cooperation.
Great Idea by the way. Like Wikileaks you would have to replicate all your server in the countries that are the "freeist" or you need a very good system to hide where you are. Tor is a good exampel.
They would also tack on extra charges for interfering with a police investigation by attempting to destroy evidence, and/or the court would find you in contempt.
This is a common mistake in security -- assuming that the hacker plays by your rules.
The police would just use a copy of the program which forgets to delete when the "on duress" password is provided. I imagine it'd require commenting out all of, say, five lines and burning the modified version of YourCryptoNameHere onto a live CD.
What you want to do is to have a password that decrypts the content to something innocently looking. If the encryption program has the feature to both "dual encrypt" and do an ordinary encryption it should be hard to prove anything :) Not sure how you go about doing that algorithmically though so it would resist reverse engineering the program
Is it possible to have a third volume as well, opened with a different key? Or a fourth?
Maybe the solution is to have a first "primary" partition, then an "under duress" partition which you'll fight tooth and nail to protect, filing every appeal possible... and if you finally do give up the key, it's filled with entirely legal but extremely embarrassing pornography, plus a few self-written Harry Potter fanfictions.
Meanwhile, whatever you're ACTUALLY trying to hide is on a third.
Sure, it's a big damn hassle, but if you're conscious enough about the stuff you're trying to hide to go with a TrueCrypt hidden volume, it'll be worth your effort.
(I'm not actually sure this is possible, but if it is, I'm sure someone else has come up with it already.)
I've been wondering about this every time someone brings this up. So you use Truecrypt to secure your disk, and have say a "naughty" partition and two "clean" ones, for plausible deniability.
Won't the police in the event they have compelled you to unlock your HDD check how big the partition is? If you have a 500GB disk divided by three say with the 20GB "naughty" partition, a 20GB "double-decoy" and a 460GB "decoy" partition won't the police pull the disk out, look at the label on it which says "Seagate 500GB" and say "You have 20GB left on this disk we haven't seen yet. Unlock it."?
Or is there a way in which trucrypt can hide your hidden partitions in a way that a) they don't look like randomized/encrypted data and b) it isn't obvious there is space "missing" from your disk.
That's the beauty of full-disk encryption. Even the empty space is encrypted. So the hidden volume is truly hidden. Even TrueCrypt has no idea the hidden volume exists if you unlock the outer volume with a different key.
Truly empty-space is indistinguishable from a secret inner volume.
Why can't I write a program that tries to expand itself to use any available space, then runs in to a wall if the "empty space" is actually encrypted data? If the space used by data + my program adds up to less than the total capacity of the disk, it indicates something is hiding right?
You seem to be misunderstanding. Read your parent's last line again. "Empty space" is indistinguishable from encrypted data. On the hard disk, everything will just look like randomized bits, empty space and data alike. There is no way to write the program you propose without the encryption key(s). So there's no way to tell, unless you have all the keys.
The program will just overwrite the data of the hidden volume. That's why it's important to have a lot of empty ("empty") space on the primary volume when you have a hidden volume there.
AIUI, Truecrypt is actually very clever about this. Until decrypted, every TrueCrypt partition consists of nothing more than random data. This, combined with the fact that hidden volumes are actually stored within your first / outer partition it should make it impossible to analyze whether other volumes / partitions exist.
What you really need is a hard disk encrypted with many different partitions, e.g. one for programming projects, one for web browsing, one for email and correspondance, one of movies, one for porn, etc. This should be done using encryption software that allows for 100s of partitions, so it would be a lot harder for the police to argue that you're hiding some partitions.
The software should also, when if formats the disk, leave a random area of c.5% of it free, so the police can't count up trhe size of all your partitions and figure out you're hiding something.
From what I gathered Truecrypt provides plausible deniability through hidden volumes that appear to be random data. AFAIK it doesn't allow you to have a partition that when you decrypt with a certain password transforms to alternate content. So if the feds know you have something encrypted you might be in trouble.
well, it lets you have a fully functional alternate system (both systems are encrypted) that will show up if the correct password is used, with no direct forensic way to prove it exists at all, by design. There indirect ways, outlined intheir faqs quite well, that could beused to suggest you have multiple instqnces, like multiple windows updates for thesame updates from th same system, that kinda thing..... but with enough diligence you could pull it off.
there are also some write restrictions iirc - may enim wrong but i think if you write to the alternate system you cansquash data inadvertently from the primary as thesecondary can have no knowledge of thereal system in any way, makingn this unavoidable.
pulling this off would require a level of diligence most people justdonthave, andthere are easierways to hide your data.
But if you've done it right, they can't prove it. In US law, you can't convict someone criminally because you suspect they're withholding information, you have to be able to prove it beyond reasonable doubt.
I've actually been in court for this kind of stuff. (Not as a defendant.) What actually happens is the prosecutor tells the court that they have X, Y, and Z evidence, which indicates the existence of W evidence, even though they can't actually get hold of W evidence. Then they don't charge you for W evidence directly, they just run the charges up for X, Y, and Z until you agree to a plea bargain anyway.
Your ability to defend against tactics like this is 100% dependent on the size of your bank account, which, by the way, may also be compromised if the prosecutors can convince the right people that you made any money at all on your illegal activities.
This is why I am mostly blasé about things like TrueCrypt's capabilities or this particular part of the law or what-have-you. If you're doing something illegal involving a computer, you're already screwed anyway -- unless you're independently wealthy and have some serious connections.
> What actually happens is the prosecutor tells the court that they have X, Y, and Z evidence, which indicates the existence of W evidence, even though they can't actually get hold of W evidence. Then they don't charge you for W evidence directly, they just run the charges up for X, Y, and Z until you agree to a plea bargain anyway.
Uh, yeah, so what?
If they have the evidence to prove you committed a crime, then they have the evidence to prove you committed a crime. It kind of makes sense that they'd, y'know, prosecute you for that crime.
They can't just arbitrarily increase your sentence based on the suspicion of another crime. There are statutory limits for the crimes they can prove, augmented by sentencing guidelines. The court cannot exceed the statutory limits, and deviations from the sentencing guidelines require a justification to be articulated. "I think you also did W" is not a valid justification.
You're always at risk of a harsh sentence for whatever crimes can be proven. If you're not prepared to take that risk, you should probably avoid committing the crimes in the first place, no?
> If you're not prepared to take that risk, you should probably avoid committing the crimes in the first place, no?
That presumes you have the capacity to know what is and what is not legal. In the US, no human being is capable of that. On top of thousands and thousands of federal statutes, you also have state, county, and local statutes to worry about.
If the prosecutor comes up empty and you piss him off by playing games, guess what? He'll go on a fishing expedition and he will find something because, quite simply, it's impossible to run a business for any period of time without breaking some regulation or statute somewhere out there.
There's a reason 90% of criminal cases end in plea bargain. It's not because the people pleading are guilty nor because they are dumb.
Look. Don't do things to piss off cops or prosecutors. Be cordial, be kind, be helpful. They deal with assholes all day, it's easy to forget the nice guy. Also, hire a lawyer who used to be a prosecutor and who is on very good terms with the prosecutor and the local judges. The evidence isn't going to matter. There's a 90% chance you won't even get to trial. Focus on ending things cordially and quickly.
If someone has evidence on their encrypted drive that could put them away for life or a large portion thereof, or even trigger a capital case, the fine or few years of time behind bars for whatever piddly-ass crap the prosecutor can dig up is not going to be their primary concern. Worse for the prosecutor, if they go to extreme lengths to find something to charge you with, they risk pissing off the judge and/or appellate system with their vindictiveness.
You're always going to have to make a judgement as to whether you're better off cutting a deal or refusing to cooperate, but that does absolutely nothing to change the fact that a hidden volume may save your life.
I was thinking along the same lines, but instead of wiping the file, it changes the password to a randomized 20 character string.
If you're doing anything that risks getting pinched, it's probably better to take the obstruction rap than whatever it is you're being investigated for.
It would still be possible to copy the hard drive at a lower level before password entry. You could then compare before and after password entry and see that large chunks of data have been modified.
Doesn't have to be large chunks, just one block that stored the encryption key for the other partition. All you have to do is scrub the key from the drive and it's effectively erased.
The hard drive is encrypted and sensitive folders are identified by the user. When a password is given all contents are decrypted.
When a "under duress" password is given the sensitive folders are permanently wiped and all the (remaining, innoculous) contents are decrypted.
This stops them from finding hidden volumes or operating systems because there are none. Wouldn't that be a better model, and much harder to figure out?