Comments on: Time to forget? http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/ Security Research, Computer Laboratory, University of Cambridge Mon, 12 May 2008 02:29:52 +0000 http://wordpress.org/?v=2.5.1 By: Itsasecret sorry http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-28096 Itsasecret sorry Sat, 23 Feb 2008 05:42:17 +0000 http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-28096 Maybe starting an elecrical fire in your tower would do well in this case. If your home insurance covers that, and you have the receipt for all your parts (like I do!) Mwahaha. Maybe starting an elecrical fire in your tower would do well in this case. If your home insurance covers that, and you have the receipt for all your parts (like I do!) Mwahaha.

]]> By: psme http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-28054 psme Fri, 22 Feb 2008 03:42:28 +0000 http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-28054 @RP9, I'm thinking for this dual OS setup, if the encryption software can do this: for example a 100G hdd, first 10G partition for the save OS, the rest 90G parition for the data drive of the save OS. a password on bootup will boot to the safe OS, then mount the data partition. Put some dummy files on the data partition. The 90G data partition actually contain a safe inner zone and a large (80G for example) outer private zone with the real private OS, and private data. In that setup, the user can boot the safe OS from time to time and play around. Just remember not to mess with the other large data partition. With the other password in bootup, the system will start the real private OS for protected usage. Since the whole 90G data partition is random data (besides those few dummy files when mounted), there is no way to tell if there is a hidden OS. And the user can safely play around the fake OS anytime to avoid the "long time no use" problem of the fake OS. @RP9,

I’m thinking for this dual OS setup, if the encryption software can do this:

for example a 100G hdd, first 10G partition for the save OS, the rest 90G parition for the data drive of the save OS.

a password on bootup will boot to the safe OS, then mount the data partition. Put some dummy files on the data partition.

The 90G data partition actually contain a safe inner zone and a large (80G for example) outer private zone with the real private OS, and private data.

In that setup, the user can boot the safe OS from time to time and play around. Just remember not to mess with the other large data partition.

With the other password in bootup, the system will start the real private OS for protected usage.

Since the whole 90G data partition is random data (besides those few dummy files when mounted), there is no way to tell if there is a hidden OS. And the user can safely play around the fake OS anytime to avoid the “long time no use” problem of the fake OS.

]]> By: Mr Tor http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-27742 Mr Tor Sat, 26 Jan 2008 15:27:01 +0000 http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-27742 RIPA could be challenged on human rights The government's new powers to force the handover of encryption keys could be vulnerable to a legal challenge under the Human Rights Act's guarantee to a fair trial. People who refuse keys or passwords face up to five years in jail. [snip] http://www.out-law.com/page-8826 RIPA could be challenged on human rights

The government’s new powers to force the handover of encryption keys could be vulnerable to a legal challenge under the Human Rights Act’s guarantee to a fair trial. People who refuse keys or passwords face up to five years in jail.

[snip]

http://www.out-law.com/page-8826

]]> By: Ilja http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-27591 Ilja Thu, 17 Jan 2008 00:56:55 +0000 http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-27591 @Tom Godber Re: the very fact that you have them installed indicates that you are probably using this feature The fact that I have installed truecrypt possibly indicates that I use truecrypt (if we ingore the fact that people don't use a lot of software they have installed), but not that I use a particular feature of that program. As a law-abiding citicen I have the right to protect my privacy against illegal, private spies, and for this purpose truecrypt is a good choice. Without the necessity to use its hidden volumes. @Tom Godber
Re: the very fact that you have them installed indicates that you are probably using this feature

The fact that I have installed truecrypt possibly indicates that I use truecrypt (if we ingore the fact that people don’t use a lot of software they have installed), but not that I use a particular feature of that program.

As a law-abiding citicen I have the right to protect my privacy against illegal, private spies, and for this purpose truecrypt is a good choice. Without the necessity to use its hidden volumes.

]]> By: Aleksejs http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-27399 Aleksejs Fri, 14 Dec 2007 12:59:19 +0000 http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-27399 Is TrueCrypt volume distinguishable as a TrueCrypt volume just by analyzing the file? I think not. And TrueCrypt can be used from thumb drive or any other removable media or even network share that technically is out of the country in concern. Is TrueCrypt volume distinguishable as a TrueCrypt volume just by analyzing the file? I think not. And TrueCrypt can be used from thumb drive or any other removable media or even network share that technically is out of the country in concern.

]]> By: jeremy http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-27215 jeremy Mon, 26 Nov 2007 10:41:29 +0000 http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-27215 The first s49/s51 ante-hoc RIP request is in re animal rights activists and material seized in May 2007. The BBC article below even mentions TrueCrypt http://news.bbc.co.uk/1/hi/technology/7102180.stm The first s49/s51 ante-hoc RIP request is in re animal rights activists and material seized in May 2007. The BBC article below even mentions TrueCrypt

http://news.bbc.co.uk/1/hi/technology/7102180.stm

]]> By: RP9 http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-25118 RP9 Thu, 01 Nov 2007 08:10:53 +0000 http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-25118 The problem I see with the hidden OS in DCPP in particular (as I use this product) is you cannot actually USE the fake OS or it can damage the hidden OS. So it would seem if you installed the hidden OS and never used the fake OS - timestamps would give you away. I bypassed the option after reading the very limited documentation that came with the program (and the nearly mirror image support site) because it appears to me that if you hand over your "fake" password and it is quickly discovered that nothing in the OS has been used or modified for 6 months - or 5 years - there is obviously reason to believe there is a hidden operating system involved. As I do not have anything on my computer that I would worry about the authorities per se looking at I opted against the overkill. But if someone DOES have data that they are concerned about, they should also be concerned about this obvious flaw in the “plausible deniability" claims these companies are making. The problem I see with the hidden OS in DCPP in particular (as I use this product) is you cannot actually USE the fake OS or it can damage the hidden OS. So it would seem if you installed the hidden OS and never used the fake OS - timestamps would give you away. I bypassed the option after reading the very limited documentation that came with the program (and the nearly mirror image support site) because it appears to me that if you hand over your “fake” password and it is quickly discovered that nothing in the OS has been used or modified for 6 months - or 5 years - there is obviously reason to believe there is a hidden operating system involved. As I do not have anything on my computer that I would worry about the authorities per se looking at I opted against the overkill. But if someone DOES have data that they are concerned about, they should also be concerned about this obvious flaw in the “plausible deniability” claims these companies are making.

]]> By: Pete Austin http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-24341 Pete Austin Thu, 04 Oct 2007 11:43:53 +0000 http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-24341 @Tom Godber Re: the very fact that you have them installed indicates that you are probably using this feature Anyone with a Windows PC has probably never used most of the applications installed there. The "Microsoft Office Tools" for starters. So this claim needn't be a problem. @Tom Godber
Re: the very fact that you have them installed indicates that you are probably using this feature

Anyone with a Windows PC has probably never used most of the applications installed there. The “Microsoft Office Tools” for starters. So this claim needn’t be a problem.

]]> By: Normen http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-24339 Normen Thu, 04 Oct 2007 08:51:58 +0000 http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-24339 HeyHo from germany, Its quite shocking for me to read this. I was not aware of this law until i saw it on telepolis. (german it-news-site) I strongly recommand to use Truecrypt. The it-specialists of the police are well aware of the possibility of the second hidden container, but as you said already, you are out of the line, because of the “plausible deniability feature”. Please use L2P and TOR. The more users, the more security. http://www.i2p.net/ Good luck in UK, i fear our goverment is making this come true too. As you perhaps know, the german goverment is creating a 'Bundestrojaner' and govemental software spyware, which get illegaly on your machine to spy you. HeyHo from germany,

Its quite shocking for me to read this. I was not aware of this law until i saw it on telepolis. (german it-news-site)
I strongly recommand to use Truecrypt. The it-specialists of the police are well aware of the possibility of the second hidden container, but as you said already, you are out of the line, because of the “plausible deniability feature”.
Please use L2P and TOR. The more users, the more security.
http://www.i2p.net/

Good luck in UK, i fear our goverment is making this come true too. As you perhaps know, the german goverment is creating a ‘Bundestrojaner’ and govemental software spyware, which get illegaly on your machine to spy you.

]]> By: Tom Godber http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-24337 Tom Godber Thu, 04 Oct 2007 08:06:46 +0000 http://www.lightbluetouchpaper.org/2007/09/30/time-to-forget/#comment-24337 Possibly I'm being naive, but surely FreeOTFE / TrueCrypt / DriveCrypt Plus don't actually provide any kind of plausible deniability with cunning dual password strategies, because the very fact that you have them installed indicates that you are probably using this feature. There are plenty of more common drive encryption systems which don't use this technique and you as a user would surely have to provide a very good reason why you used software that did offer the ability to have a second password but you chose not to use it, particularly on a hard drive which appeared to have a large amount of free space... Possibly I’m being naive, but surely FreeOTFE / TrueCrypt / DriveCrypt Plus don’t actually provide any kind of plausible deniability with cunning dual password strategies, because the very fact that you have them installed indicates that you are probably using this feature. There are plenty of more common drive encryption systems which don’t use this technique and you as a user would surely have to provide a very good reason why you used software that did offer the ability to have a second password but you chose not to use it, particularly on a hard drive which appeared to have a large amount of free space…

]]>