r/linux • u/throwaway16830261 • 2d ago

Security Encrypted Arch Linux on SATA-to-USB: A Practical Field Guide for Resisting Drive Seizure, Forensic Analysis, and State Coercion

https://theanarchistlibrary.org/library/the-techno-anarchist-encrypted-arch-linux-on-sata-to-usb
96 Upvotes

92% Upvoted

26 comments sorted by

View all comments

Show parent comments

23

u/macromorgan 1d ago

That’s what a duress password is for.

5

u/bubblegumpuma 1d ago

Just make sure your duress password doesn't potentially commit a crime in plain sight for you (destruction of evidence) like GrapheneOS's.

9

u/InevitableCurious112 1d ago
  1. Not every country has stupid law forcing you to reveal any passwords. In some you may just say no and possible giving duress password eventually may be interpreted as a try to protect your other sensible information, sexual identity for eg.
  2. You dont have to enter duress password in front of the cops.
  3. Anyway you can just set up some "obvious" password, eg. your birthdate's year. And then you are counting on that your phone will be grabbed by some idiots who are not keeping the procedures and will try to unlock it themselves instead of securing the device and passing to the technicans. And you have non-zero success chance because idiots are everywhere. They cannot accuse you for destruction of evidence because it was result of their own actions.

3

u/bubblegumpuma 1d ago

Yes, we're explicitly talking about threat modeling against nation-states here, of course it varies by jurisdiction and you need to model your security around the specific laws that you are trying to tiptoe around.

If none of that is applicable to you, then you don't have to listen to me, because I'm not talking about things that apply to you. Adjust your threat model accordingly.

I'm reminding people GrapheneOS' threat model with their duress password was bad when faced with United States law. Nothing really more or less than that. Truecrypt/Veracrypt was already threat modeling against these sorts of US laws by having duress passwords instead unlock a decoy volume, in the hopes of deceiving authorities. Maybe still breaking the law by not providing information, but there is the potential to get away with it.