Hacker News new | ask | show | jobs
by 6510 2294 days ago
I forget where I hear it or if it was my own idea (the shame, I know, I know!) but... cant you have an unknown number of username/password pairs that decrypt/unpack the same chunk of data into different things? Say you have the same OS 51 times, as clean installs the data shouldn't have to be all that much larger than 1. You install some games on one, some office apps on the next, put some downloaded movies on the 3rd. You could give them "all" 50 passwords and they could never find OS nr 51.
3 comments

It's not possible to encrypt 51GB of real-world data in 1GB space for the same reason that compression algorithms can't achieve 51x compression ratios. Given that, such a scheme presents some challenges if you want to maintain plausibility. Either,

1. Each filesystem lives within an allocated area and knows not to overwrite its neighbors' data.

2. Some filesystems (the real ones) are privileged and know their actual allocated area. Others (the decoys) think they own areas of the storage volume that contain hidden data and therefore have the potential to overwrite the hidden filesystems if they are written to.

In the case of (1), you need to be able to explain why your computer has unallocated areas filled with pseudorandom data. That is never going to pass the plausibility test, imo.

In the case of (2), a lot of effort needs to be put into making the decoys look normal while not letting them overwrite the hidden data. There are a number of strategies you could use here that would work, but it will never be as convenient or simple as dual-booting and the more convenient you try to make it, the less innocent a hard drive will appear under close inspection.

I think the original commenter was going for an encrypted copy-on-write setup, not some magical compressed fs. Just a base image (eg 50GB) with various encrypted delta images (1GB each) that are assigned to each user.
I wonder why this wasn't adopted and maintained?
Nice idea, now wondering how / if I could have an alternate password that would load a decoy environment while hiding all the private stuff of my main account...

Does such a thing already exists for an Ubuntu setup ?