[johnnyApplePRNG]

>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries;

This would evade 99% of them.

Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things".

I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example.

They took everything. They found everything. Everything except for the $1,000 piece of drug paraphernalia I had sitting right out in open view in the middle of the apartment... the Volcano vaporizer.

It didn't look like anything they had seen before so they didn't think anything of it.

Same would be true with this USB drive in 99% of border crossing privacy invasions... plug in USB, ask for password, read it/copy it/whatever... they're not taking it apart and performing open heart surgery on a $5 USB drive at the border.

They might throw it out... or keep it or something... sure... but in general... this is a hell of a lot better than a regular USB drive imho.

[tptacek]

This is self-soothing, not a real security plan. It doesn't matter how competent a security agency is, because there's a whole ecosystem of vendors selling into that space; knowledge of how to attack encrypted disks like this is outsourced, and, importantly, those firms have incentives to mop up even random stuff like this, because vendors will be selected in part based on lists of how many different circumvention and privacy tools they can detect.

[broken-kebab]

You are right in a laboratory way of let's-assume-perfect-adversary, and you're not in a how-it-really-works way. I simply have my own RL exp in a bad repressive country on this topic, and my claim that e.g. hidden volume works most of the time. Like any tech it will stop being useful eventually, but it has been saving people for quite some time.

Why is that is a long story. And it includes both general inefficiency of state apparatus, but also the fact that repressive systems aren't optimized for getting evidence (or just correct information) in most cases.

[LorenPechtel]

This isn't stand-up-to-state-actors security. This is keep-state-actors-from-noticing security. They know you're guilty, they'll get it. The XKCD version of password cracking works no matter how secure your hardware.

But while states realistically can crack most anything it doesn't mean they can crack *every*thing. There are simply too many flash drives crossing the border every day.

But there is a big flaw I see: 8gb. You're carting around an 8gb flash drive these days??

[tptacek]

We're talking about exactly the same threat. What I'm pointing out is that state adversaries won't have to "notice" this; all they'll have to do is plug the device into a standard commercial forensics scanner product --- and we're stipulating that they're plugging the device in already (else what does it matter what bits are on it).

They pay other people to notice this stuff for them!

[whizzter]

I think part of the entire design is that it's quite hard to detect.

1: Reads/Writes are just routed to a COTS SD-card. 2: Unless the (correct?) password is detected in the write-data that starts the disconnect procedure.

The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, only works if the CPU cost is large enough to overtake the SD-card measurably and some constant-time optimizations should make it more or less undetectable.

It's a clever design and I think it should be possible to optimize to become more or less unrecognizable.

[05]

> The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay,

- Have the first check be a simple 8bit hash that filters out most passwords in microseconds, or use a customizable prefix instead of “password:”.

- have your password checking thread run in background at idle priority

- when you get an async password match, force usb disconnect and reconnect and the system will rescan the bus and mount your real drive.

Short of adversary dumping drive firmware (or them figuring out your hn account t, having a LLM scan the messages and finding this conversation) it’s not really easily detectable..

[ralferoo]

It's even easier to detect from that. From the project writeup Q&As: 'The firmware snoops for the string "password:xyz" and inhibits the write of "xyz". Otherwise, yes this would be very insecure.'

So detecting this drive is just a matter of writing "password:anything" to the drive, unmounting, remounting and checking the file you just wrote. If it's not what you wrote, then you have detected the existence of this drive.

The parent comment was correct that if this was mitigated by testing if the key is valid then you can detect it by checking for timing differences between writing a sector that starts "password:" and one that doesn't. Moving the password check async just means that you run the risk of having the real password written to the SD card before it was detected.

If you buffer that sector from being written, then you might be able to detect it because the write was faster than expected, or if you write the modified version and go back and overwrite it with the original if the check fails, then you will slow down a different subsequent access, again which would be detectable. This would also invalidate one of the design goals of never keeping the password in memory, only the derived key.

Having a customizable prefix is possible, as the project is open source. Personally, I'd be tempted to make this possible on the base build by storing the prefix in the hidden area of the SD card.

[femto]

If I was building a black box to detect hidden data on a USB stick, I'd include a feature whereby it measures power consumption and flags USB drives that don't consume the expected power for that type of drive.

[kulahan]

What an unreasonably complex device to imply you’re going to make 50,000 copies of and ship out to every border agent in the nation after telling them every SINGLE flash drive crossing the border MUST be scanned. That’s so much wasted time, energy, and money. Are you building a similar device for SD cards? HDDs? SSDs? External drives? You’re going to build a database of exact charge draws for every device in existence which happens to have some form of storage on it?

Fucking up every single import and traveler on the off-chance one in seven billion scans detects one of these devices and, further, carries some data the US cares enough about to chase down to this degree?

No. Nope. Nuh uh. Insanely unreasonable. You will get ONE at a station, which you only bother to use if you can convince your $12/hr employee to even give a shit. Literally an insane proposition.

[LorenPechtel]

Power use is not deterministic unless it's in a known state. The power hungry circuit is the erase and that's mostly a background thing.

[marysol5]

laughs in that flash drive I have that just gets hot instead of working

[tptacek]

Can you flesh that out? If I've missed something and oversimplified the design here, I'd want to clarify that!

[whizzter]

The encryption/hiding is done by the firmware, hence..

1: The drive more or less looks like any boring old usb-stick, it isn't even uncommon for cheap fake Amazon sellers to sell sticks with SD-card's as faked large drives (so even with X-ray inspection it doesn't look too much out of order).

2: To a computer, since the firmware presents a regular UMASS device, there isn't anything telling the computers over-the-wire protocol that anything is amiss (since the real size is hidden by the firmware and regular accessible blocks just behave normally).

So, short of an intrusive teardown of the device to read the true size of the SD-card and even knowing the presence of a hidden volume, the only over the wire that can help discerning this from a regular drive is timing attacks (And as you notice from this thread, people are jumping on to suggest solutions to minimize or even remove that).

[awesome_dude]

> They pay other people to notice this stuff for them!

Money, even at state level, is not some infinite resource (and neither is time).

States put effort into what they consider worth investigating - no state strip searches every incoming traveller, and goes through every item in their possession - it's possible for them to do, and if they did they'd find a hang of a lot more contraband, but it's costly, time consuming, and politically risky.

[mediaman]

He's saying they just plug your USB stick into some gizmo sold to the state, and it's going to find enough to escalate it.

If the idea is that there's no point in encrypting anything on a USB stick, and you just hope they don't look at it at all, sure.

But there is no threat model here that includes "check the USB stick" and does not automatically lead to finding and breaking "hidden" content.

[NetMageSCW]

Try to explain how the hidden content would be found? It effectively doesn’t exist until the password is in place. It isn’t hidden, it isn’t connected at all.

[otherme123]

> But there is a big flaw I see: 8gb. You're carting around an 8gb flash drive these days??

What is the problem? I have promotional flash drives from 1 Gb up to 8 Gb, that I use to store music for my car, or to carry pdfs to print in shared printers. I don't care if they break or get lost. I know people that carry similar promotional items with similar capacities. What is suspicious about 8 Gb drives? Maybe the lack of external branding, like "SanDisk" or "Walmart"?

[marysol5]

I found a 8GB USB drive in my pocket after doing the washing the other day (RIP).

I'd been using it to boot the debian installer from.

[raddan]

You should check to see if it still works. My favorite thumb drive went through the washing machine several times and still works.

[LorenPechtel]

Most drives are bigger. I have some around that size--but they're old.

[zyx321]

It would be less suspicious if the drive advertised 512GB and returned garbage data for any read past 8GB

[giancarlostoro]

> The XKCD version of password cracking works no matter how secure your hardware.

Lavabit would like to enter the conversation.

[ThePowerOfFuet]

The xkcd approach worked in that case; the wrench in that case was legal, not physical, but boy would it have hurt nonetheless.

[giancarlostoro]

He deleted everything ultimately. He printed it out in ultra tiny font in order to comply, but it was nearly impossible for law enforcement to use it. The FBI never decrypted the files.

[tptacek]

It's hard to tell if you're being serious here. At the end of the day, Lavabit's security came down to... the FBI's inability to read an ultra tiny font?

That's not the actual story (like, that happened, but all it did was provoke the DOJ), but it's remarkable to see someone cite that as a success for Levison.

[akerl_]

What about the other Lavabit users whose data he had handed over previously, before deciding to say no?

[marysol5]

FBI = legal

[matheusmoreira]

> It didn't look like anything they had seen before so they didn't think anything of it.

You will miss your government's incompetence when they start rectifying these failures. I know I do.

They are the tyrants who oppress us with a clean conscience. They never rest and have infinite money. Their occasional episodes of bumbling incompetence is the only respite, but those won't last. Especially now with AI to think for them.

[pixl97]

Ya. Especially when were at the point they know you know about hidden encrypted disks because they have your full internet history for the last 10 years.

I guess it's human nature to build the Torment Nexus.

[brookst]

Actually I’ve found some flaws in the Torment Nexus and have a PR to improve it.

[dijit]

I was arrested once and interrogated in great detail about how to access the data on a bluetooth usb dongle.

Just to say, I know what you mean.

[marysol5]

In court I had to explain how a TPM works, to the prosecution.....

[ozim]

You are conflating „state level actor” with „police level action”.

There is a world of difference if you get searched by your local police and a country level agency.

There are military units dealing with forensic investigations they have 100x or 1000x more budget and much smarter people.

But they don’t care about some drug dealers. They don’t waste time on silly stuff.

[marysol5]

The military really doesn’t have "much smarter people", the intelligent people are all in private industry, then LEO, THEN the military.

The military is stuffed full of grunts who are just there for the pay, and in many cases, conscription.

You can throw all the money you want at something, it doesn't make it work, just look at the US military

[fhdkweig]

> Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things".

The state-level threat isn't just about the direct employees' competence. They also have the funding to purchase tools made by people who really know what they are doing. Think of things like Pegasus spyware or Darksword iPhone hacking.

I can believe that a keystone cop wouldn't know the difference between a bong and a flower vase, but border crossing guards will know a USB drive when they see one and pass a copy of it to someone who knows what they are doing.

[NetMageSCW]

A copy of this USB drive would show nothing from the encrypted portion.

[johnnyApplePRNG]

Pegasus spyware operations cost something like $500k a pop, last I checked.

[fhdkweig]

That's kinda the defining characteristic of a state-level threat. They have all the money they could ever need. The reason Pegasus can charge that much is because there are people able and willing to pay that much.

[tptacek]

Can you check again and share where you're getting that number?

[ninju]

It may have gotten cheaper

https://prodefence.io/news/pegasus-spyware-operating-costs-c...

[tptacek]

Thanks! Per-seat licensing here checks out.

[XorNot]

Trying to keep data on a USB drive hidden long term is a losing game is the thing.

If you're intercepted with anything of value what you want is to rapidly destroy it.

This was the big problem I found when I was trying to figure out a secure way use Yubikeys: they're both long term unreliable, and short term impossible to wipe or destroy fast enough.

Literally a printout of 1 time passwords has better security properties in an adversarial situation.

For a storage device what you want isn't a secure store, what you want is a pin pull or switch which wipes it instantly.

[giancarlostoro]

Anyone using forensic software can dump an image of your entire drive including all partitions, byte for byte copy. Just because you got away with being careless once doesn't mean this will work every time. If you don't want your files to be copied in encrypted or plain unencrypted form, don't bring them with you. You're better off re-downloading them over the web at that point.

[ted_dunning]

Unless they disassemble this drive, a forensic dump will only show the open partition.

[marysol5]

A cursory X-Ray would show the internal SD. This product needs a hardware re-design (which I've seen other projects do) to have onboard flash instead.

Saying that, any proper investigation would read the firmware from the flash and identify the decryption routing anyway

[zyx321]

It has an SD card because proper flash is expensive. Surely the people making "4TB" flash drives on Temu must be using the same methods, or else they will be soon.

[throwawayffffas]

> This would evade 99% of them.

> Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things"

Famous last words. Do not underestimate the police, they have been doing this longer than you, they typically have highly sophisticated people working for them, and at the border they have enormous resources behind them.

[stackghost]

>Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things".

Even dumb cops know how to use a Cellebrite machine.