top 97 comments

sorted by: hot top controversial new old
[–] 389 points 1 year ago (26 children)
  • [–] 82 points 1 year ago (13 children)

    What if i don't remember my own password?

  • source
  • parent
  • hideshow 13 child comments
  • [–] 135 points 1 year ago (12 children)

    It says "until" so you'll be having plenty of time to remember it.

  • source
  • parent
  • hideshow 12 child comments
  • [–] 32 points 1 year ago (11 children)

    I'il probably have internal bleeding before i remember them

  • source
  • parent
  • hideshow 11 child comments
  • [–] 46 points 1 year ago* (10 children)

    Well in reality they will use waterboarding or some other technique that ensures suffering while not being life threatening. There's actually a great movie called Unthinkable about this.

  • source
  • parent
  • hideshow 10 child comments
  • [–] 23 points 1 year ago (7 children)

    That still doesn’t mean you’re gonna remember it. I forget my master password all the time. Torture would just ensure I’d forget it even worse.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 35 points 1 year ago (6 children)

    That's the whole thing with torture. It demonstrably doesn't work, but people who use it aren't the people who're concerned with scientific reality

  • source
  • parent
  • hideshow 6 child comments
  • [–] -3 points 1 year ago (5 children)

    It does work for people who value their wellbeing more than they value the information they remember. For remembering stuff there may be some medical injestions before torture.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 13 points 1 year ago (4 children)

    No, there is no medical injections, they only exist in badly written novels. In reality yeah, people will talk, they will talk so much you wouldn't be able to shut them up. What you can't have is the reliable information, people will tell you everything they think you want to hear so you wouldn't worsen their wellbeing. And you can't know at all, did they tell you the truth, or what they think you want them to say. You might as well ask an LLM for information. The only difference is, LLM is not an entity and can't feel pain, and that's probably the main purpose of torture.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 8 points 1 year ago (3 children)

    Yeah. Trevor in GTA 5 explains the concept quite well. I'm paraphrasing but he says that torture is done for the act itself and not to get information

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 1 year ago (2 children)

    I remember many years ago reading the findings of a study done by the US military about the info that they got out of people at Guantanamo Bay, and basically running out into a field and shouting "Are there any terrorists here??" was more or less as useful, and any field info -regardless of how much or how little - was way more accurate and useful. By the time you even get somebody in front of the torturers, what they know is probably outdated, and you're more likely to get false info than anything true anyway because people will tell you whatever you want to hear to make it stop, even if they have to make shit up right then and there.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 20 points 1 year ago (4 children)

    give them the duress password gg

  • source
  • parent
  • hideshow 4 child comments
  • [–] 9 points 1 year ago (2 children)

    "If this password doesn't work, I'm going to break your thumbs."

    "Uh...."

    "Yeah, its not the real password. Lets break his thumbs and ask him again."

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago

    It's cute that anyone thinks situation 2 would be necessary and that encryption couldn't be broken with the press of a button if someone seriously wanted your info.

    Fantasy land.

    Privacy is a human right, but our rights were eroded long ago.

  • source
  • parent
  • [–] 197 points 1 year ago (27 children)

    Linux nerds literally only want one thing and it's fucking the idea that your full disk encryption will pay off one day.

  • source
  • hideshow 27 child comments
  • [–] 94 points 1 year ago (2 children)

    It's when your disk breaks and you can just throw it away without worries.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 28 points 1 year ago (7 children)

    It can, but most likely it only would if you're doing illegal shit and get caught. They'd search your place for evidence and FDE could keep them from discovering some things.

    But uh, if they got that far into investigating you then you're probably already screwed.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 50 points 1 year ago (5 children)

    Not true at all. Governments regularly raid political dissidents. It's a disciplinary tactic in and of itself. I've been raided for plenty of shit and never been convicted of any crime.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 25 points 1 year ago* (last edited 1 year ago) (4 children)

    I mean the average dork not cool people like you (if you're being truthful)

    Persons of interest to governments should always be diligent.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 24 points 1 year ago (1 child)

    My point is that raids are for the purpose of gathering evidence. The way it usually works is that the state decides they want to criminalise you for something so they search your place for anything they can use to incriminate youβ€”not vice versa, ie they dont already have enough evidence to incriminate you when they plan the raid.

    I don't know about a majority of people, but with the rise of the far-right across many countries I think it is a significant number of people who are at risk of this, and I think it's rather short-sighted to assume only a small number of "cool people" are affected (thank you though). Like I am a nobody, I'm not famous, and there are lots of political organisers and militants like me you've never heard of being targeted for their political activities. You don't need to be a Snowden to have some degree of state interest in you, and most state repression (raids, incarceration, arrests, etc) is relatively cheap to dish out willy-nilly.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 6 points 1 year ago

    I think he's over blowing the 5 dollar wrench method.

    Unless you live in a place where human rights are disregarded like every possible moment, they'd probably only resort to torturing you to gain access if they believe you are somehow connected or have ancillary evidence that points to you. IE that darkweb dude they tortured in Turkey to gain access to his encrypted laptop containing incriminating evidence.

    Otherwise they'll just do a preemptive raid hoping that it leads to new information.

    Like right now border patrol has been forcing foreigners to show data on their mobile devices to see if you have any roasted vance memes so they can turn you away. But in many cases, it has been done because they already had you flagged as posting or sharing roasted vance memes online.

    Of course you could also always be in a craphole country where they'll torture you anyway, regardless if they have any reason to believe you are connected to something, but simply due to the fact that you opted to use FDE or any practical security scheme.

  • source
  • parent
  • [–] 14 points 1 year ago (1 child)

    I know a nice middle aged mum whose house was raided by whatever the Australian SWAT team calls themselves at 2am. She's basically considered a public enemy by the government. And the worst she's ever been accused of is blocking traffic and using water-soluble spray chalk on buildings.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 1 year ago (6 children)

    Is there any reason to do full disk encryption, vs encrypting a single partiton or a folder with eCryptfs? It’s not like your /usr/bin, etc… needs to be encrypted, but encrypting it reduces performance.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 5 points 1 year ago* (4 children)

    Suppose you're in some hypothetical country where torrenting is illegal. The presence of /usr/bin/qbittorrent on your disk could be enough to face charges. Unencrypted /var/log? Maybe they can see you've been running a cryptocurrency miner. There could be plenty of data outside of $HOME on your computer which a cop might try to use against you.

    In the most paranoid hypothetical scenario, someone could mount your unencrypted /usr/bin and replace openssl with a compromised version.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 year ago (3 children)

    /var/log and the likes aren’t really issues, I just have mine as a link to the real one in an eCryptfs folder. Though I guess you’d be right about qbittorrent, this is something pretty rare.

    In the most paranoid hypothetical scenario, someone could mount your unencryptedΒ /usr/binΒ and replaceΒ opensslΒ with a compromised version.

    I suppose if you’re in this situation, you have way more important things to deal with. That would imply someone has physical access to your computer, at that point if they really want to know what you’re doing they might as well setup a camera.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 1 year ago* (2 children)

    What I'm getting at is that for people using FDE, any performance hit is worth it compared to worrying that you've covered every angle.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 0 points 1 year ago (1 child)

    By default, most FDE have horrible performance hits and require significant tweaking, configuring and benchmarking to get it right depending on hardware, use cases, conditions… I’m sure there are quite a bunch of people out there who don’t want to do any tweaking while still having the performance they paid for.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago

    Unless what you are doing is heavily I/O dependant (mostly heavy database workloads), that's not really true anymore, especially with a modern CPU and say, LUKS encryption. Phoronix has a recent review of FDE using LUKS, and apart from synthetic I/O tests, the difference isn't really observable.

    Try cryptsetup benchmark on your pc and look at the results for aes-xts for example.

  • source
  • parent
  • load more comments (1 reply)
  • [–] 5 points 1 year ago (5 children)

    That's the best part, it can never really "pay off." It can only mitigate. Hardly seems worth it to me. Alas.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 10 points 1 year ago (4 children)

    Aren't you worried about your laptop getting stolen?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 313 points 1 year ago (9 children)

    "Well, we raided his mom's house and confiscated all his cobbled-together e-waste."

    "And!?"

    "His drives were encrypted. Apparently he 'applied PQC patches to dm-crypt himself', whatever that means. All I know is that it made the guys from NSA scream. There was nothing we could do."

    "So we've got nothing?"

    "Oh no. He happily gave us both the keyfile and the passphrase."

    "So..?"

    "No warez, no CSA, no political manifestos or illicit recipes. Not even tax evasion - it's not like he has an income. Just... copyleft source code as far as the eye could see."

  • source
  • hideshow 9 child comments
  • [–] 110 points 1 year ago (2 children)

    copyleft source code is a telltale sign of communism, thus anon can be associated with Big terrorist like the Antifa.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 133 points 1 year ago (2 children)

    I lol’d at this. But seriously, privacy is a fundamental human right. You don’t need to have something to hide to assert your right of privacy.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 77 points 1 year ago (8 children)
  • [+] -10 points 1 year ago (7 children)

    Or just beat the shit out of them and get the info you need (or more likely want).

  • source
  • parent
  • hideshow 7 child comments
  • [–] 31 points 1 year ago (3 children)
  • [–] 66 points 1 year ago (12 children)

    "His fucking kernel is deblobbed too?"

    As a noob, I genuinely can't tell if this is real jargon or not

  • source
  • hideshow 12 child comments
  • [–] 76 points 1 year ago* (6 children)

    It's referring to binary blobs. A windows exe might be a binary blob.
    These are distributed compiled. Even if the project is open sources, the binary blob might have been generated by a compromised compiler.

    This is one of the reasons the XZ Utils compromisation went unnoticed for so long. One of the compressed files used for testing contained malicious code that would be included in the build artefacts (IE, the final compiled binary) under very narrow and specific circumstances.

    So "deblobbed" means absolutely everything in the OS was built & compiled on their computer from original source code

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 1 year ago (4 children)

    Thanks. But I don't understand why any of that ensures that the compiler isn't compromised? Do you mean they have presumably vetted the compiler themselves first? This is something that would be incredibly time consuming to do, assuming we are talking about gcc or something equivalent, which, I mean if you're compiling an OS...

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 1 year ago (1 child)

    The concepts they're referring to have more to do with Ken Thompson's Trusting Trust essay. Laurie Wired recently came out with an episode about it. It's a rather intractable problem in computing, and unfortunately, even with the best practices to overcome it, you can never be 100% sure that your system is completely free of compromise.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago (1 child)

    That's true.
    But the idea is that there are no precompiled binaries that are implicitly trusted.
    So you CAN vet all of the code and artefacts, and if something doesn't seem right you can trace it back to the code and understand exactly why, instead of seeing a black-box binary and coming to the conclusion "it's doing something it shouldn't, but I don't know what or why".
    The idea is that you are in control of the entire build process.

    But yes, it would be extremely time consuming to vet GCC, build it from source and (I guess) compare checksum/hashes against published binaries. Then vet all of the source code of everything you need to compile for Gentoo, then compile that and compare checksum/hashes etc.
    Which is why it's in a 4chan meme.

    But I imagine governments agency will have some deblobbed Linux installs with the technical capacity to vet all the code and artefacts

  • source
  • parent
  • hideshow 1 child comment
  • [–] 8 points 1 year ago (1 child)

    Tower's explanation of blobs is kind of strange and not really correct. In a general sense a binary blob is just a situation where you have open-source software that is combined with proprietary components.

    Most relevant example to the meme is that the Linux kernel is open-source, but can sometimes contain drivers that are proprietary and don't have source code available. Those proprietary drivers would be the blobs.

    As a counter-example, the linux-libre kernel that devfuuu linked to, is a version of the Linux kernel that has had all the blobs removed.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 43 points 1 year ago

    Last line should have been "we cant he lives on the street"

  • source
  • [–] 41 points 1 year ago (6 children)

    They missed out the firmware in the WiFi adapter

  • source
  • hideshow 6 child comments
  • [–] 2 points 1 year ago (3 children)
  • [–] 16 points 1 year ago (2 children)

    That's not firmware in wifi adapter.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 36 points 1 year ago* (last edited 1 year ago) (2 children)
  • load more comments
    view more: next β€Ί