Slashdot Mirror
Ask Slashdot: Securing a Journalist's Laptop Against a Police Search?
Bruce66423 writes: In the light of the British police's seizure of a BBC laptop what is the right configuration and practices to ensure that such a seizure provides zero information to the cops? This post from Thursday might be a good place for some ideas, but that one's expressly about securing a Chromebook; what would you advise for securing a more conventional laptop? (Or desktop, for that matter.)
Shred it...
“He’s not deformed, he’s just drunk!”
Don't store your information on the laptop in the first place. Just use it as an editing and remote-access tool over a secure connection or to a USB stick you don't expose to search procedures.
That's about the best you can do, short of memorizing everything.
Encrypt the laptop, and you could lose it. Just let them search it top to bottom, then when they're done and you're wherever you're going, wipe the hard drive, reinstall your OS, and carry on.
It's really not a great idea to carry information you need to be secure around with you.
I've fallen off your lawn, and I can't get up.
https://xkcd.com/538/
Easy: Store nothing sensitive anywhere on the laptop. Make sure all browsing history/data is wiped before the laptop is every put to sleep/hibernate.
Whatever kind of encryption you use should have the ability to use alternative passwords - an unlimited number of them. So enter password (A) reveals your tax records, password (B) gets pictures of naked 30 year old men. But enter password (C) and you get clear pictures of Mr. Cameron violating a dead pig. When they demand your password, give them password A. If they get all torture-ish you give them password B.
excitingthingstodo.blogspot.com
Unlike common criminals, try cooperating with the police. You'll be better off in the end for it generally.
What if the police have become criminals themselves?
Best bet is simply not to have anything for them to find. Store your data on a thumb drive (that you'll carry or ship separately) or upload it to your own server or a service like Google Drive or Dropbox, encrypting it or not first, all depending on how sensitive the information is. Delete it or secure-wipe it or wipe the whole drive and do a complete factory restore on your laptop depending on how invasive you think the search might be. Then let the cops search all they want, they won't find what isn't there.
NB: Linux makes a better platform for this than Windows. On Windows bits of your files can end up in the oddest places to be found during a scan of the drive. On Linux it's easy to set up a separate partition where all your data will go and be certain it didn't leave traces anywhere else, and that partition can be secure-wiped and reformatted without messing up the OS installation in the process. Plus the cops are less likely to be familiar with Linux, and you can play the dumb-non-techie card of "I dunno, it's whatever the guys in IT put on it. I just follow the instructions to run my programs and everything works.".
https://www.youtube.com/watch?... http://www.kirkpiccione.com/10...
Comment removed based on user account deletion
> Unlike common criminals, try cooperating with the police. You'll be better off in the end for it generally.
Sigh... Dont Talk to Police
In the British Police-State, that is not possible, unless the journalist is willing to go to prison for failing to disclose an encryption password. Forget about "plausible deniability", that is for kids and morons. It does not work in practice.
The time to protect essential freedoms in Britain is past, and the battle (pathetic though as it has been) is lost. Anybody now trying to protect itself will just be classified as a "terror supporter" and that is it. Expect concentration camps to be opened soon.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
That one is true even in budding fascism as the British now clearly have.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Unlike common criminals, try cooperating with the police. You'll be better off in the end for it generally.
Yeah, in this case I'd have to agree with you. According to the article, the police went to a judge and obtained a court order to get the information - so if you don't provide it, be prepared to sit in a jail cell until you change your mind.
I do think these laws are overreaching and need to be rewritten (and rescinded in some cases) - but the police were following the letter of the law here.
#DeleteChrome
That's very bad advice sometimes, when it is. You're advocating 4th amendment roullette. Moronic.
It's an unfortunate sign of the times, but I've read far too many articles about people being arrested and jailed for unknowingly violating the technicalities of various different laws.. consenting partners under 18 being jailed as sex offenders and being listed for life, insulting heads of state or reporting on human rights abuses, jailed for having cartoon porn / weird tentacle thing stuff from Japan that still gets branded as child pornography, or even for whistle-blowing. And particularly for America, reading in recent times, the attitude of border agents that they're outside the law and no-one has any constitutional rights.. frankly, if you are a journalist reporting about things your government (either American or elsewhere) are doing, you'd be a fool not to have everything strongly encrypted, and give them the leisure to browse through your stuff to find something to charge you with.
On your Laptop there is a normal Windows installation which is not used for work. Only for stuff like browsing the web in the evening at the hotel. mails to the kids, etc.
On a USB stick on the keychain there is a copy of Tails https://tails.boum.org/index.e...
You rent some VPS or root server in a country of your choice, under a different name, preferably paid via cash. This is the place where all the data for work is stored. encrypted.
This server you only access via Tails which uses Tor by default.
If you can't do this, you put an encrypted VM onto your Laptop which happens to have the data for work and you write your stuff or access the web for work related research only in this VM. Again using a distro like Tails.
What do you mean, 'budding' fascism?
Have you forgotten in the late 1930's the UK had the largest Nazi party outside of Germany?
And it's leader was a member of the royal family.
Yes I know there is a small difference between Nazism and Fascism.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Don't store anything on the laptop. The fact they can legally compel you to provide the means of data access means you are in trouble in every case which they have possession of both you and your laptop. You can either do a really good job of hiding the data or you can keep it outside of where they can get it. How about a remote server a trusted person can deactivate if they hear about your situation?
When things get complex, multiply by the complex conjugate.
Don't have a drive in it. Don't have bits that they can claim to find suspicious. No excuses, because even (or perhaps especially) if they don't find anything on your laptop they'll confiscate it anyway to have the boys back at the shop take it apart ten ways from Sunday.
When you arrive, buy a new drive and load it up. How? Well, if you're visiting a field (or home) office, they'll have a disk image handy for you to use. If there are private bits that you haven't shipped over yet (SRSLY? They travel faster than you do, after all) then you can take them along. The border peeps aren't interested in doing cavity searches on everyone, after all, and short of shredding all of your clothing as well as the rubber-glove treatment they're not likely to find a micro-SD.
Lacking <sarcasm> tags,
In the UK you can be forced to hand over keys so keeping anything, encrypted or not, on the laptop is a no-no.
Get yourself a 4G account and mail the Veracrypt file to a safe country.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
1. Use Linux for the simple reason you can separate partitions. Create a separate /home partition that mounts on an encrypted removable drive, like an Ironkey.
2. Do all work on the removable drive.
3. Never cross a border with both the laptop and the removable drive. Ship out courier the drive separately and carry the laptop.
This way there is nothing on the laptop to be searched or seized.
Learning HOW to think is more important than learning WHAT to think.
to what you can actually do.
You can hide files in a hidden container, you can encrypt files and give the key to someone in a different jurisdiction. But, in the end, if they have you and they have the computer, they will probably get what they want. We used to call it "rubber hose crypto".
If you don't have to bring the data with you, don't. Put the encrypted data somewhere in the cloud and pull it down when you need it. Then purge it from your computer.
SD cards are small and might pass if you are not subject to intense scrutiny. But if they are really looking at you, they will be found. If you don't have a lot of data, consider encrypting it and then use steganography to hide it in some of the files in you iPod.
Assuming you do not keep data on the computer, what you need to do is install apps that will:
Make sure to clear history, etc.
The best way to store data securely is in your own head.
linquendum tondere
They won't be able to figure out how to make it work, so your data will be safe.
Heh heh. You said what if.
The Regulation of Investigatory Powers Act allows them to compel you to hand over any passwords or encryption keys needed to access the data.
You want to run gentoo hardened. Separate partition for /boot and use full disk encryption with cryptsetup. I'd recommend paranoid high iteration count and using serpent over the official AES. Think of a nice long sentence or two and type it out without using the space bar, then toss a real password at the end of around 10 characters minimum. Do not use USB thumb drives for the key, memorize it as I said above.
Use non-standard use flags and do not use any -O optimization level and opt for safer-but-slower code. Do not use hardware acceleration hooks for encryption, prefer slower software generation (less backdoors/issues from biased hardware). Do not run or use any remote admin tools such as SSH, or if you do generate 16384 bit diffie-hellman moduli on two different machines and use only the ones common in both outputted moduli as your real DH pairs in /etc/ssh/moduli.
Keep the system partition with disk encryption, separate from your small-as-possible directory where you keep the sensitive news items. Known plaintext attacks can assist breaking the encryption behind the system-partition since there's files that *must* contain certain content inside /etc and such. You want your documents to use a separate encrypted mountpoint and never copy any known things there and only put things you write inside that partition uncompressed (again known plaintext).
With the Gentoo hardened GRSec kernel, you will want to use the option to disable any USB devices added after boot as to prevent NSA USB Fobs from being inserted to do DMA-memory attacks. You will never use wireless, always opting for a physical cable. You will never use firewire/thunderbolt/sound and they should be missing from the machine or disabled. Remove the microphone from the system, keep the webcam and tape over it (later you can use it to shed encryption keys from memory upon seeing a fast moving blob approaching when agents raid.
You will never leave the machine out of your sight booted up with the encryption keys in memory. Upon leaving the machine, you should spray a light bit of silly-string over it and take a photo of the unique strands. When you come back compare it and if you spot any differences the machine was accessed while you were away.
Wrap the machine in RF shielding and when doing encryption, run other encryption of the same type in a loop before starting the real encryption to prevent side channel attacks against the Chinese Remainder Theorem (youtube this for a demo of snatching RSA keys over RF leaks).
Never type your password with a cellphone within hearing range or else the keys will be heard and deciphered that way. Put the cell phone in a box like the oven or microwave then go back and type your passwords. Once the setup is complete with the machine, you will never update it and do not use it to get online once setup. Go back to using CDROMs as the input medium and mount it readonly,noexec with the system encryption key unlocked but not the private directory. Reboot after using the CDROM and *then* unlock the private directory and move the files from the system directory over. This way any memory loading/stealing by a hijacked CDROM device won't be resident or have the ability to snag that coveted secret key.
I'd keep going, but I'm afraid I've already said too much...
If you do not, then you are a "troublemaker" and will be treated just the same as a criminal. The police state is violently opposed to any and all resistance and the law does only support them, not you anymore.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
1. (Most stupid proposal so far): That will fail by a simple look-up of the HDD serial number which the HDD reports via SMART command.
2. Ever heard of x-rays? You know, like they use in airports?
3. Lots and lots of forensic tools that can detect that.
4. Uh huh. About as obvious as just ssh-ing to your remote server. Nothing gained at all.
5. Again, x-rays.
6. An have that friend go to jail as a "data mule" instead. Only good piece of advice in here. Utterly immoral though.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
If the journalist has a home computer, suppose it was left on, with plenty of UPS protection, while the journalist was out of the country, with laptop? Then, shortly before travelling back to the home country, the journalist uses the laptop with Tor or some other secure protocol to upload/transfer critical data to the other computer. The laptop can then be TOTALLY erased --we know programs exist to do a thorough job of it-- such that a fundamental reinstall of all software would be needed, before it can get used again. The erased laptop is, of course, what would be handed over to customs ghouls.
1) Make one of these: https://hackaday.com/2015/10/1...
2) Hand everything over. Warn the bad guys that if they try to use your USB stick, it'll fry their computer.
3) When they fry their computer, ask if they have learned their lesson about taking you on your word.
4) Be cooperative. You already won the battle of wits, be a gracious winner.
5) Your data was on your obscure self-hosted webserver elsewhere in the first place.
Liberty - Security - Laziness - Pick any two.
Back when I was at Kazaa many years ago, I kept all my files in a BestCrypt-encrypted drive, and all sensitive emails were PGP-encrypted. I was feeling pleased - if anyone got hold of my computer, there was nothing to see. But then one day our office was raided in a search discovery order, and all that time spent encrypting things came to naught, if I refused to hand over anything it would have been contempt of court. And so I printed out thousands of emails in one long continuous unformatted strip... that was about as far as I could go. I did consider that I could have gone one step further and used BestCrypt's feature that lets you create an encrypted drive that's actually two partitions - give out one key and all you see is nice set of clean files, plus a whole lot of random bytes. It's something to consider, but you're living dangerously if it's a court order. BTW, there's discussion here about keeping data in the cloud - another tempting option. Broadly the law can compel you to hand over any data "In your control or possession", where possession is defined as including the means to retrieve remote data. So there would need to be zero knowledge of having that remote data at all. Just sayin'
The parent organisation should maintain a networked data store that all it's reporters have a write only password for.
Data is then sent via ssl. No other encryption software of any kind on the laptop.
Absolute minimum of services and a tiny hard drive, with no swap file/partition.
Reporters should only use a plain, single view, text editor that doesn't store parts of a working document to file, and can be made to direct send the data without ever touching the hard drive.
And for the politically correct, social just warriors, etc. .. man in the sense of person
You carry a laptop, you carry a live boot USB stick/CD, You carry encrypted media, possibly the same as a boot USB. Your counterpart, possibly in another country, carries the decryption key. You carry his decryption key. Never cross an international border together.
Personally, I'd perform a persistent install [of the distro of your choice] to a bootable MicroSD card. You can not only boot it up on virtually any PC, there are myriad ways you can throw them off or just plain fuck with them. Hell, really mess with their heads and lug around a laptop with Win9x on it (you don't even need all the drivers; present 'em with one huge fucking list of yellow exclamation marks in Device Manager!).
The bootable MicroSD card you can hide almost anywhere (up your nose, in a slit cut in the sole of your shoe, etc etc).
Yes, it's possible to find MicroSDs -- if you do a full-up fine-tooth-comb search. Which takes hours and pretty much destroys everything in its path. If you've really pissed off the Powers That Be, they might. Then again, they've probably done the same thing to your office, home, car, and anything else you've been near recently anyway so why start worrying at the airport?
Otherwise, the major danger is that your brand-new Alienware machine looks like it would be better off in someone else's collection and the "confiscation for the sake of search" is just an excuse. Which is why you're better off without it (get another on arrival) or at least leaving the hard drive at home. The MicroSD chips aren't what they're after and finding the one in the heel of your shoe is more trouble than it's worth.
Lacking <sarcasm> tags,
Zip the relevant files, and then change the extension to .odt
When people cant read them, they will blame Microsoft!
(Or use bzip, or compress or even IBM Squoze)
Sent from my ASR33 using ASCII
Everyone should have at least a few files that are encrypted random bits. Big ones. Just to make sure that the snoops suffer for being dicks.
Lacking <sarcasm> tags,
These folks provide advice for human rights activists who want to stay safe and protect their sources from nasty governments: Security in a Box.
run a parasent Linux distro like puppy on a micro sd as the entire os is stored in ram. save you data to the sd card they can be easily hidden or destroyed. now the fun part encrypt your entire harddisk with windows on it to make them think your hiding something then make them wast there time getting a court order to hand over the key just to find nothing.
Buy a camera that uses dual SD cards, like a Nikon D7000, and keep the card in the camera when moving through security. Store your computer data on one of the SD cards in an encrypted hidden file. Make sure you take lots of pictures and have the camera set to use the cards in mirror mode. No security people will image a camera card. At best they look at all the pictures using the camera. If they do image the card, highly unlikely, all they can find is a hidden encrypted file that you just deny any knowledge of.
Easy. Don't do anything - and I mean ANYTHING - locally on your laptop. Use it as a glorified VPN and Remote Desktop/VNC Client to a PC safely behind your employer's firewall, or at a hosting provider that is in a country with good privacy protections.
With a really long passphrase with weird characters. They'll spend the rest of the natural lives waiting for it to be cracked.
... if it is not possible for you to memorize what you can, you may suddenly have entered an alternate dimension.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Survival 101.
Pissing off the border guard.
How the story ends if you "Ask Slashdot."
2) Hand everything over. Warn the bad guys that if they try to use your USB stick, it'll fry their computer.
3) When they fry their computer, ask if they have learned their lesson about taking you on your word.
4) Be cooperative. You already won the battle of wits, be a gracious winner.
How the story ends in the cinematic world.
[Anonymous basement interrogation room]
Wake up! I need you to be focused!
You either give me what I need or this switch will stay on until they turn the power off for lack of payment on the bill.
Which do you think cuts closer to the truth?
1. Backup the data files to a single backup file.
2. Encrypt the backup file using an OpenPGP application (e.g., PGP, Gnu Privacy Guard). Software should not have sensitive data so it does not need to be encrypted.
3. Upload the encrypted backup file to a cloud service whose servers are in a nation that will not respond to a police warrant from the nation whose police worry you.
4. Use a strong eraser application to erase the original files, the backup file, and the encrypted backup file on the laptop.
Project Gutenberg has 50,000 books. Each book as 100,000 words.
Each word can be the starting point for 5 keys (5 to 10 words long).
That's 25,000,000,000 keys. Roughly a 34 bit keyspace. Not really
all that great, IF they know that's the algorithm you used to choose
the key. If you drop the e's and they don't know, then their brute
force attack won't work.
I believe you are missing my point here as it appears others may have as well since I've been modded as a troll and someone else posted the "don't talk to police" thing. There is a difference between being polite and cooperative - good things - and volunteering information expecting the police to simply send you on your way, which can happen but is highly unlikely. I'm advocating the former. As in most aspects of life 'polite and cooperative' is generally the best policy, at least at the beginning of any conversation with authority.
If you have a Chromebook, have a separate gmail account that looks active (subscribe to some innocuous mailing lists.)
Prior to border simply powerwash the Chromebook and login with the clean account. Nothing to see here officer. The password is 1234.
After you get home, login with your normal account.
Confronting the police by breaking laws in order to protest the laws is, at least in the US, a pointless excercise as the policy neither make the laws nor do they judge whether the laws are fair or even legal. The job of the police is to simple enforce laws that have been made. That is as true today as it was 50 years ago.
Boy I should have proof read that before posting. Several misspellings, but I believe you can get my point.
Many countries in the world require the ability to search computers brought across the border. You can be detained if you fail to provide access such as passwords.
Do not take precious data with you. Leave the data safely at home and connect securely.
Use secure cloud storage or even secure storage back at home base and connect using a secure VPN.
Get some clunker laptop and pull the hard drive out of it. Build a bootable Linux CD/DVD with team viewer on it. Don't save any passwords IDs, etc. to it. When you're in the field, fire up team viewer to a machine that is safely at home. Work. When done power the machine down. Toss DVD before going to the airport, or keep it if you like to live dangerously. Cops snatch the laptop, has no hard drive they will have 20 questions for you, and they will ask them in a way that usually involving bright white lights, waterboarding, etc. but they will not have your data.
Or, more likely, you're discovering that you bit off more than you can chew, and you're hoping the IRS doesn't want to see last year's tax records again.
As in most aspects of life 'polite and cooperative' is generally the best policy, at least at the beginning of any conversation with authority.
Polite and cooperative does not include volunteering anything. Law enforcement employees are not your friends, and will use anything you give them against you in any way they can.
So, yes, cooperate, and be polite, but don't think for a minute that they'll reward you in a positive way for anything you volunteer.
Be especially wary about promises of immunity for testifying as a witness. Unless it's a full immunity in perpetuity (which is rarely given), they can demand that you incriminate yourself and waive your fifth because you have "immunity". Then they turn around and gather evidence for a crime they knew nothing about before, and nail you. They can't use your testimony against you, but they can and will use it as a basis for discovering other evidence.
So don't volunteer anything if you have anything to hide. Not even anything unrelated to what you have to hide.
And quite frankly, who can say with certainty that they have never broken a law - wittingly or unwittingly? In the eye of the cops, prosecutors and judges, everybody is guilty of something. And they are probably right.
Put your encrypted computer or data store in a diplomatic bag for transport across borders. This may require having diplomat friends at both ends of the chain. Then again, friendly countries may be glad to help if they suspect you might embarrass an enemy.
In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
Even thats getting tricky. In the old days that was a perfect method. But with diplomatic protection now been confused with local embassy staff any convention on is getting weak. A person can claim to be, show id, seek protections but might have already been searched and had data cloned. ;)
Later nice comments about "intake procedures" "arrest" and "appropriate procedures" will be released to the press ie the full diplomatic immunity part vs consular immunity was not found until well after the search
Domestic spying is now "Benign Information Gathering"
The keyspace is only large if the attacker doesn't know or suspect how your password is constructed. Otherwise: 10^3 possible famous books, 10^5 words (starting positions) per book, 5 possible key lengths, 2 for with/without spaces. This gives you a key space of 10^9 that can easily be brute-forced.
And if they/NSA see you look up the book on your browser, you're definitely done.
Avantslash: low-bandwidth mobile slashdot.
NAZI is a flawed english transliteration of NSDAP National Socialist German Workers' Party. A socialist workers party isn't a "bad thing" and most people didn't notice it was not a worker's party, nor socialist until it was too late. I have no idea what the UK party was like at the time, but I'd guess they were more like the theoretical ideals, not the "kill all Jews" party. But maybe they were.
The NAZI party was a German nationalist party, why would there be so many German nationalists in the UK?
Learn to love Alaska
I don't know what I expected. Clicking random youtube links on slashdot is like playing russian roulette with your mood.
About halfway through the first video, very very interesting stuff.
...
You guys are aware that self encrypting drives have been readily available for a decade now, right? The bios detects that the drive requires a password and asks for it at book. The password unlocks an internal key used to encrypt the drive. Unless the adversary manages to capture laptop while it's on or in standby, no password = no data.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Timothy - Any chance you could post "Ask Slashdot" stories to the "Ask Slashdot" section of the site? It exists for that very reason you know.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
Except everyone is considered a terrorist in the governments eyes. So we are all F***ed!
The Truth is a Virus!!!
Turn on FileVault to encrypt the drive. Set a firmware password. Make sure there are no guest accounts. See https://support.apple.com/kb/P... and https://support.apple.com/en-u... . Turn off iCloud and don't enter an AppleID. Use an encrypted text editor on top of this with a 3rd password. This won't stop the NSA, but will stop most hack attempts. Putting documents on an encrypted SD card is not a bad idea.
using a mac+filevault2+bootprom password should cover you
VeraCrypt whole disk encryption. (Successor to TrueCrypt.) Duh!
Make sure it's powered off when you're traveling, and avoid malware infection. Then, you're all good.
If you're worried about compulsory password requests, then things get a bit more complicated. You can use the plausible deniability feature of VeraCrypt to accomplish this, but deniability also requires rigorous adherence to modified computing practices.
Thank you for exposing a privilege escalation backdoor to your system through the TrueCrypt driver.
To prevent the collapse of Western Civilization due to complete automation and unfettered rent-seeking we need to institute these three policies:
Universal Basic Income which will replace most forms of welfare. However, this will not work without...
Land Value Tax based on the rental value of land not including any improvements. This will replace most other forms of taxation. For this to have the desired effect we also need...
Full Reserve Banking which will remove the ability of banks to create money and then charge interest on it.
Private natural monopolies and every other form of rent extraction must be hunted down and neutralised.
If we don't do these things the booms and busts will continue to ratchet up wealth inequality until the economy collapses and the peasants revolt.
Don't take a laptop, just an install DVD. When you arrive, pick up your pre-arranged rental laptop and install your image from the DVD. Use that to download the rest from home. Then work normally.
When you're ready to leave, upload everything over the net and use the DVD as a rescue boot so you can wipe the drives. Return the laptop and shred the DVD.
I would strongly suspect that EFS has have a backdoor that Microsoft would give up immediately upon request. Same for any and all cloud storage. Also, Windows 10 is offered for free which means that someone else is paying Microsoft for the data that this OS collects by default. It's like "Here, take this free stuff so we can keep track of everything you do." Has Microsoft ever given away anything for free? Not that I can remember.
the weakest link in any security system is the flesh and blood one...
Actually, Nazi was a derogative nickname for the party (there was a comparable nickname, Sozi, for a left-wing party). It was used in Germany, but not by Nazis, who always used "National Socialist". I would suspect it was a lot less used after 1933.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
The UK can compel disclosure of a password, with up to 2 years in jail for simply refusing to comply.
https://en.wikipedia.org/wiki/...
TrueCrypt could provide plausible deniability in theory, but the difference between theory and reality is often smaller in theory than in reality.
https://www.eff.org/https-everywhere
Just load your laptop like usual, and run your vm from inside an encrypted veracrypt folder. Put another vm with some games (so you have a reason to have the vm host running). Most investigators won't spot the vm's, most of the ones that do, won't spot the encrypted ones. The ones that do spot the encrypted one, won't be able to get into it.
Cheap storage VM.
I wouldn't do that without also encrypting the host OS's whole disk with VeraCrypt in case the passwords leak out of RAM onto disk unencrypted.
I would say that's unnecessary for 99% of use cases, and defeats the purpose.
Cheap storage VM.
I would say that's unnecessary for 99% of use cases, and defeats the purpose.
Hi pnutjam. That was my thought about the VM solution actually versus plain whole disk encryption. ;-) Is the use case you're worried about the plausible deniability requirement? Apart from that, do you see a use case that makes it preferable to go this route and install a VM instead of just using whole disk encryption?
On the plausible deniability front however, your suggestion seems pretty interesting; definitely sounds simpler to use an encrypted container with a hidden volume than an encrypted system with a hidden OS.
Well, the problem with just a hidden container, is that you often don't realize where things are being written by programs you use. It's easy to end up with something in an insecure location, or sitting in you hibernation or suspend file.
With the whole OS encapsulated, you can more easily contain it. You can also have it use a vpn or tor network, so the main pc can't listen to it's traffic.
The only big problem in this situation, would be keyloggers, or some sort of malware that is taking screen shots periodically. You can guard against key loggers by using an onscreen keyboard, but the other is something you will have to avoid with opsec.
Cheap storage VM.
In regards to whole disk encryption, I think that is great also. However, it's still difficult for your average user. I think it's more common and less of a red flag now.
My problem with whole disk encryption is that it's usually integrated into the logon. You just need to leave your pc running, and it's defeated.
I think the separate vm provides a sort of reminder and encourages you to be more conscious of operational security, which is where most people screw up.
I also like the portability.
Cheap storage VM.