In this post we are going to see why Anonymity is not enough for Sensitive use, and what can be done about it.
+In this post we are going to see why Anonymity is not enough for Sensitive Use, and what can be done about it.
Let's say that Bob is using a popular online forum to leak information about a government agency’s unethical behavior. To stay anonymous, he makes sure to connect to the forum using at least Tor to connect there. He uses a burner email address to sign up there, to upload the sensitive files. His Anonymity while doing this sensitive action remains solid.
+Let’s say that Bob is using a popular online forum to leak information about a government agency’s unethical behavior. To stay anonymous, he makes sure to connect to the forum using Tor at the very minimum. He uses a burner email address to sign up to the forum and upload the sensitive files. His Anonymity during this sensitive action remains intact.
However, there are only 10 people who could have originally had access to the leaked information, and Bob is one of those 10 potential suspects.
-The adversary makes use of the key disclosure legislation to issue search warrants to all 10 people, to get to know the contents of their personal drives. Essentially, they don't have anything solid against Bob, as the anonymity of the perpetrating party is solid, but they are doing some guess work to try and find anything incriminating against him anyway, to make sure.
+The adversary makes use of the key disclosure legislation to issue search warrants to all 10 people, and to get to know the contents of their personal drives. Essentially, they don’t have anything solid against Bob, as the anonymity of the perpetrating party is intact, but they are doing some guess work to try and find something incriminating anyway.
-Problem is, the adversary now busts down Bob's door, and forces him to unlock his laptop, and unlock every encrypted volume on his laptop. What then ?
+Here’s the problem: the adversary busts down Bob’s door and forces him to unlock his laptop, including every encrypted volume. What happens then?
-
Bob didn't implement Deniable Encryption, therefore the adversary forces Bob to unlock his harddrives, and he has no other choice but to comply. He shows all the incriminating evidence contained in there, where he isn't able to deny implications with said Sensitive activity.
Since Bob has no other choice but to comply when the adversary forces him to unlock his hard drives, and since e didn’t implement Deniable Encryption, he has to show all the incriminating evidence, and therefore he can no longer deny implications with the sensitive activity.
-Bob's setup, although suitable for Anonymous Use, is not suitable for Sensitive use, due to the lack of Deniable encryption
-
For instance, if Bob had implemented VeraCrypt’s deniable encryption to store all that sensitive data, he could've given the password A to open the decoy volume to the adversary, and claimed that there was no hidden volume, and the adversary wouldn't have a way to prove otherwise.
Bob’s setup, although suitable for Anonymous Use, is not suitable for Sensitive Use due to the lack of Deniable Encryption
+For instance, if Bob had implemented VeraCrypt’s deniable encryption to store the sensitive data, he could’ve given password A to open the decoy volume for the adversary, and could’ve claimed that there was no hidden volume. The adversary wouldn have no way to prove otherwise.