Arch Linux

rklingsten

Member

Registered: 2009-07-31

Posts: 29

Obscuring LUKS password entry at boot?

Howdy, I'm interested in some security by obscurity. When I boot my Arch on my X1 Carbon, of course the encrypted root presents a prompt for password with the message like "I need the password to the ENCRYPTED filesystem" ...

My question is, I'd like to get more plausible deniability on the existence of the encrypted filesystem. I know my desktop when using fglrx for my Radeon card presents just a black screen with a blinking underline cursor, and no character echo. That's pretty good, if only a side effect of something else.

Ideally I'd like it to throw up a Windows BSOD, while silently accepting the LUKS password. Then if someone gets it, or I am forced to boot it, I can go "oh snap, computer won't boot, sorry" or something like that.

Is this somehow possible? I know it's not a perfect deniable setup, but it should be sufficient to throw off most casual observers, like thieves, border customs, etc. Thanks for any suggestions!

ewaller

Administrator

From: Pasadena, CA

Registered: 2009-07-13

Posts: 20,287

Re: Obscuring LUKS password entry at boot?

but it should be sufficient to throw off most casual observers, like thieves, border customs, etc. Thanks for any suggestions!

I understand what you are trying to do, and it makes sense.  Sadly, I've no suggestions.  My only comment is that you should never underestimate your adversaries.  The two  you quoted are not idiots, are persistent, and have significant resources at their disposal.

---

Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
Sometimes it is the people no one can imagine anything of who do the things no one can imagine. -- Alan Turing
---
How to Ask Questions the Smart Way

bstaletic

Member

Registered: 2014-02-02

Posts: 658

Re: Obscuring LUKS password entry at boot?

Won't BSOD just make one pull out a removable bootable media?

---

My dotfiles

dice

Member

From: Germany

Registered: 2014-02-10

Posts: 413

Re: Obscuring LUKS password entry at boot?

Especially border customs would get suspicious. They might think the computer doesn't boot because you have removed important components in order to smuggle something...
Despite that, this is a nice idea. But I have no idea how to set it up.
I once used a fake BSOD as my screen locker, until ....Friend: 'Hey you had an error so I powered off your machine to avoid damage', Me: 'Well, thanks...'

---

I put at button on it. Yes. I wish to press it, but I'm not sure what will happen if I do.  (Gune | Titan A.E.)

bleach

Member

Registered: 2013-07-26

Posts: 264

Re: Obscuring LUKS password entry at boot?

you could have a partition with root and a lite dm/wm that can access the internet and every thing and make your boot loader not show and make that root the default. when you want your encrypted part you just push arrow really fast and at the right time. all that is null though upon closer inspection of the partions. it should only take a few gigs. for border customs and such you could just prepare for it and make it default during that time and thats just for inition inspection not indepth. for theft encryption is ussually enough for your data. for thieves good practices and your sorrounding(use your computer with you back to a wall) is good to know and make sure your not connecting to fake hotspots or anything etc.

Last edited by bleach (2015-07-10 23:01:00)

frostschutz

Member

Registered: 2013-11-15

Posts: 1,475

Re: Obscuring LUKS password entry at boot?

You could install Windows. Then the PC would boot Windows. To make it look convincing you could set it up with fake browser bookmarks and mails and other tidbits that would make people happy who are trying to snoop your privacy.  Maybe create a Steam account and invest a dollar in an indie game or two (or get a Humble Bundle that also lets you play them in Linux). Anything so the system appears to be in use and looks natural to the casual observer. It will be as convincing as you make it, until someone notices the hard disk is a bit small ...

And then use a USB stick to boot Linux. As long as the USB stick has FAT32 on the first partition, it will look like a normal data stick when you put it in a Windows machine, so you should put some innocent files on that as well. Few people think to try booting off every stick ...

rklingsten

Member

Registered: 2009-07-31

Posts: 29

Re: Obscuring LUKS password entry at boot?

Won't BSOD just make one pull out a removable bootable media?

Sure but then it's still encrypted. If you're some punk that stole it from my bag at the library, good luck. If you're some government agency and insist you need to see it or else, well, I'll open it up rather than go to jail.

rklingsten

Member

Registered: 2009-07-31

Posts: 29

Re: Obscuring LUKS password entry at boot?

You could install Windows. Then the PC would boot Windows. To make it look convincing you could set it up with fake browser bookmarks and mails and other tidbits that would make people happy who are trying to snoop your privacy.  Maybe create a Steam account and invest a dollar in an indie game or two (or get a Humble Bundle that also lets you play them in Linux). Anything so the system appears to be in use and looks natural to the casual observer. It will be as convincing as you make it, until someone notices the hard disk is a bit small ...

And then use a USB stick to boot Linux. As long as the USB stick has FAT32 on the first partition, it will look like a normal data stick when you put it in a Windows machine, so you should put some innocent files on that as well. Few people think to try booting off every stick ...

All good ideas, thanks for that. I was hoping to keep it super simple. After all, I don't really have anything to hide. I'd just rather keep private stuff private, like financial records & tax stuff, backups of important papers like birth certs and ssn cards, records of how much gold and silver coins I have in that safe deposit box and where it is, naked pix of the wife, all that sort of stuff.

I guess it's safe enough if someone steals it, and just leave it at home if going out of the country. Take a Chromebook or something instead. I can VPN into home if I am desperate for something.

Thanks all for the replies!

Last edited by rklingsten (2015-07-11 22:49:25)

tsh

Member

From: Munich

Registered: 2014-07-25

Posts: 41

Website

Re: Obscuring LUKS password entry at boot?

If you are using UEFI and have windows installed, you could setup the UEFI to boot by default into Windows.  When you want to boot into Arch, you interrupt the UEFI boot order and select the corresponding bootloader. This way you don't have to worry about carrying a USB stick.

Silkworm205

Member

From: UK

Registered: 2012-05-21

Posts: 267

Re: Obscuring LUKS password entry at boot?

Reading this thread, all I thought of was this XKCD strip.
Trying to give some useful feeback though, would it be possible to have the prompt point to a null font? Or have the text colour the same as the background colour for that matter? I remember back when I set up Open Suse I had LUKS enabled, and that had some kind of background enabled. With a bit of tweaking it should be possible to perform your BSOD idea. That was a few years ago now though, and as it was configured by the installer, I have no idea what settings they provided.
Edit: A quick search makes me think it was a Plymouth theme that it hooked into for a background.

Last edited by Silkworm205 (2015-07-31 11:05:02)

---

I think I know enough to know I don't know enough.

Leonid.I

Member

From: Aethyr

Registered: 2009-03-22

Posts: 999

Re: Obscuring LUKS password entry at boot?

You could install Windows. Then the PC would boot Windows. To make it look convincing you could set it up with fake browser bookmarks and mails and other tidbits that would make people happy who are trying to snoop your privacy.  Maybe create a Steam account and invest a dollar in an indie game or two (or get a Humble Bundle that also lets you play them in Linux). Anything so the system appears to be in use and looks natural to the casual observer. It will be as convincing as you make it, until someone notices the hard disk is a bit small ...

And then use a USB stick to boot Linux. As long as the USB stick has FAT32 on the first partition, it will look like a normal data stick when you put it in a Windows machine, so you should put some innocent files on that as well. Few people think to try booting off every stick ...

All good ideas, thanks for that. I was hoping to keep it super simple. After all, I don't really have anything to hide. I'd just rather keep private stuff private, like financial records & tax stuff, backups of important papers like birth certs and ssn cards, records of how much gold and silver coins I have in that safe deposit box and where it is, naked pix of the wife, all that sort of stuff.

I guess it's safe enough if someone steals it, and just leave it at home if going out of the country. Take a Chromebook or something instead. I can VPN into home if I am desperate for something.

Thanks all for the replies!

None of this is a good idea. Yes, you can patch cryptsetup to present whatever .png you specify (like grub2 does), but anyone who is _mildly_ interested in your data will boot from their own media and use an unpatched cryptsetup version.

---

Arch Linux is more than just GNU/Linux -- it's an adventure
pkill -9 systemd

clfarron4

Member

From: London, UK

Registered: 2013-06-28

Posts: 2,163

Website

Re: Obscuring LUKS password entry at boot?

None of this is a good idea. Yes, you can patch cryptsetup to present whatever .png you specify (like grub2 does), but anyone who is _mildly_ interested in your data will boot from their own media and use an unpatched cryptsetup version.

I'm gonna have to side with Leonid.I on this one. Whilst you can do whatever you like with the setup on your local machine with regards to cryptsetup (I maintain the cryptsetup-nuke-keys package, so I'm aware of changing the output when the "nuke" passphrase is entered), any party with a little bit more sense and caution that wants your information could feasibly use a LiveCD to work around the quirk of a splash screen.

Also, Silkworm205's reference to rubberhose cryptography is actually a thing, depending on where you are in the world. The Plymouth idea isn't a half-bad idea though, if you can get it to work consistently.

Last edited by clfarron4 (2015-07-31 20:03:32)

---

Claire is fine.
Problems? I have dysgraphia, so clear and concise please.
My public GPG key for package signing
My x86_64 package repository