But while states realistically can crack most anything it doesn't mean they can crack *every*thing. There are simply too many flash drives crossing the border every day.
But there is a big flaw I see: 8gb. You're carting around an 8gb flash drive these days??
They pay other people to notice this stuff for them!
1: Reads/Writes are just routed to a COTS SD-card. 2: Unless the (correct?) password is detected in the write-data that starts the disconnect procedure.
The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, only works if the CPU cost is large enough to overtake the SD-card measurably and some constant-time optimizations should make it more or less undetectable.
It's a clever design and I think it should be possible to optimize to become more or less unrecognizable.
Money, even at state level, is not some infinite resource (and neither is time).
States put effort into what they consider worth investigating - no state strip searches every incoming traveller, and goes through every item in their possession - it's possible for them to do, and if they did they'd find a hang of a lot more contraband, but it's costly, time consuming, and politically risky.
If the idea is that there's no point in encrypting anything on a USB stick, and you just hope they don't look at it at all, sure.
But there is no threat model here that includes "check the USB stick" and does not automatically lead to finding and breaking "hidden" content.
Lavabit would like to enter the conversation.
That's not the actual story (like, that happened, but all it did was provoke the DOJ), but it's remarkable to see someone cite that as a success for Levison.
You will miss your government's incompetence when they start rectifying these failures. I know I do.
They are the tyrants who oppress us with a clean conscience. They never rest and have infinite money. Their occasional episodes of bumbling incompetence is the only respite, but those won't last. Especially now with AI to think for them.
I guess it's human nature to build the Torment Nexus.
Just to say, I know what you mean.
The state-level threat isn't just about the direct employees' competence. They also have the funding to purchase tools made by people who really know what they are doing. Think of things like Pegasus spyware or Darksword iPhone hacking.
I can believe that a keystone cop wouldn't know the difference between a bong and a flower vase, but border crossing guards will know a USB drive when they see one and pass a copy of it to someone who knows what they are doing.
https://prodefence.io/news/pegasus-spyware-operating-costs-c...
There is a world of difference if you get searched by your local police and a country level agency.
There are military units dealing with forensic investigations they have 100x or 1000x more budget and much smarter people.
But they don’t care about some drug dealers. They don’t waste time on silly stuff.
If you're intercepted with anything of value what you want is to rapidly destroy it.
This was the big problem I found when I was trying to figure out a secure way use Yubikeys: they're both long term unreliable, and short term impossible to wipe or destroy fast enough.
Literally a printout of 1 time passwords has better security properties in an adversarial situation.
For a storage device what you want isn't a secure store, what you want is a pin pull or switch which wipes it instantly.