FractalCrypt 2.0
Security and privacy
deniable encryption
SHOW HN2021
How HN took it
1 positive, 14 neutral or asking, 1 mixed, 18 critical, out of 34 comments about the project. Thread score -0.42.
Privacy: 0 for, 12 againstIdea: 1 for, 5 againstDocs: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Multiple hidden layers can give deniability beyond TrueCrypt's single hidden volume
From 1 comment
This article is about the problem of using TrueCrypt, which allows you to create a single hidden layer; In case TrueCrypt usage is detected, the requirement to give out the…
zorggish on HN
Objections
Multi-snapshot and write-pattern attacks can reveal hidden data size
From 2 comments
This works like TrueCrypt hidden volumes, which are volumes created in the free space of volumes. This is not secure against multi-snapshot adversaries, like those who can take…
Comevius on HN> The capability of plausible deniability is that the encrypted file is indistinguishable from noise; There is no way you can find out the amount of data stored in the…
cdumler on HN
Interrogators can torture indefinitely; deniability fails under duress
From 3 comments
So... assuming there are bad guys demanding access to your data and you say "oh yes, I've been using this plausible deniability encryption/archive format", chances are that…
akx on HN> until they get the data they want. The game theory here is interesting. If they are sure that you have the information (for example, the private key to your bitcoin wallet)…
dane-pgp on HNOld but relevant https://defuse.ca/truecrypt-plausible-deniability-useless-by-game-theory.htm .Be careful with plausible deniability depending on your threat model as it's only…
anonypla on HN
Mentioning FractalCrypt in the app reveals its use and undermines deniability
From 3 comments
The app literally says "Welcome to FractalCrypt!" when you open it. Not only revealing the encryption format name, but clearly hinting to how it works. I'd much prefer an…
flixic on HN> Whereas, using FractalCrypt you can safely give away the keys to unclassified volumes, and there is no way to prove that there are actually more volumes than you have…
bb88 on HNCan’t the attacker just see that FractalCrypt is installed, read the same Readme, and ask for the 2nd key?
hartator on HN
No security analysis or threat model documented
From 1 comment
Not a word about security analysis, threat model, etc. That's not how a security tool your life could depend on is presented these days. Also, is it a coincidence that the "Made…
ComodoHacker on HN
Requests
Allow user-set fixed container size unrelated to payload
From 1 comment
To expand on your second point, these kinds of systems should let you set the fixed-size of the volume, like 1G or 5G, with the payload being unrelated.
moritonal on HN
Encode offset and size parameters in the key
From 1 comment
> First, it creates a cryptocontainer of a user-specified size, filled with random characters. To create the first volume, the program archives the user-specified files to the…
3np on HN
Look-alike container format such as zip for cover
From 2 comments
In countries like the UK where you can be jailed or fined for not giving a password, this provides a way to do that and escape jail. Truecrypt did it and after the developers…
davidhbolton on HNUnless the functionality is supported in common software like zip the mere fact of one using it can be a clue.
FpUser on HN
Questions
Can use of FractalCrypt be detected from the file?
From 1 comment
Can it be detected that you are using fractalcrypt archive type?
m3kw9 on HN
Is the output a standard ZIP file?
From 1 comment
For one, it's not clear that this tool creates standard .ZIP files, so the bad guys using an off-the-shelf `unzip` tool would probably suspect things. If the tool does create…
akx on HN
Alternatives named
TrueCrypt and VeraCrypt hidden volumes
From 2 comments
Yeah, TrueCrypt or VeraCrypt are widespread enough right now and most people are just using them in normal, non-deniable form, so it seems like better cover currently.
arsome on HNExactly this. In True/VeraCrypt, there’s only the possibility of having two keys, the main and hidden one. Just the existence of this feature places everyone using the software…
orev on HN
LUKS with offsets
From 1 comment
for use within linux I wouldn't trust anything but luks. speaking of luks, it can theoretically accomplish this with offsets and payload align, but I'm not sure I'd trust it not…
tifadg1 on HN
Steganography
From 1 comment
I am not an expert in encryption or plausible deniability, but couldn't steganography be used to conceal sensitive information? I realize steganography would be problematic if…
inetsee on HN