[Cryptography] Rubber-hose resistance?

[Matt Palmer]

On Tue, Dec 19, 2017 at 10:54:26PM -0600, Nico Williams wrote:
> On Wed, Dec 20, 2017 at 01:49:28AM +0000, Peter Gutmann wrote:
> > Howard Chu <hyc at symas.com> writes:
> > >Peter Gutmann wrote:
> > >> I cross borders with a wiped-clean laptop and scp in anything
> > >> work-related that I need once I get there.  That seems to be a common strategy
> > >> among IT-savvy travellers who are worried about travelling with
> > >> NDA'd/commercially sensitive material.
> > >
> > >I do this too. But just out of curiosity, what do you use for ssh credentials
> > >when traveling?
> > 
> > A password.  That's the one thing that's completely deniable (when it's used,
> > as in this case, to scp something over from some random server at some random
> > IP address).
> 
> +1.
> 
> How are they even to know where you'll remote to?

If your threat model is purely disclosure at the (immigration) border, this
works fine.  If you also need to protect against disclosure at the
(network) border once you're in-country, well, they'll figure out where
you're connecting to quickly enough...

And, of course, as was pointed out, if your threat model includes physical
modification of the device at the border, all bets are off.

- Matt