Incomplete plausible deniability feature for Cwtch app profiles #544

New Issue

nihilist · 2024-01-17T10:47:39Z

nihilist commented

2024-01-17 10:47:39 +00:00

Hello,

I see the cwtch application has been designed around plausible deniability, hence you're supposed to deny the existance of a profile by requiring to type a password to reveal the existance of a profile initially, after a cwtch app shutdown.

However i see that the application creates separate files that clearly shows that there are 2 different profiles in the ~/.cwtch/profiles/ directory.

Threat model: an adversary captures someone's phone in a public protest, and the individual is forced to give passwords, the adversary browses the local files of the application on the phone / laptop. There, the user gives the password to the decoy profile, but the adversary browses the local files and now finds the ~/.cwtch/profiles directory which reveals the existance of the second profile.

I feel like this needs to be adressed, the existance of profiles must be completely deniable, like veracrypt hidden partitions

Hello, I see the cwtch application has been designed around plausible deniability, hence you're supposed to deny the existance of a profile by requiring to type a password to reveal the existance of a profile initially, after a cwtch app shutdown. However i see that the application creates separate files that clearly shows that there are 2 different profiles in the ~/.cwtch/profiles/ directory. Threat model: an adversary captures someone's phone in a public protest, and the individual is forced to give passwords, the adversary browses the local files of the application on the phone / laptop. There, the user gives the password to the decoy profile, but the adversary browses the local files and now finds the ~/.cwtch/profiles directory which reveals the existance of the second profile. I feel like this needs to be adressed, the existance of profiles must be completely deniable, like veracrypt hidden partitions

Sign in to join this conversation.