[HN Gopher] Show HN: Tripwire: A new anti evil maid defense
       ___________________________________________________________________
        
       Show HN: Tripwire: A new anti evil maid defense
        
       If you have heard of
       [Haven](https://github.com/guardianproject/haven), then Tripwire
       fills in the void for a robust anti evil maid solution after Haven
       went dormant.  The GitHub repo describes both the concept and the
       setup process in great details. For a quick overview, read up to
       the demo video.  There is also a presentation of Tripwire available
       on the Counter Surveil podcast:
       https://www.youtube.com/watch?v=s-wPrOTm5qo
        
       Author : DoctorFreeman
       Score  : 68 points
       Date   : 2025-12-11 09:46 UTC (1 days ago)
        
 (HTM) web link (github.com)
 (TXT) w3m dump (github.com)
        
       | sandworm101 wrote:
       | This isnt a tripwire. This is a canary. You have to actively
       | check a canary. A tripwire would send notifications in real time
       | without the user needing to check.
       | 
       | An evolution of this would be to put a server on a different
       | network, a remote location, and have it pump out warnings the
       | moment movement was detected and/or contact with the "tripwire"
       | system was lost.
       | 
       | But the best way of preventing evil maid attacks remains knowing
       | your hardware. Anyone trying to swap out my laptop, or open it,
       | is going to have a problem replicating my scratch marks, my non-
       | standard OS boot screen, or prying out the glue holding in the
       | ram modules (to prevent cold boot attacks).
        
         | ramses0 wrote:
         | I was sure I'd made a comment like this before, but I'd love
         | some sort of home-spun setup like this:
         | https://news.ycombinator.com/item?id=2465687 ...hood, tuck,
         | john. (2x local, 1x remote) which constantly rotated roles as
         | to who was primary/secondary.
         | 
         | Basically core "chaos-infra" for your home setup(s). Hood/Tuck
         | switch between primary and secondary, always trying to stay in
         | touch with "John" (offsite), maybe like a primitive etcd for
         | home automation/monitoring/backup/file-serving. Green==3good,
         | Yellow=degraded[local|remote], Red=single-point-of-failure,
         | Black=off/not-serving.
         | 
         | Other funsie to think about is getting a thumbprint/PIN-locked
         | USB-drive to hold/unlock `~/.passwordstore/*.gpg` so that even
         | on power-outage/reboot you'd need to physically "re-auth" to
         | unlock important secrets.
         | 
         | Something like this would fit nicely into this (imaginary)
         | setup!
        
           | sandworm101 wrote:
           | I had a professor once ask about the strip of duct tape
           | across the back of my brand new laptop. "Well, thieves cannot
           | pawn electronics with cracked cases. So all my laptops have
           | at least some tape so they think it may be cracked." The next
           | lecture, the prof had a strip of masking tape on his laptop
           | too.
           | 
           | But slap a tux logo and an "i l9ve truecrypt" banner on you
           | device and nobody short of the NSA would even attempt a maid
           | attack.
        
             | gruez wrote:
             | >Well, thieves cannot pawn electronics with cracked cases
             | 
             | Can't, or they'll get less money? I'm also not sure if I
             | ever saw a laptop with a cracked case before, not to
             | mention macbooks are the most recognizable and can't have
             | cracked cases (because they're aluminum), and other laptops
             | aren't worth stealing because their value drops sharply.
             | 
             | >But slap a tux logo and an "i l9ve truecrypt" banner on
             | you device and nobody short of the NSA would even attempt a
             | maid attack.
             | 
             | truecrypt is actually very susceptible to evil maid attacks
             | because it doesn't use secureboot/tpm, which means all a
             | baddie has to do is installed a backdoored version of
             | truecrypt and wait for you to enter the password.
        
               | sandworm101 wrote:
               | The stickers are just a statement that the owner is
               | privacy aware. And, physically, stickers are hard to
               | replicate quickly, preventing simple swapping of
               | hardware. A clean iPad that looks brand new is
               | indistinguishable from any other ipad that the maid can
               | swap in.
        
         | hurturue wrote:
         | new CPUs have built in memory encryption with random key.
         | activate it for an additional layer on top of your glue
         | 
         | it's called TSME on AMD
        
           | justincormack wrote:
           | Or "memory guard". Its only available on "Pro" CPUs though,
           | not all of them.
        
         | mlyle wrote:
         | > A tripwire would send notifications in real time without the
         | user needing to check.
         | 
         | c.f.
         | 
         | > > If any motion is detected by RPi's camera module or motion
         | sensor, the server will delete those secrets immediately, in
         | addition to sending push notifications to the web client.
         | 
         | It sends notifications in real time _and_ tries to stay
         | irrevocably tripped.
        
       | voxadam wrote:
       | For a second I thought Tripwire, Inc.[0] had risen from the dead
       | with a new IDS.
       | 
       | [0] https://en.wikipedia.org/wiki/Tripwire_(company)
        
       | Eduard wrote:
       | I guess this is actually not an anti evil maid defense.
       | 
       | It's rather an anti evil maid tool, or an evil maid defense. :)
       | 
       | sorry for being pedantic, but with the arms race within
       | cybersecurity, "anti something defense" sounds like double
       | negation to me.
        
         | nine_k wrote:
         | I would call it "a defense against evil maid attacks" to avoid
         | any ambiguity.
        
       | bflesch wrote:
       | The bullet point stating that tripwire was built for "High-
       | ranking officials in businesses/organizations" should be removed,
       | because that group is very unlike the "Developers of critical
       | software", "Investigative journalists", and "Attorneys with high-
       | profile clients" which are also mentioned.
       | 
       | Everybody who had the pleasure to work with "high-ranking
       | officials in businesses/organizations" knows that this group is
       | the one who overrides many technically optimal decisions and
       | thinks internal policies do not apply to them. Their lives are
       | not affected if a device is compromised because they are
       | financially stable and can just blame an intrusion on the IT
       | team.
        
       | neuralkoi wrote:
       | The author did an excellent job explaining what an evil maid
       | attack is, but a very poor job of explaining how their proposal
       | mitigates such attack.
       | 
       | I think the classic "Detecting unauthorized physical access with
       | beans, lentils and colored rice" [0] approach is simpler to
       | understand and simpler to implement. It doesn't rely on any
       | hardware, such as a Raspberry Pi or otherwise technology which
       | can be more easily subject to scrutiny via Ken Thompson's
       | "Reflections on Trusting Trust".
       | 
       | [0] https://dys2p.com/en/2021-12-tamper-evident-protection.html
        
         | x187463 wrote:
         | That's cool. I hadn't heard of that, before. I had a related
         | idea for achieving plausible deniability of the key in full
         | disk encryption or similar scenarios. The password would be
         | derived from the position of sensitive, yet innocuous, elements
         | on the device, ensuring that the seizure of the device would
         | likely corrupt this relationship. For instance, a series of
         | N-sided dice could be placed in specific positions on top of
         | the device (in the case of a desktop computer, perhaps), and
         | the password derived from their sequence. Consideration must
         | also be given to the possibility of the device being
         | photographed--likely from a single angle--before being moved.
         | So, the dice would be positioned to include some amount of
         | occlusion. Any dice-based algorithm would need to ensure the
         | search space for the resulting key was sufficiently large.
        
         | IncreasePosts wrote:
         | With beans and colored rice, a smart evil maid will just wait
         | until they next earthquake to compromise your devices.
        
           | alias_neo wrote:
           | It's vacuum packed so movement such as that of an earthquake
           | would have no effect.
        
             | ignoramous wrote:
             | I'm surprised vaccum packing a Laptop with lentils/rice
             | doesn't crack its screen.
        
         | thenthenthen wrote:
         | Thanks for sharing again, I saw this at some point but lost the
         | reference, great technique, cheap, easy, fun. This is art
        
       | guerrilla wrote:
       | Just so you know, this name is already taken by a famous security
       | product for intrusion detection.
       | 
       | https://en.wikipedia.org/wiki/Tripwire_(company)
       | 
       | https://en.wikipedia.org/wiki/Open_Source_Tripwire
        
         | QuadmasterXLII wrote:
         | as well as https://en.wikipedia.org/wiki/Tripwire ;)
        
         | angry_octet wrote:
         | Agreed, it's pointlessly confusing to call it tripwire.
        
         | FuriouslyAdrift wrote:
         | Yep... first big project I worked on (as a baby intern). Spaff
         | is a legend.
        
       | pyrolistical wrote:
       | For high sec people, they should have an internal sec camera
       | system. They are have come down in price over time
        
         | kotaKat wrote:
         | I've slowly been working on building a Honeywell burglar alarm
         | panel (a Vista15P/20P) into part of a Pelican case for travel.
         | I can just stick up sensors where I need them temporarily (a
         | PIR, a glassbreak, a couple motions), and then use an ECP bus
         | decoder (like the old AlarmDecoder board[1]) to kick
         | notifications and alerts out where they need to go with an LTE-
         | connected miniPC/Pi.
         | 
         | When I need to secure an area (eg, vending at a convention at a
         | hotel, locking up the room with stock), I can just pop down the
         | Pelican, plug in the keypad (which doubles as the RF
         | transceiver), stick up sensors, and I'm off to the races.
         | 
         | [1] http://www.alarmdecoder.com/
        
       | friend99 wrote:
       | > NEVER PLUG/UNPLUG THE CAMERA MODULE, THE PIR SENSOR, OR WIRES
       | WHEN THE RPi IS POWERED ON!!!
       | 
       | Why?! Will it will trigger W.O.P.R. and start attempting to brute
       | force missile silo keys?
        
         | hulitu wrote:
         | It will trigger SW bugs.
        
       | Mistletoe wrote:
       | How does an evil maid get past a locked iPhone or laptop? It's
       | really not that easy with a proper password and encryption right?
        
         | seanhunter wrote:
         | The threat is them implanting some sort of device that sniffs
         | your password next time you type it. Then they come back at a
         | later date for the password and unlock your gadget.
        
       | seanhunter wrote:
       | This reminded me of the (real life) story of Oleg Gordievsky, the
       | FSB officer who was a double agent for the west[1]. He was
       | alerted to the fact that the FSB were on to him and had been in
       | his apartment because there were three locks on his front door
       | but he never locked one of them as he didn't have the key. He
       | came home one day to find all three were locked.
       | 
       | [1] read "The spy and the traitor" by Ben Mackintyre. It's
       | incredibly gripping and at times hard to believe the courage and
       | perseverance of the people involved but it was real.
        
         | MrBuddyCasino wrote:
         | And if that tickles your fancy, "Tinker Tailor Soldier Spy" [0]
         | is an excellent miniseries from 1979 about a mole in MI6,
         | perhaps the best spy series ever made. I didn't care about the
         | movie much, so don't let this deter you, but Alec Guiness as
         | George Smiley is a perfect match. John Le Carre thought so,
         | too.
         | 
         | Oh and Patrick Steward plays "Karla" the soviet mastermind in
         | this series and its successor "Smiley's People". Just a few
         | seconds, but very memorable, its incredible really.
         | 
         | [0] https://www.imdb.com/title/tt0080297/
        
           | buredoranna wrote:
           | "Smiley's People" remains one of my favorite shows.
           | 
           | If you track it down, I highly recommend watching it with
           | headphones. The sound design is amazing.
           | 
           | The sound of an empty room being profoundly menacing.
        
           | seanhunter wrote:
           | Wholeheartedly second that. Both series are amazing.
        
       | whalesalad wrote:
       | We used to put nail polish on all the screws/panels so that if
       | they were ever removed it was clear as day.
        
         | lukan wrote:
         | If you just have nail polish, can't an attacker just put on new
         | nail polish after removing all the previous one?
         | 
         | The first comment here
         | https://news.ycombinator.com/item?id=46244062 links to
         | something more elaborate with nail polish.
        
           | swores wrote:
           | The person you replied to didn't explain the full concept -
           | it's not just nail polish, it's nail polish with glitter in
           | to create a unique pattern that the attacker wouldn't be able
           | to replicate.
           | 
           | Unfortunately... I've seen a video of somebody defeating this
           | concept before, not by trying to recreate the pattern with
           | new nail polish and glitter, but by using a chemical (I can't
           | remember what) that lets them, gently and very carefully,
           | remove the whole layer of nail polish in one piece rather
           | than having to break it apart, and then afterwards they stuck
           | it back in place such that it looked identical. So it's not
           | as secure an idea as it's often considered to be.
           | 
           | Edit: actually my memory was slightly wrong. The video I was
           | remembering wasn't about defeating glitter in nail polish on
           | a screw, but about "tamper proof" stickers which are made for
           | the same purpose. I don't know for sure if nail polish could
           | equally be defeated, but I suspect so. Here's that video
           | (LockPickingLawyer defeating a tamper proof sticker):
           | https://youtube.com/watch?v=xUJtqvYDnkg&
        
       | Thorrez wrote:
       | Instead of deleting the secret on trip, and requiring a re-arm,
       | it could instead derive a new secret on trip, by e.g. hashing the
       | previous secret. That way you don't have to manually re-arm it,
       | and you get a record of all trips.
       | 
       | Say e.g. a bug walks in front of the camera, tripping it. Then 1
       | hour a later an evil maid comes in and tampers with the system.
       | In my design, you could look at the photo record, see that the
       | 1st trip was a false alarm, then continue looking at the data,
       | and see that the 2nd trip was something real.
       | 
       | Compared to with the current design, the bug would trip it, then
       | you would get no record of the actual evil maid. You would see
       | the photos of the bug tripping it, and think "oh, it's just a
       | false alarm, I don't need to worry", and trust the computer, even
       | though it's tampered with.
        
       | IshKebab wrote:
       | Fun project, but the chances that this is ever used successfully
       | are exactly zero.
        
       | nullbyte808 wrote:
       | Perfect addition to my Darknet traphouse!
        
       ___________________________________________________________________
       (page generated 2025-12-12 23:01 UTC)