← Back to context

Comment by rock_artist

15 hours ago

For non-graphene users (eg. Boring iPhone people like me).

So there’s a feature called Duress PIN which as explained through some comments means you put a different pin which intentionally wipes the phone. It’s not auto wipe or wipe after several failed attempts but intentional wipe of device. (Worth explanation as the current title nor the article doesn't easily explain this was made by the US citizen providing the alternative passcode)

For more technical details:

> GrapheneOS provides users with the ability to set a duress PIN/Password that will irreversibly wipe the device (along with any installed eSIMs) once entered anywhere where the device credentials are requested (on the lockscreen, along with any such prompt in the OS).

https://grapheneos.org/features#duress

24 comments

rock_artist

Reply
f-serif  14 hours ago

PIN to wipe seems suspicious. How about a PIN where it login to a patriotic profile and phone looks like normal android.

  • MrDisposable  12 hours ago

    This is exactly my setup with GrapheneOS. The default / main profile is patriotic, with a sterilized Telegram account, state-adjacent banks and apps, etc. The second profile (that uses a separate PIN) is not so patriotic: it has foreign bank apps, crypto apps, password manager, 2FA app, personal records, and an alternate Telegram account that I use to discuss any potentially unpatriotic topics with potentially unpatriotic people.

    • antihero  8 hours ago

      It would be cool if there's a third PIN that can wipe the unpatriotic profile whilst showing the patriotic one.

      So you use 1st pin for normal use, 2nd for downloading your flight details on patriot mode, and 3rd for unlocking to patriot mode whilst silently nuking unpatriotic data.

      Or a PIN that just nukes the data for certain apps (Signal, Telegram, WhatsApp, E-mail) etc. Feds can read my Slack messages all day.

      2 replies →

    • antihero  9 hours ago

      It would be cool if there's a third PIN that can wipe the unpatriotic profile whilst showing the patriotic one.

      So you use 1st pin for normal use, 2nd for downloading your flight details on patriot mode, and 3rd for unlocking to patriot mode whilst silently nuking unpatriotic data in case of seizure.

    • dMnFCX  9 hours ago

      It's absurd that you have to do this and/or be so careful. But if you live in Russia, China, or another dictatorship, then I understand.

      1 reply →

  • microtonal  11 hours ago

    This is extremely hard to implement in a non-superficial way that would be hard to detect.

    Android switched from block device encryption to filesystem-based encryption (with encryption data and metadata). This provides many security improvements, such as per-file encryption keys and per-profile keys.

    However, this also means that the main file system is readable and you could enumerate the available users. If you would encrypt/obscure that information, you could still infer the presence of other profiles from file system block allocations.

    (Disclaimer: not an expert, but I read the relevant Android docs at some point.)

  • nurumaik  10 hours ago

    And wipes the main partition in the background at the same time

    Also too patriotic is sus. Better to keep some minor offenses (that give you a fine or a week of jail at most) on that partition so they will think that this is the thing that made you so nervous during the search

zugi  14 hours ago

That's a nice feature, every OS should have that.

I believe the old TrueCrypt had two passwords, each revealing a different set of files. You'd put e.g. your tax forms in one, so if forced to decrypt your drive, you could cooperate and do so.

It's not illegal to delete your own vacation photos. So to prove this guy guilty of destruction of evidence, does the government need to prove there was actual evidence in the phone?