Comment by patcon
3 hours ago
I used to play around on projects adjacent to Tor and TailsOS, and had an idea for a setup I was researching. It's a little intense and probably has annoying failure modes, but sharing in case anyone else finds it helpful:
- Tasker is an automation app for setting up rules for triggers and actions. It allows extension apps to be created to add new triggers and actions.
- someone at one point made an extension to add an action for wiping or factory resetting when triggered
- there was an existing extension (or core feature) to trigger when certain signals are lost or found (e.g., wifi signals, Bluetooth LE beacons, etc)
So the idea is to carry a BLE beacon (any "item tracking" one works) on your keychain, and an unassuming faraday cage pocket alongside it. If you want to wipe your phone, slip the fob into the pocket, the signal disappears, and your phone wipes. And if you don't have the keychain on you, just refuse to open it right away, as when they put the phone itself in a faraday cage (to prevent it from being remote wiped), they cause the signal to be lost, and it gets reset.
Not sure if all the pieces still exist (I dont think the tasker extension for wiping existed outside a forum post...)
Or keep it in a faraday bag and have the phone wipe if it sees it. If you're ever searched (or otherwise indisposed), they'll open the bag and wipe your phone for you.
Oh hey, I like this variant! So... both the BLE beacon and the phone have a faraday cage, and if they ever appear together outside their cages, the phone wipes?
Perhaps less likely to go wrong than my original proposal when living normal life, as it might wipe if the BLE signal randomly gets lost.
It would be nicer if you could leave phone in cage during security, and remove beacon while loading airport trays ("remove all electronics from their cases..."). the only chance for a failure mode is only when you're going through security, and have the fob outside its case..
But you'd need to be able to leave your phone in the faraday cage pouch while going thru security, which is only ok if they don't notice... (maybe they commonly don't notice small faraday pouches aren't empty... Maybe they wouldn't if you had a secondary mobile device...)
I was imagining only the BLE beacon living in one of those little faraday pouches people put their key fobs in. They should be pretty much transparent passing through the x-ray and a pouch with an airtag in it wouldn't raise any suspicion at all at the airport.
Only once you're getting invasively searched would they (ideally) dump the pouch out into the tray with your phone.
This depends on the beacon being visible. If they just take the phone and walk away, because that's where they think the evidence is, it won't wipe.
When I've gotten secondary screening the first thing they do is take all my belongings and rifle through them on a table. That seems to be standard practice and I'm sure it was step 1 in Tunick's ordeal.
Both approaches have situations they wouldn't work in. If you're extra paranoid you could do both.
> If you're ever searched (or otherwise indisposed), they'll open the bag and wipe your phone for you.
Isn't that the same issue here that resulted in felony charges? Border agent was given a duress PIN and wiped the phone for the owner. Now owner is charged.
It's not the exact same situation. Whether it's similar enough to be prosecuted or convicted is a different question.
I don't see how. Regardless of how you feel about the lawfulness of the overall situation, Tunick gave an agent false information which resulted in the phone being wiped. That's intent.
This requires no action whatsoever from the phone's owner, you could even be unconscious/dead and it would still work.
2 replies →
I like the idea of a phone that automatically wipes itself if I don’t act to stop it. I wonder about the legality of that if the duress code is considered “destroying evidence.”
Action vs inaction seems like an important distinction.
I used to contribute to this https://en.wikipedia.org/wiki/USBKill
Ah I recall I used to see the creator around :) thanks for your work!
Regarding the motivation for usbkill mentioned in the article: I too was motivated to think on this stuff in relation to my sense of injustice around Ross Ulbrecht, and wanting to think of some way that someone in his position could avoid getting caught. One creative variant in my thinking involved embedding the BLE beacon inside a rubber ball that could be launched and lost track of. Or maybe embedded in heel of a shoe and ditched in transit haha
With no third party apps you can set an iPhone to wipe itself after 10 failed passcode attempts.
US law enforcement is well aware of it.
They're also now well aware of the GrapheneOS duress PIN/password feature. It was designed to work against an attacker aware of it by acting as a deterrence. If they're aware of the feature, it discourages them from trying to coerce a PIN/password and attempt to unlock with it. We aren't fond of features depending on an attacker being unaware of them and this isn't one of those.
Pixels have a high quality secure element enforcing a maximum of 20 unique attempts to derive the encryption keys for each separately encrypted profile. There's also very aggressive rate limiting between the attempts. It filters out duplicate attempts by temporarily remembering the previous 5 unique attempts to make the rate limiting more usable. A misremembered PIN/password repeatedly entered over and over will only use up 1 attempt.
Android does have standard support for enabling wiping after N attempts and an open source app can be used to set a configurable limit rather than specifically after 10.
tfw face when I leave my phone on the table and go to the restaurant bathroom only to return to a brand new squeaky clean factory reset