A possible idea about 2nd factor - Is this realistic?

JayJay

Of course everything is realistic. Just brainstorming here.

I was thinking about my car, it has an antitheft card as a second factor which I keep in my pocket/jacket.
If the card is not close to the car it would not be possible to start it at all regardless of the key. It needs both the card+key to start.

So I thought why isnt this something that could also be used for the phones we use daily? Depending on your threatlevel, specially if the phone is being snatched away while you are using it by cops, or by a sudden raid middle of night. If the phone is not close to the key/card it would just automatically power itself off. Starting it would reach BFU mode.
Possible connection method would be Airtag/Bluetooth although BT requires battery power so the card can be recharged as required.

It should allow for a limited but good range to allow you to move freely at least around your home (10-20m).
If signal is lost and not reconnected within 60 seconds phone would just switch itself off without alert.

Turning on airplane mode would disable BT/NFC too so it would power itself off.
Putting the phone straight into a faraday cage would disconnect it and power itself off too.
If anyone would steal your phone it would power itself off too as its moving away from you.
Moving the phone away from the owner at any scenario would disconnect it too and it would also then power itself off.

You need to always carry the keycard, but the inconvenience is very small. I think it's a brilliant idea :)
You have 60 seconds to pair your card after powering the phone and entering your password or it would turn itself off again.

Of course I have not thought out all details yet but just wanted to brainstorm the idea and hear what you people have to say.

Discussion:
Do you like or dislike the idea?
Any loopholes?
Anything forgotten?
Does it provide a false sense of security?
Would having this enabled drain the battery?
Airtag/BT is just example. Which connection method would be preferred in this situation?

flighty_sloth

JayJay

I think it could be realistic protection for a snatch and grab, but if it was an organization like police, I think they follow security/privacy features and would probably quickly learn of the feature and would be sure to take the card too when they are confiscating a phone. That's my thoughts.

Ammako

flighty_sloth what if the person they're seizing the phone from doesn't even have that? I guess they could default to "arrest and jail just in case they have this card"

flighty_sloth

Ammako I don't understand what you mean. I just mean if they are seizing the phone they may learn to also investigate/search for this card too so that they can seize it with the phone. Maybe they could even develop equipment to detect the technology since it works off radio waves.

Ammako

flighty_sloth what I'm saying is that the antitheft card would be optional, therefore:

Police seizes phone, they demand you hand over antitheft card. Let's say you dont even have one, so you tell them, "I dont have one."

At that point police has to decide whether it's true, or you're lying. Someone who has an antitheft card like this could easily just lie about it.

So in the end, either you can just lie about it so they don't take it, or police defaults to just bringing you in and jailing you just in case you have one.

If the assumption is that they'd perform a search for it, it's easy to hide it on your person or disguise it in some way. So either they take your word for it that you don't have one, or they default to stripping people down and taking them in for investigation if they can't find the card (including if the person doesn't even have one, in the first place. What happens then? Do they keep you indefinitely on the off chance you're lying about not having one?)

flighty_sloth

Ammako I think how this discussion goes depends entirely on the laws of the country. In many countries the police couldn't necessarily arrest/hold someone just because they suspect there might be a card.

JayJay

The point here is to ensure that the phone is being automatic switched off once its not near the card.
Wether they find the card later doesn't matter as phone is ensured to be in bfu mode and your trust now goes to the secure element/your key.

Any live extraction will no longer be possible as what they do is, they snatch the phone puts it in airplane mode and take live photographs of the screen.
A function like this will make this impossible to do as disconnecting the phone from the keycard will power it off automatically.

If the police continues their raid and finds the card later it won't make any difference as we have secured it to be in bfu mode right away.

This is a good option that would work great with the built in autoreboot function. With the autoreboot we can set it to 1 hour. With the keycard it will be an instant shutdown once separated.

mmmm

The police/LE would demand the card. Thats just that. I can't see how a physical card could be any protection from them. Perhaps a snatch and grab fairs better. But I can't help but wonder if your threat model is that great then the 10 minute auto reboot is more effective, potentially stealthier and doesn't demand remembering a second factor to be with you.

I do believe your solution is to a problem thats already been solved.