Self-destruction feature

x_arrange

Hi all sorry if this one was previously discussed (although didnt find any)
Woudn't it be wonderful to have the feature of "special unlock" pin which can be configured to either one of or all of:

wipe all data
wipe some apps
wipe some photos
Same for fingerprint - one fo fingers can do things above

argante

x_arrange See what duress password is.

BaronAfanas

x_arrange Not the fingerprint thing. Have unlocked a device several times when fumbling in my pants. One with the fingerprint reader on a side button, but nevertheless.

tV0gr

Thought I have not used any of these yet, I think most of this could be done by a MDM running a custom script when certain conditions are met. You might be interested in this thread, for example.

final

Duress password is already a feature in GrapheneOS, using it erases the entire device.

There isn't any plans to expand it currently, and if it was it would be a low priority.

freezet

GrapheneOS own device should feature self destruction hardware xD

angela

This idea is for a duress pin that also has plausible deniability. For instance currently the duress pin could be seen as destruction, which could lead a government to enact punishment. A plausibly deniable duress pin woukd let someone look like they have a normal phone but have most important data gone.

Ie "unlock the phone or else!"
Partial wipe pin "####"
Result: It looks fine, you can go on your way.

Versus "unlock the phone or else"
Full duress pin "####"
Result: Why isn't it loading? This is suspicious. You are not able to leave!

I don't think it will be added because the duress pin was already really hard to code probably and they have other priorities. Most likely the developers would respond that it would not protect against forensic analysis which woukd be correct, but it would still be nice to partially wipe in case of a stupid but aggressive adversary that can be easily fooled.

Anither problem is if a partial duress pin were implemented, then it would become known and aggressors would be less likely to be fooled.

freezet

angela sounds like a duress password to delete a specific profile would be best

area51

my use of the duress password differs from everyone here.
for me the duress password is not for giving to an adversary to type into my phone whilst I watch them stare at the phone going through the reset procedure. They are then aware what has happened and react accordingly.
Its for me, whenever I feel threatened etc, to input to destroy my data prior to the phone being taken from me, it saves me having to input my normal password, navigate to settings - system - reset options - erase all data. A simple straight forward six digit pin and its all over before they ask for my phone.
if you need a self destruct feature... use a club hammer, from personal experience, its very effective.

ejns

area51 It seems like this would get the same reaction from whoever is demanding you to hand over your phone. If I were the authority and you handed me a device with essentially nothing on it, I'd get suspicious, just the same as if I were to watch the phone erase itself after I had unknowingly entered your duress password.

This is why I haven't bothered to set it up. I can't really think of a use for it that wouldn't make things worse for me. That said, I have a pretty neutral threat model and don't have anything on my phone that would get me in trouble in the first place, so I can't speak to its value for someone who does.

thmf

ejns I can't really think of a use for it that wouldn't make things worse for me

If someone is detained and LE looks behind their phone case and accidentally finds a PIN on a piece of paper and tries it, then the aforementioned person is not in any trouble. It's a good benefit, especially compared to no benefits. And it's the only way to do it in instant, uninterruptible, and truly secure way.