Decoy Profile?

DeletedUser477

I live in Australia, and I am worried about police trying to get me to unlock my device. If you didn't know, Australian police have totalitarian power >> https://tuta.com/blog/australia-surveillance-bill

Now, if I refuse to unlock my device they would likely confiscate it and obtain a warrant to then unlock it.

So I am thinking, is the best way to deal with this to use the duress PIN to erase everything? Or perhaps have a dummy profile?

If you use the duress PIN when they have a warrant it's possible that you could get charged with years in prison for it under Aus laws. But I think if you erase it before they have warrant.. then I think it's okay.

Any advice on the situation? I am thinking mainly for protests.

DeletedUser370

DeletedUser477 Or perhaps have a dummy profile?

I found this official response on the topic: https://discuss.grapheneos.org/d/12901-best-way-to-defend-against-this/9

DeletedUser313

DeletedUser477

So the phone must hide the other profiles for this to work then. If they restart the phone, will they be able to see the other users?

DollyRags

You might as well just enter the duress PIN and say it was an automated wipe, unless the logs prove otherwise

LunaticBuzz

I have thought about this myself, as well (another Aussie here).

I heard somewhere that someone's approach to this was to set the Duress PIN to be something utterly basic, like DoB YYYMMDD (eg of self or spouse or child etc), so that when you "can't remember it because you are feeling so stressed, harassed and freaked out that my mind is a blank", they themselves will wipe it by trying to open it using a brute force approach. As long as the duress PIN is shorter than the actual, a brute-force may trip it earlier. IIRC, it would need to be in the AFU state for this to work on GOS.

I like the idea of a dummy profile, but it would need to be kept up to date and not look too sparse.

DeletedUser477

DeletedUser370 Thanks for this. Sounds like decoys aren't really feasible in the context of someone really going through your device.

My intention is just to show the police something (an innocuous profile) that isn't my daily driver and have them see I'm not up to anything or in touch with anyone and for them to just let me be. This might not be the best approach though. Honestly I would love for my device to just wipe if in the hands of police, but without me getting into major trouble for it. By the sounds of it they can shaft you if they want for "obstruction" or something like that.

de0u

nine This suggestion has been made a lot, even again recently. So far the GrapheneOS project has focused on reliable strong security, not weak countermeasures that work only against low-competence adversaries.

In part this is because the existence of "stealth" features will quickly become known to adversaries.

Please see the earlier posts in this thread and others, e.g.: DeletedUser370

DeletedUser477

@"LunaticBuzz"

Interesting approach. Do you think the cops would try and brute force your phone instead of just getting a warrant to compel you to open it?

I mean if I was a cop and I knew someones birthday that would 100% be the first thing I'd try. I'd hazard a guess and say over 50% of people with a 6 digit pin make it their birthday, or if it's 4 digit pin just MM/YY.

Also I suppose for this approach you would also need to enable USB connection when the screen is locked right? If USB port is set to charging only when the screen is locked I don't think they can connect anything to it to try and brute force?

DollyRags

Best way to implement this without violating GOS principals on making half baked or overcomplicated features would be to have an optional feature which autowipes the phone after a specific time/as soon as it boots up if the phone was off and the time is passed when it reboots. Not something for the average user but for people with advanced threat models this would work and since its automatic and can’t be blocked by anyone after the time has passed even if you know about it, you can’t be accused of doing it yourself or tricking the authorities into doing it. It would just run the same functions as a duress wipe but its time based like the auto reboot feature.

With this feature, even if you are compelled by a court to provide the password (which could take weeks in slow courts), the wipe timer will have passed then and there will be no way anyone can operate the phone without it wiping itself instantly (unless they use an exploit).
I don’t know if this has been considered as a feature before.

argante

DollyRags Interesting idea. I thought of something else. After entering the duress PIN, tasks that clean the phone are launched. This is a drastic solution. What if we created a dummy profile and a special PIN, similar to the duress PIN, but after entering which you would always get to the dummy profile.

nine

What about similar to how the duress pin is implemented we create the option to have a duress user where you just setup your default doxed identity so you type the duress user pin and then they can just scroll through your instagram or whatever innocent profile you have setup

mar2112

If you absolutely need to bring a phone to your protest how about just bringing a secondary (dummy) phone with minimal benign content on it. You can still maintain communication, take photos, etc and not have any incriminating data.

BeepBeep

mar2112

This. (And, keep your real phone in your jail purse! ;)