Forced by Police to reveal the pin/password to GrapheneOS

Manole

Hello everyone,

First of all, I want to say that I truly love this project—GrapheneOS is amazing. However, I’d like to talk about a feature that I believe urgently needs to be implemented.

In my country, Romania, there have been situations where the police, when entering someone’s home with a warrant, force the person to reveal their phone PIN or password. In some cases—including my own—they even used violence to obtain it, knowing no one was watching and abusing their power.

What I’d like to suggest is the implementation of a feature similar to what VeraCrypt offers: a second password that, when entered under force, leads to a decoy or hidden profile—such as a blank user profile or one with no sensitive information. This would help protect individuals from harm when they are coerced into unlocking their devices.

I know GrapheneOS already has an option for auto-wipe after a specific password is entered, but in a real-life situation like mine, this might escalate the violence even more. That’s why I think a less confrontational alternative—a fake profile accessed via a second PIN—could be a life-saving feature.

This request comes from personal experience: I was assaulted in my own home until I gave up my real password. Fortunately, in the case of my laptop, I was able to avoid further harm thanks to VeraCrypt hidden volume feature. I'm willing to donate to support the development of this functionality in GrapheneOS.

Thank you from the bottom of my heart for your work. I deeply appreciate this project and the mission behind it.

IcyScroll

Manole That's messed up. This shouldn't be taking place. I feel so sorry for you and everyone else affected by this abuse of power.

I believe there were requests for the feature you describe. Someone might have a link.

To my understanding, it's currently not feasible for GOS to provide such a feature. It wouldn't work in a way that one could expect. Everyone aware of its existence could easily tell when it switched to a different profile. It wouldn't be seamless. It would cause a significant chance to worsen the already dire situation, just like duress PIN. The duress feature is clear about what it does. An incomplete implementation of plausible deniability could be misleading and provide a false sense of safety during an encounter with a knowledgeable adversary.

GOS has a very high bar when it comes to implementing features - they HAVE to be reasonable, clear and work for the majority of use cases. The developers certainly care a lot about these properties. I am sure that once it becomes possible to implement this feature, they will work on it.

Note: I am just a passionate user doing my best to understand everything I can about GrapheneOS and the reasoning behind it. I might be wrong, if that's the case, do not hesitate to correct me.

DeletedUser559

Perhaps you could have a "Duress Decoy" pin/password that logs in as normal but then in the background it deletes user cache, storage and other data from preselected apps, and resets the Duress Decoy settings.

de0u

Manole Historically the GrapheneOS project has focused on straightforward strong security that works against strong adversaries. The duress PIN feature is instant, comprehensive, and irreversible. The automatic reboot timer reliably puts all private data at rest.

One problem with all of the stealth proposals is that they work only against low-competence adversaries.

Another issue is that structurally they put non-users at risk. If the Romanian police, or criminal gangs in Mexico, came to understand that some future version kf GrapheneOS had implemented stealth profiles, they might well beat people who don't have a stealth profile set up to force them to unlock it.

Being able to carry around a private pocket supercomputer with high-speed communications is great. It is also something that totalitarians naturally try to abolish. This is a hard problem!

DeletedUser495

I believe this feature has been asked for many times and doesn't have an alternative in stock environment. I also believe it is not so easy to implement alongside the regular profiles where you have to pick the user before logging in and would require some fundamental change in the code diverting from AOSP and testing done by a small team hence I understand why they are reluctant to entertain it.

When it comes to interacting with LE, best way is the least resistence so unlocking your device when asked, revealing relatively harmless content may be better way of doing things than storing dangerous and incriminating stuff for prolonged times directly on your device and if you do that, it begs for a rethink on how you should use your device if you operate with such information.

grayway2

Alternatively, you can create a secondary profile and the duress pin.

Create a convincing owner profile and unlock it. Cops are just cops and the vast majority don't even know a damn thing about forensics.

Now, if they are not too stupid and ask you to unlock the secondary profile which has your real data, give them the duress pin.

The worst scenario is death if they beat you for a long time but it's very unlikely.

JollyRancher

The best option would be a duress pin that unlocks owner as normal and works in all respects like the real password but when used wipes a given user profile. Well that and not allowing the whole user profile list to be visible before entering the password.

angela

grayway2 then you are going to afu which is easier to brute-force

It would be better if the duress password wiped everything and created a plain profile

It could say something such as "Installing update 1 percent" then "20 percent" etc to account for the delay and the plain profile could just be an old asop image.

Many police are violent, angry, and technologically stupid. Some police are very intelligent. For the bulk of police they are not reading forensic technology articles and rarely come into contact with technology. Often just calming them is good enough. If such a feature is implemented it would become widely known among smarter intelligent police, but some police rarely read anything.

This feature would also protect against criminals trying to wrench attack gos users since many wrench attach criminals do not read about things like gos.

Even if smarter types who read learn about this it would still protect against many attacks.

Sigismund

I always wonder what makes people think that opening such a "decoy" profile will "satisfy" people forcing you to show your phone because they want to review your data. There's a difference between "fake" veracrypt profile and a "fake" phone profile, due to usage of such devices..

grayway2

angela not if you fast reboot the phone of just end session. The profile will be in BFU.

Manole

Sigismund
In Romania, when the police come to your home early in the morning with a warrant, they are instructed by the officers in charge of digital forensics to try to bring the phone back to the base along with the password, if possible.

The officers who enter your home are often not very technically knowledgeable — they are simply trained to believe that it's better to return to the base with a working device and the password. They don’t usually care whether the unlocked device leads to a real user profile or a decoy one — they are quite naive when it comes to that.

For example, in my personal case, I avoided being beaten when the police asked me for the password to my laptop. I gave them a secondary password, thanks to VeraCrypt’s brilliant feature that allows this. The laptop then booted into a clean Windows partition with no sensitive data.

It wasn’t until they got back to their forensic lab that they realized it was a decoy profile. But at that point, they could no longer beat or intimidate me — because at their base, there are lawyers present, surveillance cameras, and procedures that prevent them from doing such things.

In conclusion, in Romania, the police can abuse their power only in places where there are no cameras and no lawyers around to protect your rights.

Manole

Sigismund

But if I were to use the DURESS PIN option, where GrapheneOS wipes the phone, even these naive officers — no matter how untrained or unaware they might be — would clearly see that GOS was erased. And in that case, they would beat me even worse.

Manole

Sigismund

There should be an option implemented in GrapheneOS that allows for a secondary PIN, similar to the existing DURESS PIN feature. However, when this secondary PIN is entered, instead of wiping the phone, the system should display a fake system update screen.

The phone would then appear to be "updating," and the progress bar would slowly move from 1% to 100% — but this process should take at least 10 hours to complete, then when 100% complete can be wiping. The idea is that the authorities, when entering the house in the morning, won’t stand around waiting for the update to finish. Instead, they will seal the phone and send it to the forensic lab.

This delay would give the user a chance to avoid immediate violence or abuse during the home search, as it buys time and deflects suspicion.

I am ready to pay or donate for such a feature if it could be implemented.

Hathaway_Noa

Manole Are you prepared to pay 50K - 100K in fees for such a feature? It costs a lot of time and effort to perfect such a feature, its not simple.

Manole

Hathaway_Noa
why 50k ! Just need to add a fake update screen before wipe !

DeletedUser421

Manole What if they pull the battery out before it’s complete?

Manole

something like this must be added !
https://i.postimg.cc/PJX01ch9/gosduresspin.jpg
https://i.ibb.co/jZ9z8h4B/gosduresspin.jpg
https://freeimage.host/i/Fg1OAzb

Manole

DeletedUser421
They don’t do that. They just want to see if the PIN or password works and unlocks the phone. If it does, they’re usually very satisfied just to see that it opens successfully.

DeletedUser421

How soon until they become aware of this feature? It’s no better than the hilarious security by obscurity features that the Encro phones had. It just adds unnecessary code and wastes developer time.

It’s entertaining to imagine features like this and you probably feel like a genius for a few hours, but then reality hits you.

Manole

DeletedUser421
in Romania maybe 20 years, in another country it will not beat you even if they know about this features.