This is a great conversation. I would like to throw in a possibility. If it were possible to implement a per profile duress pin it could be an interesting tool. Assume the duress pin unlocks the default profile while silently deleting a profile on the phone. I dont know the feasibility or development effort necessary to accomplish this. I am sure it is not trivial.
I think the power of a feature could be extended if the auto reboot timer is set to a relatively short time frame.
(Bonus points if the duress pin could auto set the reboot timer or maybe set a process where by each reboot changes the timeout setting to the next shortest interval .
I fully recognize this modification of the auto reboot would likely be very difficult, if not impossible implement.)
But a per profile duress pin that unlocks the device and loads the default profile while silently deleting a secondary profile could possibly ease some users concerns about data disclosure during visual investigation.
Consider the following scenario. A gos user relies on the default profile for most activity. This user creates a secondary profile where they house data/contacts/images they feel are sensitive and want to minimize the risk of disclosure. The criteria for sensitive is "would the disclosure of this material cause me or others harm such that its disclosure is more detrimental than recognition of my effort to delete it"
This feature and organization of data would empower the user to make the calculation about which outcome is more detrimental for them in their current circumstances. Specifically when confronted by an adversary they can provide the default pin or the profile duress pin, or nothing at all. This would extend the current logic behind the duress pin. Currently the duress pin offers users a similar choice without the ability to try to end a confrontation by a perceived less than sophisticated technical actor. The difference is the user gets to assess their adversary when confronted and judge whether or not providing immediate access to default profile is preferable to wiping the phone. It allows the gos user to take a path they may feel is the best chance of ending the confrontation while simuelteanousluly deleting their most sensitive data in a way that is not manifestly evident at the time the phone is being visually examined.
The adversary in my scenario is sophisticated enough to be familiar with gos and how profiles work but not have immediate access to a forensic tool kit.
Further buttressing this calculation could be that forensic efforts at data recovery could be hampered by a auto reboot every 10 min.
Whats at play is the users ability to build a defensive strategy that is flexible and responsive to the user's judgements of the adversary demanding disclosure. I imagine users of GOS have already thought through some of the scenarios they may encounter as part of their adoption of the paltform. To reiterate, I understand it may not be possible to implement these features.