Robbed at gunpoint: Forced to give robber my pin

n3t_admin

gianfisco depends... is the robber trying to get your data specifically or is he more interested in the hardware? In that case you could set up a duress PIN (and password) that would wipe the phone clean of all data and eSIMs and reset it back to factory state. That process will be very noticeable though once you enter the duress PIN, so it might escalate the situation.

thmf

gianfisco I know there is a "second password" feature or something, but does that block messenger apps and notifications also?

The feature is called duress pin/password.
In short, once the duress pin is entered the phone wipes its encryption keys from the secure element immediately rendering all phone data useless. The adversary will see a message on the screen saying something like "the phone is corrupted" (I don't remember the exact words). To make phone usable again, they'll need to do a factory reset (i.e. hold power + vol down buttons and select factory reset from menu). Then the phone will become usable again, but will be completely clean.

Dumdum

thmf The feature is called duress pin/password.

Not necessarily. Sounds like they could be talking about the 2 factor PIN.

schklom

how could I prevent this kind of situation from fucking me up really good

Graphene has a "duress" password/PIN you can setup. Instead of your normal password/PIN, you use that one and it immediately deletes the device's encryption keys, making your data unreadable, then it reboots. https://grapheneos.org/features#duress

And if so, would it be a burden to having to type my password twice just to see notification contents

You can use your fingerprint for the first part instead.
So it can be fingerprint + PIN, it's pretty fast.

does that block messenger apps and notifications also?

Not by itself. Personally, I disable displaying anything on the lockscreen except the clock time, I don't want random people from being able to read e.g. a dating app new message.

For notifications, I use a smartwatch to read them without having to unlock my phone.

gianfisco

I've read about duress password, but as n3t_admin said, that will absolutely escalate the situation, as the robber always tests the password you told him.

Is there any way I can wipe all my data with a delay? Or remotely? So, when he asks me the pin, I tell him the real one, he tests it, it works, he leaves, I'm unharmed, and then I wipe all the data to protect myself?

Someone also told me about Wasted, which looks like a solution, but I'm afraid it might not be reliable, since it's an independent developer and it hasn't been updated in 3 years. Has anybody tested it?

secrec

gianfisco that will absolutely escalate the situation

But it also ends the situation, because once its been wiped, its game over.

leafnose

gianfisco
Would it be realistic in your use-case to have a secondary profile for the street?
This secondary profile would have the bare minimum regarding your personal data, maybe even no phone connectivity, depending on how much robbers do usually check the phone.

It would be a sort of decoy profile, but still useable for very basic functions – no real mail, no real banking, no real chatting, maybe fake ones.

You could even use a hidden private space inside it, if you really need to quickly get access to some of your data.
It would also probably be a good thing to turn off cross-profile notifications, in order not to give a hint to the robber.

I’m guessing that those robbers don’t indefinitely store their haul, and don’t have tools like Cellebrite at hand.
I’m also guessing that the usual ‘shelf life’ ends quickly with a refurbishing of their make, involving a wipe.
As long as your important profiles are protected with a good password or PIN, and as long as they don’t begin to patiently wait for security vulnerabilities in order to break in, you should be reasonably assured that your data won’t be accessed.

Elysium

gianfisco
Maybe there is but...fast and dirty method would be just having multiple user profiles I guess. If someone just wants to steal your phone unlocked quickly, he most likely won't check if you have multiple profiles installed.
So 1. he would have to ask all your profile passwords
then 2. maybe you have private space hidden in those additional profiles, with different PINs etc.
and 3. maybe the apps you use, have their own app lock with their own passwords, you can claim you need a e.g. Yubi hardware key to unlock your password manager to access them, which you claim is in your car or somewhere else.

you go back home or use your 2nd device and unlink stolen device from the apps you use

Another way of protecting your data locally is cryptomator I guess. Need to buy a one time license for it though. But this can be done via proxy stores.

I also have a protective case, so I put a piece of paper on the backside of my phone between it, it is the duress code. If someone robs me, they will potentially want to remove SIM or sell the case idk - and find it the note - then they will enter it and wipe the phone themselves. Could just pretend to put all your passwords on that note too, like for financial and 2FA apps, just pretend to be dumb and an easy target.

So unless you are getting really targeted for your data, I don't think anybody would take their time to go through all that. Give them a tasty bone to chew on, so they run off quickly to get what they want. Put a note with your fake btc wallet seed on your main profile lol

GOSD-profile768

If it really says the phone is corrupted, couldn't you say that your phone memory is broken, it doesn't work anymore, but here is the code.
They open it and the corrupted error confirms the statement?

lost_cause

If I'm forced to unlock at gun point, I'm using my fingerprint and putting in the pin and giving them the phone. If this is just a common criminal, at most they will get my contacts, any files I have stored on the phone and access to my VoIP number (temporarily).

If the phone locks again and I'm gone, they are screwed.

gianfisco

lost_cause

at most they will get my contacts, any files I have stored on the phone and access to my VoIP number (temporarily

What they usually do is order thousands of dollars on resellable stuff in all kinds of delivery apps, log into your google account in another device, use your number to receive 2FA codes, etc. And they do it QUICKLY

leafnose

It would be a sort of decoy profile, but still useable for very basic functions – no real mail, no real banking, no real chatting, maybe fake ones.

Elysium

fast and dirty method would be just having multiple user profiles I guess

This looks like the way to go. I'm going to study a little bit more about profiles and how I can develop a good solution that doesn't require too much hassle and doesn't trim phone's practicality too much. Maybe tying this to Wasted's wipe function linked to a decoy "airplane mode" button.

Maybe I'll even create a dedicated post to this solution, if I ever come to find it. Thanks for the help, guys.

n3t_admin

gianfisco What they usually do is order thousands of dollars on resellable stuff in all kinds of delivery apps, log into your google account in another device, use your number to receive 2FA codes, etc. And they do it QUICKLY

No offense, but it sounds like your country has lost control over these criminals. WTF is that?

If they don't search (frisk) you, it would probably be better to just keep a decoy phone, like many people already do. With decoy accounts and everything. That way, if they ever take it from you, there's plausible deniability that it's your actual phone.

schweizer

gianfisco What they usually do is order thousands of dollars on resellable stuff in all kinds of delivery apps, log into your google account in another device, use your number to receive 2FA codes, etc. And they do it QUICKLY

It is not clear to me why they would need your phone for ordering stuff on your name online. If a shop or bank uses SMS as 2FA they have a security problem and you should avoid them. You should not be logged into a google account other than an anonymous one for updating the apps, preferrably on a secondary profile.

I would not risk my life for a smartphone.

gianfisco

n3t_admin

No offense, but it sounds like your country has lost control over these criminals. WTF is that?

None taken. As Dominic Toretto would say: "THIS IS BRAZIL!".

Decoy phones are a common alternative. But criminals are smart, and if your decoy phone is an old phone, they will know it is a decoy too, so you should carry a "new" decoy phone (which is expensive) lol.

n3t_admin

gianfisco should carry a "new" decoy phone (which is expensive) lol.

I'm thinking entry level Xiaomi phones from 2 or 3 years ago. That's reasonable enough I guess and shouldn't break the bank, even by Brazilian standards.
At least a lot less compared to getting your main phone stolen...

Pocketstar

I have put a tiny (semi-hidden) paper with my duress password inside the phone sleeve. (On the back of the phone)
If someone steals it, it will be wiped.
At a robbery, it is best to judge it yourself.l, but you can tell them that the password is inside of the sleeve, hopefully they'll leave in a hurry and check it out later.

Even better, you can create an "outdoors-profile", which is a profile you only use outdoors (or at least, at unsafe places) and contains very little personal stuff on there.
I think even at gunpoint, this should be safe enough, they are not going to take the time and trying to figure out if that is a seperate profile.

Meatheadmarty

Really Graphene developers have been unwilling to do a simple resolution that would fool dumb street criminals.

Duress Pin
Fake Update Screen
"Please wait while the latest software updates are installed. Thank you for being patient while new features are installed! This will only take a minute!"
(Stupid circly thing thay all morons who use windows are used to seeing.)
Erase everything securely
New bland minimal image to fool stupid street thug

It would be annoying and hard to code that also. But they think it's a bad idea anyway.

So give them the pin to Profile 6, don't go out using other profiles, dont keep important stuff in 6

n3t_admin

Meatheadmarty a simple resolution

It's a simple resolution when you deal with adversaries who have the IQ of a pigeon. Any criminal willing to go these lengths will just wait for the update to finish. Now what? You got yourself into the same situation we were at before - escalation probable. Even the update screen might upset some people, do you really want to risk that?

The idea only sounds good on paper - in the real world it falls apart due to an unlimited number of variables.
Going by that logic, we would have to implement 50 different features to cover every possible scenario.

Meatheadmarty

n3t_admin a street thug usually has the IQ of a pigeon. You think some dumb street thug would be familar with Graphene OS or fake updates or a new wiped profile? No the street thug would look at the new fake profile, be happy, and flee or would flee while the phone says it was installing important updates and will open momentarily. If the fake profile can open quickly, no thug is going to go "this seems like a dummy profile based on my forensic analysis." Many of these street dudes can barely read. That would trick alnost all of them. A duress wipe would not and could make it worse.

tarbeez

Is it technically feasible to open a different profile depending on the pin entered? Like if you enter your real pin, the current profile opens, but enter an alternate one and a decoy profile opens

thmf

tarbeez no. There's a constraint, your phone must be unlocked first, and only after that fact you can open other profiles.

hovenz

It would be better if switching profiles happened with some kind of non-obvious combination of buttons. For example, when changing the volume up-down-up-down and the lock button. So that after unlocking, it would be impossible to detect that the phone has multiple profiles at all