Robbed at gunpoint: Forced to give robber my pin

GOSD-profile768

If it really says the phone is corrupted, couldn't you say that your phone memory is broken, it doesn't work anymore, but here is the code.
They open it and the corrupted error confirms the statement?

lost_cause

If I'm forced to unlock at gun point, I'm using my fingerprint and putting in the pin and giving them the phone. If this is just a common criminal, at most they will get my contacts, any files I have stored on the phone and access to my VoIP number (temporarily).

If the phone locks again and I'm gone, they are screwed.

gianfisco

lost_cause

at most they will get my contacts, any files I have stored on the phone and access to my VoIP number (temporarily

What they usually do is order thousands of dollars on resellable stuff in all kinds of delivery apps, log into your google account in another device, use your number to receive 2FA codes, etc. And they do it QUICKLY

leafnose

It would be a sort of decoy profile, but still useable for very basic functions – no real mail, no real banking, no real chatting, maybe fake ones.

Elysium

fast and dirty method would be just having multiple user profiles I guess

This looks like the way to go. I'm going to study a little bit more about profiles and how I can develop a good solution that doesn't require too much hassle and doesn't trim phone's practicality too much. Maybe tying this to Wasted's wipe function linked to a decoy "airplane mode" button.

Maybe I'll even create a dedicated post to this solution, if I ever come to find it. Thanks for the help, guys.

leafnose

gianfisco
Would it be realistic in your use-case to have a secondary profile for the street?
This secondary profile would have the bare minimum regarding your personal data, maybe even no phone connectivity, depending on how much robbers do usually check the phone.

It would be a sort of decoy profile, but still useable for very basic functions – no real mail, no real banking, no real chatting, maybe fake ones.

You could even use a hidden private space inside it, if you really need to quickly get access to some of your data.
It would also probably be a good thing to turn off cross-profile notifications, in order not to give a hint to the robber.

I’m guessing that those robbers don’t indefinitely store their haul, and don’t have tools like Cellebrite at hand.
I’m also guessing that the usual ‘shelf life’ ends quickly with a refurbishing of their make, involving a wipe.
As long as your important profiles are protected with a good password or PIN, and as long as they don’t begin to patiently wait for security vulnerabilities in order to break in, you should be reasonably assured that your data won’t be accessed.

Elysium

gianfisco
Maybe there is but...fast and dirty method would be just having multiple user profiles I guess. If someone just wants to steal your phone unlocked quickly, he most likely won't check if you have multiple profiles installed.
So 1. he would have to ask all your profile passwords
then 2. maybe you have private space hidden in those additional profiles, with different PINs etc.
and 3. maybe the apps you use, have their own app lock with their own passwords, you can claim you need a e.g. Yubi hardware key to unlock your password manager to access them, which you claim is in your car or somewhere else.

you go back home or use your 2nd device and unlink stolen device from the apps you use

Another way of protecting your data locally is cryptomator I guess. Need to buy a one time license for it though. But this can be done via proxy stores.

I also have a protective case, so I put a piece of paper on the backside of my phone between it, it is the duress code. If someone robs me, they will potentially want to remove SIM or sell the case idk - and find it the note - then they will enter it and wipe the phone themselves. Could just pretend to put all your passwords on that note too, like for financial and 2FA apps, just pretend to be dumb and an easy target.

So unless you are getting really targeted for your data, I don't think anybody would take their time to go through all that. Give them a tasty bone to chew on, so they run off quickly to get what they want. Put a note with your fake btc wallet seed on your main profile lol

n3t_admin

gianfisco What they usually do is order thousands of dollars on resellable stuff in all kinds of delivery apps, log into your google account in another device, use your number to receive 2FA codes, etc. And they do it QUICKLY

No offense, but it sounds like your country has lost control over these criminals. WTF is that?

If they don't search (frisk) you, it would probably be better to just keep a decoy phone, like many people already do. With decoy accounts and everything. That way, if they ever take it from you, there's plausible deniability that it's your actual phone.

schweizer

gianfisco What they usually do is order thousands of dollars on resellable stuff in all kinds of delivery apps, log into your google account in another device, use your number to receive 2FA codes, etc. And they do it QUICKLY

It is not clear to me why they would need your phone for ordering stuff on your name online. If a shop or bank uses SMS as 2FA they have a security problem and you should avoid them. You should not be logged into a google account other than an anonymous one for updating the apps, preferrably on a secondary profile.

I would not risk my life for a smartphone.

gianfisco

n3t_admin

No offense, but it sounds like your country has lost control over these criminals. WTF is that?

None taken. As Dominic Toretto would say: "THIS IS BRAZIL!".

Decoy phones are a common alternative. But criminals are smart, and if your decoy phone is an old phone, they will know it is a decoy too, so you should carry a "new" decoy phone (which is expensive) lol.

n3t_admin

gianfisco should carry a "new" decoy phone (which is expensive) lol.

I'm thinking entry level Xiaomi phones from 2 or 3 years ago. That's reasonable enough I guess and shouldn't break the bank, even by Brazilian standards.
At least a lot less compared to getting your main phone stolen...

Pocketstar

I have put a tiny (semi-hidden) paper with my duress password inside the phone sleeve. (On the back of the phone)
If someone steals it, it will be wiped.
At a robbery, it is best to judge it yourself.l, but you can tell them that the password is inside of the sleeve, hopefully they'll leave in a hurry and check it out later.

Even better, you can create an "outdoors-profile", which is a profile you only use outdoors (or at least, at unsafe places) and contains very little personal stuff on there.
I think even at gunpoint, this should be safe enough, they are not going to take the time and trying to figure out if that is a seperate profile.

Meatheadmarty

Really Graphene developers have been unwilling to do a simple resolution that would fool dumb street criminals.

Duress Pin
Fake Update Screen
"Please wait while the latest software updates are installed. Thank you for being patient while new features are installed! This will only take a minute!"
(Stupid circly thing thay all morons who use windows are used to seeing.)
Erase everything securely
New bland minimal image to fool stupid street thug

It would be annoying and hard to code that also. But they think it's a bad idea anyway.

So give them the pin to Profile 6, don't go out using other profiles, dont keep important stuff in 6

n3t_admin

Meatheadmarty a simple resolution

It's a simple resolution when you deal with adversaries who have the IQ of a pigeon. Any criminal willing to go these lengths will just wait for the update to finish. Now what? You got yourself into the same situation we were at before - escalation probable. Even the update screen might upset some people, do you really want to risk that?

The idea only sounds good on paper - in the real world it falls apart due to an unlimited number of variables.
Going by that logic, we would have to implement 50 different features to cover every possible scenario.

Meatheadmarty

n3t_admin a street thug usually has the IQ of a pigeon. You think some dumb street thug would be familar with Graphene OS or fake updates or a new wiped profile? No the street thug would look at the new fake profile, be happy, and flee or would flee while the phone says it was installing important updates and will open momentarily. If the fake profile can open quickly, no thug is going to go "this seems like a dummy profile based on my forensic analysis." Many of these street dudes can barely read. That would trick alnost all of them. A duress wipe would not and could make it worse.

tarbeez

Is it technically feasible to open a different profile depending on the pin entered? Like if you enter your real pin, the current profile opens, but enter an alternate one and a decoy profile opens

thmf

tarbeez no. There's a constraint, your phone must be unlocked first, and only after that fact you can open other profiles.

hovenz

It would be better if switching profiles happened with some kind of non-obvious combination of buttons. For example, when changing the volume up-down-up-down and the lock button. So that after unlocking, it would be impossible to detect that the phone has multiple profiles at all

Unknown-Phallus

gianfisco The 100% ABSOLUTE MOST secure way would be to create at least 2 profiles & use the owner profile ONLY for creating other profiles and changing "Global" Settings.

Profile 1 (MAIN) will have a UNIQE Password and would be your MAIN use profile.

Profile 2 (A Street Pro) would be derived from the streets and ONLY used when gallivanting deep within the streets is required.

This way, your main profile will NOT be the owner profile, and will be set to NOT run in the background, therefore it will ALWAYS be at REST once you switch to ANY OTHER profile (eg the The Street profile, Owner, etc).

If your phone is stolen, the data in the main profile is still there, BUT is ABSOLUTLEY Irretrievable. For Pix6 and above NO ONE would be able to retrieve your MAIN Profile data without the password, NOT an individual, criminal enterprise, or state actor.

ADDED BENEFIT: If yaks and swine grow wings and fly deep into the sky, and The Stinger becomes an evil guy (PREPOSTEROUSLY IMPROBABLE), and you get your phone back You will still have your data.

thmf

Unknown-Phallus or you could use the regular owner profile as a "street" profile. Then create your additional profile which runs in background with true data. This way you'll always get into your street profile (which is phone owner), even after reboot.

Meatheadmarty

Unknown-Phallus in afu with main profile passworded if state actor got unlocked phone in profile 2 i doubt they couldn't get profile 1 access given enough time.

Unknown-Phallus

thmf You could.... However, MINOR leaks occur with information from other profiles (eg package manager leaks information about installed apps on other profiles, their installed location etc.) and this information is only accessible via Owner.
As im sure you can imagine My Namesake strives for maximum hardness and to that length's end (or tip), For the most part practicality be damned, HOWEVER practicality perused occasionally to facilitate, but only minimally so.

indigomadelin

I didn't test, but I may suggest using Macrodroid (or another app for device automation) and create a scenario to run clear app data for MyBank when headphones unplugged (the robber ripped the phone from your hands) or location is 2 km away from your home (the robber ran away). I didn't see an automation app that can uninstall apps or factory reset the phone.
You get the idea, you can customize the script how you want.
However, you need to grant admin permissions for the app, which could be against your threat model.

chinook

indigomadelin

I didn't see an automation app that can uninstall apps or factory reset the phone

Uninstall: maybe tasker with "ADB WiFi command" but that's an ENORMOUS security sinkhole (ie: keeping this enabled)

Factory Reset: FindMyDevice by nulide (I didn't try wiping yet, though)

traveller

Personally I think the best solution would be to have a special pin that brings you to a special profile with profile switch functionality completely disabled (so the adversary can't even tell right away, if the phone has other profiles set up or not).
But I also understand that may be non-trivial to implement.

Meatheadmarty

traveller yes, it would be great to have but hard to code. The developers probably lack the time to do a new feature like that. Just having a duress pin is great. Makes the OS so much better.