A "panic button" to trigger Remote Lock for example via SMS

nsreubkvne

I'm wondering how to protect the phone if it ever gets stolen in an unlocked state (various vaults decrypted and online accounts logged in).

Perhaps an app and a small device that can lock a phone remotely? I imagine something like a panic button that sends an SMS to the phone. SMS seems like a better choice, because it takes more time to remove sim card than to disconnect from internet giving you more time to react.

"Wasted" seems like a good choice? However, I'm not sure where to find an appropriate device to trigger SMS "panic message". I'd prefer to avoid carrying a second phone just to send that one SMS, because smartphones have short battery life. Are there any smaller electronic devices that could accomplish this?

I couldn't find any guide or comments so far that addressed this type of threat, which makes me wonder if there is something else I'm missing? Should one rely instead on the phone to automatically lock itself after certain time of inactivity? I'm worried that if someone gets hold of the phone in the middle of working on some tasks it can cause a lot of damage in a short amount of time.

matchboxbananasynergy

Have you considered utilizing GrapheneOS' auto reboot feature? Depending on your concerns, this might be just what you need.

Can you elaborate on what you mean "in an unlocked state"? Do you literally mean that the phone is unlocked (for example, the phone is snatched out of your hand while you're using it), or that it is just in AFU (After first unlock) mode?

If you mean the former, the auto reboot feature won't exactly help, if you mean the latter, the auto reboot feature can be very useful, as it will reboot the phone if it hasn't been unlocked for a predetermined amount of time.

What that does is put the phone in BFU (before first unlock) mode, which means that your data is fully encrypted.

nsreubkvne

matchboxbananasynergy

Can you elaborate on what you mean "in an unlocked state"?

Yes, "snatched out of hand" is exactly what I meant. It happened to me once, as well as to a few of my colleagues, so finding a way to protect personal data against this would be really helpful.

Thanks, I didn't know about auto reboot feature in GrapheneOS, however like you mentioned it won't help as the phone will be "snatched".

Blastoidea

I’m curious how your phone can be “stolen in an unlocked state” except as above, snatched out of your hand.

matchboxbananasynergy

Blastoidea I can imagine some other scenarios, I suppose. Unlocking the phone, placing it on the table and leaving. It'll remain unlock for a certain amount of time, depending on how you've configured it.

That said, that scenario sounds like something that can be avoided.

wonder75

Tasker app can do it. Other automation apps as well I guess.

Simple ruleset

If SMS arrives with [KEYWORD]
Lock screen.

Another thing I did a while ago for the case of theft:

If SMS arrives with [KEYWORD]
Every 10 min
- Get Location. Send location to webserver with HTTP-Request.

nsreubkvne

wonder75

Thanks a lot, I think that would fit perfectly for this use case. If you have any recommendation for a Tasker app like, could you please let me know? Also in this scenario do you imagine always carrying a second phone to send that SMS? I think that it may be a bit tricky - if you ever forget to charge that phone you won't be able to send SMS in time (attacker may remove SIM card by then).

Graphite

wonder75

Testify. I do the same with the lock from SMS keyword.
My GPS location doesn't send to a preconfigured web server though, it'll respond to the sending number.

wonder75

nsreubkvne The app i was refering to is called "Tasker". No, didn't have a second phone with me, but I am sure I would have been able to find someone to help me out.

matchboxbananasynergy

DISCLAIMER: I don't specifically recommend this app - it seems unmaintained and also request device admin permissions to be able to lock your phone.

Someone brought this app up in the Matrix rooms very recently: https://github.com/wesaphzt/privatelock

The way I understand it is that it uses the device's sensors to detect sudden movements (such as someone snatching your phone out of your hand), and then uses the device admin permission to lock your phone. This, combined with the auto reboot feature on a relatively small time frame would provide a solid defense, provided that the app triggers when the phone is snatched (it would need to be a sudden motion, not a stealthy one, but I don't see how someone can stealthily snatch your unlocked phone either.)

wonder75

matchboxbananasynergy

Privatelock needs the permission as well. I guess there is no other way? Maybe emulation of power button press, but I am unsure if this needs admin rights as well.

Requirements
Device admin permission for locking screen.
https://github.com/wesaphzt/privatelock

matchboxbananasynergy

wonder75 Correct, my disclaimer was about privatelock, not Tasker or any other app. I don't specifically recommend privatelock. Just providing an alternative approach to think about instead of having to send an SMS.

nsreubkvne

matchboxbananasynergy
Thanks a lot, I have come across a different app that offered a similar solution, but I'm not sure how reliable the accelerometer on the phone really is especially after a few years of using it. It definitely sounds like a good approach, but I was hoping that another way via SMS or other remote channel to be sure that it will definitely get locked? Or is overcomplicating it?

matchboxbananasynergy

nsreubkvne If the phone is unlocked when they snatch it and the mugger is a little bit smart, they can simply enable airplane mode, and the SMS will never reach your phone. What happens then? :)

ve3jlg

nsreubkvne 'm not sure how reliable the accelerometer on the phone really is especially after a few years of using it.

I would personally set my phone up to lock itself and/or reboot when it was no longer in contact with a bluetooth device on my person i.e. at a distance. The on-person device could be a cheap bluetooth earphone (no need to use it; it could be in a pocket) or an even more minimal bluetooth device.

Invoking Airplane mode and thus shutting off bluetooth and breaking the connection will secure the phone.

nsreubkvne

matchboxbananasynergy
ooh that's a good point, I haven't thought of airplane mode. I assumed that the only risk would be if they physically removed a sim card (take would take a bit longer).

Maybe it's possible to disable airplane mode for good in GrapheneOS? I personally don't use it at all, so that wouldn't be a problem :) I couldn't find any such option in the settings or by googling it so far though.

matchboxbananasynergy

nsreubkvne Maybe it's possible to disable airplane mode for good in GrapheneOS? I personally don't use it at all, so that wouldn't be a problem :)

This might (not sure) be possible to do if you make your own build of GrapheneOS and disable that functionality, but it's not possible otherwise at this time.

nsreubkvne

Thanks again, as mentioned above it's a good point, but you can remove airplane mode from "the quick menu" (the menu that appears when you swipe down from the top), which I think would give you enough time to react (at least 15-20 seconds I'd imagine) .

That's also why I'm so curious about the second part of this question, that is a device that will signal the SMS - something that is long lived enough not having to recharge it every week and reliable enough to have peace of mind in case of emergency.

matchboxbananasynergy

nsreubkvne Sure, but that makes it a game of speed. If I thought getting mugged while my phone was unlocked was a likely possibility, I'd want to cover all my bases and not assume that they won't know to do this or that I can do it faster than them. Just food for thought!

nsreubkvne

matchboxbananasynergy
You are right that it's a rather flaky solution, but combined with the privatelock app that you mentioned earlier could be considered as another layer of security. If it also sent back and SMS confirming that the phone was successfully locked it could be useful I think.

nsreubkvne

Graphite
Thanks, could you please confirm which app is it? I couldn't seem to find "Testify" in Fdroid?

nsreubkvne

ve3jlg

Oh wow that is a brilliant idea! Thanks a lot. Is there an existing app that could provide this? Are there any purpose-made devices that could be paired with? The only problem I could think of right now is if there was some bug that would permanently lock you out of the phone (I imagine there could be a few seconds timeout that would allow you to disable the app in this case).