• General
  • A "panic button" to trigger Remote Lock for example via SMS

I'm wondering how to protect the phone if it ever gets stolen in an unlocked state (various vaults decrypted and online accounts logged in).

Perhaps an app and a small device that can lock a phone remotely? I imagine something like a panic button that sends an SMS to the phone. SMS seems like a better choice, because it takes more time to remove sim card than to disconnect from internet giving you more time to react.

"Wasted" seems like a good choice? However, I'm not sure where to find an appropriate device to trigger SMS "panic message". I'd prefer to avoid carrying a second phone just to send that one SMS, because smartphones have short battery life. Are there any smaller electronic devices that could accomplish this?

I couldn't find any guide or comments so far that addressed this type of threat, which makes me wonder if there is something else I'm missing? Should one rely instead on the phone to automatically lock itself after certain time of inactivity? I'm worried that if someone gets hold of the phone in the middle of working on some tasks it can cause a lot of damage in a short amount of time.

Have you considered utilizing GrapheneOS' auto reboot feature? Depending on your concerns, this might be just what you need.

Can you elaborate on what you mean "in an unlocked state"? Do you literally mean that the phone is unlocked (for example, the phone is snatched out of your hand while you're using it), or that it is just in AFU (After first unlock) mode?

If you mean the former, the auto reboot feature won't exactly help, if you mean the latter, the auto reboot feature can be very useful, as it will reboot the phone if it hasn't been unlocked for a predetermined amount of time.

What that does is put the phone in BFU (before first unlock) mode, which means that your data is fully encrypted.

    I’m curious how your phone can be “stolen in an unlocked state” except as above, snatched out of your hand.

      Blastoidea I can imagine some other scenarios, I suppose. Unlocking the phone, placing it on the table and leaving. It'll remain unlock for a certain amount of time, depending on how you've configured it.

      That said, that scenario sounds like something that can be avoided.

      Tasker app can do it. Other automation apps as well I guess.

      Simple ruleset

      • If SMS arrives with [KEYWORD]
      • Lock screen.

      Another thing I did a while ago for the case of theft:

      • If SMS arrives with [KEYWORD]
      • Every 10 min
        • Get Location. Send location to webserver with HTTP-Request.

        matchboxbananasynergy

        Can you elaborate on what you mean "in an unlocked state"?

        Yes, "snatched out of hand" is exactly what I meant. It happened to me once, as well as to a few of my colleagues, so finding a way to protect personal data against this would be really helpful.

        Thanks, I didn't know about auto reboot feature in GrapheneOS, however like you mentioned it won't help as the phone will be "snatched".

        wonder75

        Thanks a lot, I think that would fit perfectly for this use case. If you have any recommendation for a Tasker app like, could you please let me know? Also in this scenario do you imagine always carrying a second phone to send that SMS? I think that it may be a bit tricky - if you ever forget to charge that phone you won't be able to send SMS in time (attacker may remove SIM card by then).

          nsreubkvne The app i was refering to is called "Tasker". No, didn't have a second phone with me, but I am sure I would have been able to find someone to help me out.

          DISCLAIMER: I don't specifically recommend this app - it seems unmaintained and also request device admin permissions to be able to lock your phone.

          Someone brought this app up in the Matrix rooms very recently: https://github.com/wesaphzt/privatelock

          The way I understand it is that it uses the device's sensors to detect sudden movements (such as someone snatching your phone out of your hand), and then uses the device admin permission to lock your phone. This, combined with the auto reboot feature on a relatively small time frame would provide a solid defense, provided that the app triggers when the phone is snatched (it would need to be a sudden motion, not a stealthy one, but I don't see how someone can stealthily snatch your unlocked phone either.)

            wonder75 Correct, my disclaimer was about privatelock, not Tasker or any other app. I don't specifically recommend privatelock. Just providing an alternative approach to think about instead of having to send an SMS.

              matchboxbananasynergy
              Thanks a lot, I have come across a different app that offered a similar solution, but I'm not sure how reliable the accelerometer on the phone really is especially after a few years of using it. It definitely sounds like a good approach, but I was hoping that another way via SMS or other remote channel to be sure that it will definitely get locked? Or is overcomplicating it?

                matchboxbananasynergy
                ooh that's a good point, I haven't thought of airplane mode. I assumed that the only risk would be if they physically removed a sim card (take would take a bit longer).

                Maybe it's possible to disable airplane mode for good in GrapheneOS? I personally don't use it at all, so that wouldn't be a problem :) I couldn't find any such option in the settings or by googling it so far though.

                  nsreubkvne Maybe it's possible to disable airplane mode for good in GrapheneOS? I personally don't use it at all, so that wouldn't be a problem :)

                  This might (not sure) be possible to do if you make your own build of GrapheneOS and disable that functionality, but it's not possible otherwise at this time.

                  nsreubkvne

                  Thanks again, as mentioned above it's a good point, but you can remove airplane mode from "the quick menu" (the menu that appears when you swipe down from the top), which I think would give you enough time to react (at least 15-20 seconds I'd imagine) .

                  That's also why I'm so curious about the second part of this question, that is a device that will signal the SMS - something that is long lived enough not having to recharge it every week and reliable enough to have peace of mind in case of emergency.

                    nsreubkvne Sure, but that makes it a game of speed. If I thought getting mugged while my phone was unlocked was a likely possibility, I'd want to cover all my bases and not assume that they won't know to do this or that I can do it faster than them. Just food for thought!

                      wonder75

                      Testify. I do the same with the lock from SMS keyword.
                      My GPS location doesn't send to a preconfigured web server though, it'll respond to the sending number.

                        nsreubkvne 'm not sure how reliable the accelerometer on the phone really is especially after a few years of using it.

                        I would personally set my phone up to lock itself and/or reboot when it was no longer in contact with a bluetooth device on my person i.e. at a distance. The on-person device could be a cheap bluetooth earphone (no need to use it; it could be in a pocket) or an even more minimal bluetooth device.

                        Invoking Airplane mode and thus shutting off bluetooth and breaking the connection will secure the phone.

                          matchboxbananasynergy
                          You are right that it's a rather flaky solution, but combined with the privatelock app that you mentioned earlier could be considered as another layer of security. If it also sent back and SMS confirming that the phone was successfully locked it could be useful I think.