Is the duress pin worth using or less secure?

greenstumps

I was wondering to use it or not, but it seems to me as soon as you do that then anyone can use your phone and do data recovery. So is it actually more secure to just keep the phone locked behind a password?

Dumdum

greenstumps do data recovery.

What data is being recovered??

greenstumps

Well none but we live in a police state where we will be arrested for words and they look through your phone. However if you give them a duress password and it wipes the phone, surely that makes it easier for them to just data recovery?

GrouchyGrape

greenstumps can you explain how you think it increases their ability to recover data?

https://grapheneos.org/features#duress

userofgos

greenstumps However if you give them a duress password and it wipes the phone, surely that makes it easier for them to just data recovery?

No that is not correct. Please read this recent thread: https://discuss.grapheneos.org/d/28586-securely-wipe-all-data

However, there may be consequences for using the duress pin in your country depending on the laws surrounding destruction of evidence.

Olaolaho

greenstumps Well none but we live in a police state where we will be arrested for words and they look through your phone. However if you give them a duress password and it wipes the phone, surely that makes it easier for them to just data recovery?

Activating the duress passwords main goal is to wipe the phone so no useful data will be recovered so or you trying to ask something else or you have no idea what typing the duress password does. Eatherway if your concern is that somebody will be able to retrieve data after entering the duress then I geuss your can use it without worries by now

gristle-cause

An adjacent but unrelated thought: what are your use cases for the duress pin?

If we assume GOS encryption is essentially uncrackable, when is data erasure even necessary? Just lock the phone, right?

For social situations where you are coerced to provide a password, I struggle to see value in covertly wiping the disk, unless you believe the phone is indeed crackable & feel disk erasure is a necessary preventative measure

Probably9857

gristle-cause An adjacent but unrelated thought: what are your use cases for the duress pin?

Mainly to prevent being coerced into unlocking the device, when you believe the consequences of revealing the data on the device would be worse than the consequences of having wiped it.

gristle-cause

Probably9857 Interesting... It's not a failsafe on the device, but a failsafe on you & your ability to withhold a password from an adversary

Even still, I suspect there are exceedingly few threat models where this applies to even the most extreme scenarios. This thread is relevant

Watermelon

Probably9857 gristle-cause I can imagine three cases where it's helpful: you, your password, and the secure element.

You: you are tortured (or threatened) to give the password. The duress password would not necessarily prevent/stop the torture, but it would prevent the device from being unlocked or decipherable even with knowing the correct password.
Your password: your password was guessable due to e.g. being reused in other places. The duress password prevents even the correct password from working in future.
Secure element: if a vulnerability in the Titan M2 secure element chip would be discovered that lets an attacker bypass the bruteforce resistance, and if the password isn't strong enough by itself and relies on the secure element to throttle password attempts for security, then that's a vulnerability that not even the auto-reboot feature can protect against by changing the device to BFU state. However, the duress password could help in this case (as well as updating the firmware, but that might not always be possible in every scenario, or there's a zero-day).

Probably9857

gristle-cause I suspect there are exceedingly few threat models where this applies

Agree.

Novalissoide

Watermelon hah! Posted right after you. 😊

Olaolaho

Watermelon I can imagine three cases where it's helpful: you, your password, and the secure element.

You: you are tortured (or threatened) to give the password. The duress password would not necessarily prevent/stop the torture, but it would prevent the device from being unlocked or decipherable even with knowing the correct password.
Your password: your password was guessable due to e.g. being reused in other places. The duress password prevents even the correct password from working in future.
Secure element: if a vulnerability in the Titan M2 secure element chip would be discovered that lets an attacker bypass the bruteforce resistance, and if the password isn't strong enough by itself and relies on the secure element to throttle password attempts for security, then that's a vulnerability that not even the auto-reboot feature can protect against by changing the device to BFU state. However, the duress password could help in this case (as well as updating the firmware, but that might not always be possible in every scenario, or there's a zero-day

This says it all.. I guess issue us solved and clear

Probably9857

Watermelon

This is the case I described.
If you have a threat model that could potentially involve using a duress pin, presumably you would not use an easily guessable (real) password
The original question was assuming the phone cannot be cracked. And as above, if it was known to be crackable, a person with this threat model would have replaced it. Zeros days are a good point though.

Novalissoide

In wartime settings, it may keep you from revealing state secrets, or keep you from giving away your fellow soldiers.

greenstumps

I do not see it as being useful then, because if you’ve been cheating on the wife and you give her a pin to wipe it, that will be instant divorce.

If you’re being tortured by terrorists and you do it then you’ll be killed

If you’re being held by the government and you use it, then it makes it easier for them to retrieve the data.

I was hoping someone was going to say it writes over the data like you can get programs to do with hard disks to make the data on it corrupted.

To me then it seems rather pointless and so I’ll choose not to bother it. I’ll just refuse to give them the pin.

hemingway

greenstumps

If you’re being held by the government and you use it, then it makes it easier for them to retrieve the data.

I believe this is incorrect.

Unlike deleting a partition on a hard drive (in which data is still recoverable if you rebuild the partition), GOS uses encryption on the phone's "hard drive". Upon activating the duress feature, it zeroes the encryption keys, forces a reboot and wipes the memory/RAM. Without the encryption keys, no amount of known recovery methods can unscramble any of the data.

This is my general understanding of how it works anyway.

de0u

greenstumps I was hoping someone was going to say it writes over the data like you can get programs to do with hard disks to make the data on it corrupted.

That takes hours, and that approach doesn't work reliably with flash storage devices. Wiping the encryption keys for the user data partition is instant and more effective.

GrouchyGrape

greenstumps then it makes it easier for them to retrieve the data.

Once again you're saying nonsense. Sounds like you haven't read the FAQ at all nor do you have a basic grasp on how all this works