Hidden Profiles

rilt

I am thinking it would be great to have a ghost profile feature where you have to type in the name of the profile to switch to it.

This could be useful in cases where you are physically threatened to unlock your phone. The aggressor could also force you to switch to all your profiles as they can see all the profiles on the phone. This could be prevented by requiring you to type the name of the profile you want to switch to.

userofgos

rilt this has been discussed numerous times. Here's one such thread that links to some github issues/discussions: https://discuss.grapheneos.org/d/27373-feature-ideaproposal-secret-burner-profile

A lot of users wanting features like this don't take into account that, when implemented in the ways most suggest it to be, it's not possible for it to have plausible deniability and will instead be a half-baked, low quality solution which is in opposition to what GrapheneOS stands for.

Read the following comment on the issue tracker

We want a feature in this area but done in a way where it can't just be easily discovered but rather is actually well hidden in a way that's deniable.

Here's another thread: https://discuss.grapheneos.org/d/20384-feature-request-hidden-profiles

traveller

rilt airport immigration (My phone has been search by these guys before, which is where my idea for this feature came from).

May I ask in which country's airport they did that?

your wife (You can give her your password and keep all private app/data in a ghost profile)
Regular police (They can search your phone in a traffic stop where I live)

may I ask what country is that? (Sorry for asking private information, but just out of curiosity where this is normal) - and can you tell them that it contains private personal information (nothing illegal) and such requests require court order or something like that?

rilt The aggressor could also force you to switch to all your profiles as they can see all the profiles on the phone

I have this concern too. I guess for those who are familiar with software development, the only viable option is to built Graphene yourself and do the necessary changes from code.
But it gets very annoying that you have to rebuild and re-flash Graphene manually to keep up with the security updates (recently I managed to delete all my private info after I've did a repo sync and was trying to flash it back 😅, luckily I didn't keep much of such info on that device). Not to mention - keeping your bootloader unlocked to apply those changes, or create your own update server for OTA updates, etc.

rilt

I just realized that a duress pin would suffice in the situation I mentioned. Another case is when someone saw you input your pin...or this could be used if duress is too destructive. Duress pin also lets the attacker know that you have something to hide.

gristle-cause

Hidden features like this only work if the adversary is unaware the feature exists. Otherwise, an adversary will see GOS, and assume you are concealing hidden data, even if you are not

rilt

I agree, but this would be very useful for intermediate level threat actors. eg:

airport immigration (My phone has been search by these guys before, which is where my idea for this feature came from).
your wife (You can give her your password and keep all private app/data in a ghost profile)
Regular police (They can search your phone in a traffic stop where I live)

Novalissoide

rilt would be very useful for intermediate level threat actors

Maybe, but then the higher level adversaries would torture you and your fellow GrapheneOS users. These 'features' have their bitter risks and consequences.

rilt

@userofgos What do you think about a duress pin that unlocks a profile normally but deletes the private space? What is the flaw with this idea?

userofgos

rilt as far as I'm aware it still has the same flaw as all the other proposed ideas (there are ways to detect a profile exists and weather it was deleted, so there is still no plausible deniability).

rilt

@userofgos I'm not saying to delete the profile. The alternative pin would delete the private space. It would give plausible deniability because not everyone uses private spaces.

userofgos

rilt Private Spaces are Profiles that are integrated into the UI differently. They're more like nested profiles.

rilt It would give plausible deniability because not everyone uses private spaces.

No it would not, and you could say the same thing in regards to Secondary User Profiles, not everyone uses them either.

From what I understand there are still numerous limitations and complexities within the Android/AOSP ecosystem that prevent any such features from attaining plausible deniability. Someone more knowledgeable than me could explain it better.

hello-gos

rilt it might be worth exploring creating an app to do this. Listening to pin appears to be possible according to this app:

https://f-droid.org/en/packages/me.lucky.duress/

I agree that it cannot be used against law enforcement but could be useful in other scenarios such as muggings etc.

DeletedUser629

I think people overthink security and privacy and and if Reddit is anything to go by, they jam every app on there phone because "I need it". I'd bet they really don't. Then they store their entire life in their back pocket in an age of warrantless searches and renditions. All the excuses in the world won't save them. A duress password is more likely to get someone arrested for "destroying evidence" or maybe worse from non state actors.

My model is "less is more" and "don't try to be clever".

That is... I avoid storing anything on my phone that could be sensitive or using my phone in a manner that can be used against me. I don't use apps when I can use a browser and even that is rare. I restrict my device to a phone, messages, camera, map and a browser for incidentals. No email (I can do webmail if inclined, but prefer to read mail at home and not on a little screen), no password manager (I commit the important ones to memory), There's not much of anything and I clean up at the end of the day. If I need access to a file I have a personal cloud service and the file is never on my phone. I upload as I go.
When someone gets into my phone there is nothing to see and they are disappointed.