Alarm hidden behind lockscreen after manual lock

Naudiz

Hi guys, a while ago, I had this idea to always manually lock my phone via the power-button long-press menu when I go to bed. In theory this would have two advantages:

I'd have to type my long password once every morning, so that the automatic lock after 72h(?) will not surprise me in a situation where it's uncomfortable to type the long PW.
In case that government goons would ever appear at my house 6:00 AM in the morning, my phone would be in a more secure state (no Fingerprint possible).

But then I noticed a big issue with this approach: The first time my alarm went off, it was hidden behind the lock screen and I was unable to slumber or disable it before typing in my rather long password. This of course makes the alarm rather unusable in this scenario, so I was wondering if this is intended behavior or maybe a bug with this "secure lock screen".
Also I'm wondering if the same would happen if the 72h-auto-lock would coincidentally happen between going to bed and waking up - this is rather difficult to test as it would require a setup with precise timing. Is it even 72h or something else? - I'm not even sure :D

Watermelon

Naudiz The first time my alarm went off, it was hidden behind the lock screen and I was unable to slumber or disable it before typing in my rather long password. This of course makes the alarm rather unusable in this scenario, so I was wondering if this is intended behavior

It's most likely intended. The “secure lock screen” you're talking about is called Lockdown Mode. According to recent release notes, it also blocks the USB-C port:
https://grapheneos.org/releases#2026011000
(GrapheneOS by default already physically blocks new USB connections while locked, but it sounds like if something is already connected, entering Lockdown Mode would immediately disconnect it, without waiting for the connection to end.)
So Lockdown Mode does many things at once.

Naudiz I'd have to type my long password once every morning, so that the automatic lock after 72h(?) will not surprise me in a situation where it's uncomfortable to type the long PW.

You don't have to enter Lockdown Mode to use your primary unlock method. Just swipe up in the lock screen.

You're getting many different things mixed up. I wrote a tutorial that I think would be helpful to you (see items #3 and #4):
https://discuss.grapheneos.org/d/28682-maximum-security-and-anonymity/4

benzo301

Naudiz I have the exact same problems and paranoia, so I will give you my solution.

I have a 50+ character pwd on the owner user too, but it's bad opsec to just use that profile all the time, so i will explain how i managed to set it up properly.

Absolutely NOTHING on the owner profile, and all the stuff in one or 2 separate profiles with Fingerprint Unlock, so that the security cameras/people can't see your password or pin when you type it on your user when you are outside.
For the alarm, just set it up on a secondary profile when you go to sleep and switch back after it wakes you up.
And the important part, there are 2 main solutions for when the glowies come at your door at 4-6AM:
a) If you go to sleep with the alarm on a secondary user, just restart the phone quickly when they knock as it goes back to the owner profile when it restarts, having that long password AND it goes to BFU state making it impenetrable
Edit: This prevents them having the opportunity to force you to unlock it with your fingerprint, and even if they break into it with some crazy exploit not known to the public, they have no data on that user and the users that do have the data are locked with another pin/pwd. In short just restarting your phone in 2 sec when you hear that knock is the best solution if you have your profiles set up like this.
b) just set up a short Duress that you can type in fast for all the profiles if you don't want to keep your data for after they give it back

Keep in mind that they can spy on you or use cameras or even AI cameras to see your password when you type it, that's why it's always recommended to have multiple users and/or fingerprint unlock on the secondary ones, and to not use your Owner profile when you're in public.

AcclaimSublevel19

Naudiz But then I noticed a big issue with this approach: The first time my alarm went off, it was hidden behind the lock screen and I was unable to slumber or disable it before typing in my rather long password.

I also put my default profile to rest before going to bed and have set up my alarms in the owner profile. I've been able to dismiss them just fine for weeks. I got this bug a couple of times in the past (today too, how ironic) but it's been generally working just fine.

I also have a huge 8-word passphrase. I can type it in like maybe half a minute, but when you've just woken up it's exponentially harder to do it quickly and accurately 😁

Naudiz

Watermelon
Thanks for your reply.
I'm not sure what you are referring to as the "many things" I got mixed up? I think besides not knowing the actual name of Lockdown Mode I didn't say anything particularly wrong, or did I? My assumption was just that an alarm would popup above the lock screen in any AFU state, including Lockdown Mode, and I just wanted to clarify if that not being the case is intentional or not.

That being said, by testing around, I think I just found a working solution to my use case: Providing the wrong fingerprint 5 times in a row locks the screen to the primary unlock method and the alarm still does popup correctly. This obviously is not the same as Lockdown Mode but enough for my intended purpose.

Watermelon

Naudiz I think besides not knowing the actual name of Lockdown Mode I didn't say anything particularly wrong, or did I?

For example, you cited a “72” hours timer, implied that you can't use your primary unlock method when fingerprint unlock is available, said that your device is in a more secure state when fingerprint unlock is disabled (it's vague but I took it as a hint that you might be thinking about BFU state, in which case you're wrong), and other incorrect ideas I detected in your post. (You didn't do anything bad, I just thought my tutorial would be particularly helpful to you due to this.)

Naudiz Providing the wrong fingerprint 5 times in a row locks the screen to the primary unlock method

(This is an intentional GrapheneOS feature, by the way.)

Naudiz Anyways, last night I locked the phone by using the wrong fingerprint 5 times and was able to handle the alarm just fine this morning. Maybe this is the way to go for me from now on - it's a bit clunkier than just pressing a button in the power menu, but if the alarm popup is more reliable this way it's worth it.

AcclaimSublevel19 activating lockdown mode achieves the same then

Lockdown Mode seems to do much more than disabling secondary unlock methods. It also seems to block overlays in the lock screen (hence why the alarm rings but doesn't appear) and block the USB-C port (which GrapheneOS seems to have recently upgraded to use the same hardware-level blocking as their USB-C port control feature), and maybe more.

Naudiz

AcclaimSublevel19 I also put my default profile to rest before going to bed and have set up my alarms in the owner profile. I've been able to dismiss them just fine for weeks. I got this bug a couple of times in the past (today too, how ironic) but it's been generally working just fine.

Default profile & owner profile are two different profiles in your case?
So you locked the default one, but left the owner "unlocked" (i.e. in a state where it can be unlocked by fingerprint + optional 2nd factor PIN), if I understand you correctly?

AcclaimSublevel19 I also have a huge 8-word passphrase. I can type it in like maybe half a minute, but when you've just woken up it's exponentially harder to do it quickly and accurately 😁

Exactly! That's the reason for this thread 😁

Anyways, last night I locked the phone by using the wrong fingerprint 5 times and was able to handle the alarm just fine this morning. Maybe this is the way to go for me from now on - it's a bit clunkier than just pressing a button in the power menu, but if the alarm popup is more reliable this way it's worth it.

AcclaimSublevel19

Naudiz Default profile & owner profile are two different profiles in your case?

Yeah, the idea is that owner can only be unlocked with a really strong passphrase. My default (which is a secondary profile) has a shorter passphrase on first unlock and then fingerprint + 2FA PIN.

Before going to bed, I end the session for the default session. Technically the owner profile is AFU at that time and alarms work.

Naudiz Anyways, last night I locked the phone by using the wrong fingerprint 5 times

You don't really lock it (the keys are still in memory), you're just forced to use the primary unlocking method, so alarms obviously work.

Naudiz Maybe this is the way to go for me from now on - it's a bit clunkier than just pressing a button in the power menu, but if the alarm popup is more reliable this way it's worth it.

I'm not quite sure what you mean. What way are you referring and what power menu button? Are you trying to deliberately disable fingerprint unlock so that alarms are more reliable? That's never going to work lol

Naudiz

AcclaimSublevel19 you're just forced to use the primary unlocking method

Yes, and this is exactly what I was trying to achieve.

AcclaimSublevel19

Naudiz activating lockdown mode achieves the same then