Duress pass encrypted keys wipe: before or after the auto reboot?

DeletedUser711

Hello.
I have done something very very very very stupid. I have more profiles. One of them is used by a person when he borrows my phone. Today I had to check something in that profile. The duress password of the phone is literarly his birthday date. I tried accessing his profile: I entered a traditional password of mine (bc I have the bad habit of using the same password for every profile), realized it isnt good. Tried again, maybe it is was his darn birthday.... right?! Oh well, his birthday was the duress password, YAY!

Question: When the duress password is introduced, are the encryption keys wiped EXACTLY in that moment OR after the phone automatically reboots.

I have a google pixel pro 9 XL, graphene os version: [ill check attestation if necessary].
The phone was supposed to reboot however I paused it.
When booting, theres always that warning message: "Your device is loading a different operating system..."; Next to the power button theres: "Press power button to pause", thats what I pressed.

What should I do now?
If the encryption keys were wiped before the reboot, then ill just accept my fate and use my backup that doesnt include 2 weeks of data...

If the encryption keys ARE TO BE wiped... what if I took out the battery so that RAM erases itself completely? I dont think this second scenario is possible.

An answer will be highly appreciated. If this scenario was clarrified somewhere on these forums then I am sorry for this junk post.

MyIdentityIsntImportant

DeletedUser711 As stated by the documentation: Note that if the duress PIN/Password is the same as the actual unlock method, the actual unlock method always takes precedence, and therefore no wipe will occur.

https://grapheneos.org/features#duress

You can rest easy.

Johnnyloans

DeletedUser711

I think either way, it's gone.
A reboot, essentially, is a power off. Power off again won't change the process.

keys wiped > reboot
Or
device places a flag/reminder to delete the keys on next boot up that survives being turned off (e.g. a reboot) > reboot > keys wiped

1 thing if you really want to try: hold down the power button for a minute or 2 until the phone is forced off. (This works anytime)

MyIdentityIsntImportant

Good to know, thank you.
It sounds like their phone rebooted right after the pin so they think it's duress. The actual unlock pin is different. They were guessing pins.

fid03

DeletedUser711 Question: When the duress password is introduced, are the encryption keys wiped EXACTLY in that moment OR after the phone automatically reboots.

Please read https://grapheneos.org/features#duress

If you entered the duress password then your data is not recoverable. You can't do anything about that once the duress password is entered.

I know it's not the answer you want but this is the way the feature works. If you found a way to prevent the wipe once the password is entered then I'm sure the GrapheneOS team would be interested to know.

userofgos

DeletedUser711 When the duress password is introduced, are the encryption keys wiped EXACTLY in that moment OR after the phone automatically reboots.

The duress feature is immediate and is not preventable, meaning you cannot stop a duress wipe at any stage.

DeletedUser711 The phone was supposed to reboot however I paused it.
When booting, theres always that warning message: "Your device is loading a different operating system..."; Next to the power button theres: "Press power button to pause", thats what I pressed..

DeletedUser711

It DOES NOT matter if you Pause the boot process at this stage, it WILL NOT stop or prevent the wipe. (The wipe has already happened by this point, before you paused at this screen)

See the X post here for a video of the duress feature in action: https://xcancel.com/tuxpizza/status/1797314703468753342

Important thing to note is the keystore keys required for deriving the encryption keys are erased before the phone even shuts down, and when you turn it back on it is unable to boot due to the corrupted state, forcing you to perform a factory reset

DeletedUser711

Johnnyloans I would like to clarify: I have a slight feeling the NORMAL user password was indeed his birthday. Maybe the duress and his user password were the same, however, if this was indeed true, the normal password would have been dominant and would have unlocked the profile. My phone rebooted right after so I think the user password wasnt the same as the duress password, oh god. Or did I miss something? Im pretty tired.

TrustExecutor

From what I read the GrapheneOS devs took great care in implementing the duress PIN in a way that could not in any way be interrupted.

DeletedUser711

TrustExecutor

DeletedUser711 and I am too afraid to continue. I would like to still keep the phone paused for a while until more people respond, sorry.

Novalissoide

DeletedUser711 if duress, its gone already. If no duress, you'll know by rebooting.

Novalissoide

DeletedUser711 There's no gain by waiting now.

Johnnyloans

DeletedUser711

Sorry, that's a terrible feeling.
Here's an internet hug <3

DeletedUser711

Johnnyloans oh well. Stupid of me. Glad I had a backup, it is a bit old thought. Restoring whatsapp will be a pain bc I manually compressed and saved the /media/com.whatsapp folder. I have used this method when I first got graphene and I remember encountering some issues, like, pics showing up grayed out in chats (they are in /media however)...
Thanks :-*)

DeletedUser711

fid03 I will try force shutting down, currently the phone boot procedure is still paused; would be an interesting experiment, even thought I am convinced, the data is gone.
Ill do this tomorrow, I need sleep.

Thanks for the support, Ill report back!