GrapheneOS protections against data extraction from locked devices

Pocketstar

ejns
I know it can be tempting to do this, but it is best practice to provide as little information as possible in order to optimize security, especially when lives depend on it, especially with corruption at play. The less people know the better.
Denying can be used as evidence as much as admitting can in an interview/interrogation.
Best not to share any tactics at all with enemies like corrupt law enforcers or worse, playing games with them can introduce all sort of caviats in the law they can use against you or use as psychological operations to break one's mind, furthermore, they can draw a profile of you based on how you play dare with law enforcement. (Which can haunt you in court afterwards, it may not look good in front of a jury)
Simply give them nothing to work with, the less you provide, the less they can use against you.
Best to say nothing and ask for a lawyer.
No offence, bit I'm just saying this to keep you and others as safe as possible when confronted with folk that are not interested in human rights.

ejns

Pocketstar Fair enough; you're right. Best not to play games in these situations.

GrapheneOSuser74

What about a feature which brings the phone back to BFU state by restarting the phone after a certain amount of wrong PIN attempts? This kind of feature should make more harder to brute force the pnone rather than delay in my opinion.

Another possible feature(which one would be great, but hard to make unfortunatey): A secondary PIN which unlocks some kind of hidden profile, intended for a special situations. Just like VeraCrypt hidden volumes.

Novaliss

GrapheneOSuser74 What about a feature which brings the phone back to BFU state by restarting the phone after a certain amount of wrong PIN attempts?

It is kind of what we already have. The adversary tries and fails, the Titan steeply throttles, the time runs out and the reboot happens.

Novaliss

GrapheneOSuser74 kind of feature should make more harder to brute force the pnone rather than delay

And it isn't the case that successful brute-force entries actually happens within this delay.

DeletedUser1041

ejns "gee officer, I'd love to cooperate but I'm invoking my 5th amendment right and am uncomfortable speaking any more without my attorney present"

Not an attorney but this is basically how my attorney said to handle basically any cop or fed interaction.

DeletedUser1191

DeletedUser1041 according to the article he asked for a lawyer 4 times but it remains to be seen if any of the law enforcement's actions will absolve him from any responsibility.

Law by Mike always says, "the place to fight is in court, not on the road". If they were only asking verbally I got to say he doesn't have a great excuse for wiping it.

warampos22

@GrapheneOS Do you still analyze reports extracted with forensic tools like Cellebrite? A lot of people in my country claim that GrapheneOS has been compromised or "broken," but no one has provided any actual evidence. I'd be interested to see whether there's anything in the extraction reports that supports those claims.

GrapheneOS

warampos22 No one has ever posted any evidence of any ongoing exploitation of locked GrapheneOS devices or a bypass for Titan M2 rate limiting. Recent Cellebrite Premium documentation shows it can't exploit locked GrapheneOS devices updated past a patch level in 2022 and can't bypass Titan M2 rate limiting even on very outdated devices. You're talking about people making completely unsubstantiated claims which anyone can do about anything.

DeletedUser1191

warampos22 I also had someone who made unsubstantiated claims to me that it can be broken in to in Russia by their authorities. I should ask where they heard it.

They also thought using a desktop would protect them better :( and that the OS doesn't need security features if you don't install untrusted software. So obviously not someone to listen to for that advice but im still curious where he heard the bad-mouthing of GrapheneOS.

If you don't mind sharing, what country are you referring to and where did this rumor start as far as you know?

Norman

warampos22

It's entirely possible that someone used a fake closed-source fork from GOS that was called GOS by buying it from some shady reseller or a police plant, ended up getting compromised and blamed GOS.
There are cases of device extractions being succesful on GOS, but those are exclusively limited to devices which were obtained unlocked or the passcode was shared at which point the device was unlocked.

DeletedUser1041

Norman and people forget there are cameras absolutely everywhere now and if someone types a pin or password in front of one even once it's now at risk. Pin scrambling and a privacy screen protector help but still..

pixel---fold

DeletedUser1191

how else would they ask it for?

pixel---fold

And what about having a special pin that instead of wiping the phone, redirects to a special profile? Like if we created another separate profile and it would simulate a normal phone account? Instead of wiping, so it would be more credible?

DeletedUser1191

pixel---fold not possible afaict due to low level way SSDs work on Pixels.

ToxicArgon

GrapheneOS Sounds too good. However, l've got an android phone which was bought in 2010. It's lying waste with me. If l revive the necessary hardware components, would Graphene OS work on it if l load into it ?

userofgos

ToxicArgon If l revive the necessary hardware components, would Graphene OS work on it if l load into it ?

No. See here: https://grapheneos.org/faq#supported-devices

tplestid

GrapheneOS

Take care wrt Duress password, i originated that patent , probably still owned by BlackBerry.

https://ppubs.uspto.gov/api/pdf/downloadPdf/US-20070015490-A1?source=US-PGPUB&requestToken=eyJzdWIiOiJmMmVjYjQyOS0xNjM4LTQzODYtYjQyMS04Yzg0ZjM0YWRkNTkiLCJ2ZXIiOiJkZmZiZTYyNS00Yjg4LTRhNDItOGFkYS0yY2QyMTE5YTU5ZjQiLCJleHAiOjB9

DeletedUser1191

tplestid me downloading random pdf from
. gov website

This-is-fine.jpg

Secure pdf viewer save me

« Previous Page Next Page »