Duress Mechanism

Trizzo

Devs I have a request. One that may be insane but something that's just crossed my mind with the duress mechanism.

In my opinion I'm not exactly sure the current duress setup is deniable to adversaries. What I propose is something that may help the plausibility of it all.

Here's my idea:

First, when you activate the duress pin, another profile is automatically created that's linked to the password.

This profile will be used as a 'decoy' user as the rest of the phone gets wiped. This decoy user must be customizable so u can add apps to it to make it look plausible.

So it would work like this:
You type the duress pin, the decoy user opens up and the adversary can inspect decoy user. Then while that is being inspected, in the background the phone is being wiped (maybe run the decoy user in ram or something) then when the phone is on next reboot, the corruption screen shows.

Thoughts?

otterfoghornrainfall

Trizzo This and similar concepts have been brought up numerous times, please do a search of the forum in the future. Note the response from user matchboxbananasynergy in this thread, in which they are speaking for the project (they are not currently involved but their response stands). It would not provide meaningful protection and thus is not considered for implementation.

Trizzo

Well you look at veracrypt and other projects like this and even though their mechanisms are known, its extremely hard and in some cases impossible for the adversary to prove there's a hidden volume. Why can't this be like that?

Because the way things are now, the duress mechanism is meaningless if they know you triggered it. In this case the adversary will be more angry than before making your outcome worse for using the duress feature. Imo if it doesn't adapt and evolve it will end up being meaningless bloatware and mere 'privacy theater'. If the real world use case isn't thought of, whats the point of having it?

As we see with the most recent use case of the duress pin, it actually makes things worse off for those who use it so I don't think saying 'they'll know about it so we won't implement it' is a good enough reason to not do something. They already know about the duress feature and it was already implemented.

Carrousel7956

Trizzo https://veracrypt.io/en/Wear-Leveling.html

Carrousel7956

There's so many reasons beyond the fact it's not possible.

Trizzo

Carrousel7956 yes I see the wear leveling thing (which is why harddrives are better) and using a live system etc. Which is a different discussion about OPSEC altogether but look, I'm not going to pretend like I'm some expert out here, so if smarter people than I say there's more to this that makes it impossible then I'll leave it alone. I just wish there was a way... 😔

Carrousel7956

Trizzo just wish there was a way... 😔

It wouldn't be good idea even if there was a way imo

Trizzo

Carrousel7956 I've read most of the other thread and people say it could be worse if the adversary finds out what you've done even if the mechanism is hidden for a while, but the same does go for the current implementation? Like the guy that wiped his phone at the us boarder and now he could be in more trouble than letting them image his phone.

Imo the only way to fight duress is to have a deniable way to navigate it, mind you wiping the device no matter how sneaky it happens, will ultimately make itself known at the next reboot so there's that. 😆

Jack-schidt

Trizzo
The Duresspin/password does not protect the device user in any scenario what so ever. In fact it probably increases their jeopardy. What it does 100% is protect anyone who's data/details are in your phone when its triggered. Its not a silver bullet and on many cases using it will get you incarcerated at best or killed.

Carrousel7956

Jack-schidt the hidden profile idea gets bad when there's a violent adversary. There's no way to prove you have given up all data unless you have a hidden partition set up and give out both keys. Innocent users without a hidden partition to disclose would be in trouble.

Hypothetically it works in a fair court system but it's never been tested.

Carrousel7956

Jack-schidt That could be 100s of sources if you're a journalist. whistleblowers, leakers, activists, etc.

It helps all GrapheneOS users if their password is coerced because adversary must consider not entering at risk of deleting the data.

de0u

There have been so many posts about this in so many threads. I think it is safe to say:

The idea is appealing
The GrapheneOS developers have firmly said they plan not to build anything like this in the foreseeable future
Thus posting here about the idea being appealing will not lead to the GrapheneOS team working on it for the foreseeable future
Thus people who really want this feature should build it, or hire somebody to try to build it.

It's kind of like perpetual-motion machines and/or "reactionless thrusters":

The idea is appealing
Physicists say it can't be done
Thus telling physicists how appealing the idea is will not lead to the physicists working on it in the foreseeable future
Thus people who really want a perpetual motion machine / reactionless thruster should build it, or hire somebody to try to build it.

To be clear, a reactionless thruster would genuinely be great. The idea genuinely is appealing.

Jack-schidt

de0u There have been so many posts about this in so many threads. I think it is safe to say:

Search the forum before you start a discussion on your 'light bulb' moments, next best thing for GrapheneOS...

Cellobright

Here is a fun logic I think would explain why any "duress" feature against any person with capacity to punish you would be bad:

You exercise your right to silence/right to not incriminate yourself and do nothing:
- Good authority: Does nothing, respects your rights and await a trial
- Bad authority or criminals: Treat you badly and use inhumane/illegal tactics
You do something and therefore forfeit your right to silence/right to not incriminate yourself:
- Good authority: Can either charge you for obstruction of justice or deceiving the authority (any form of duress is either of these) or both
- Bad authority or criminals: Treat you badly and use inhumane/illegal tactics, but worse than before

In case you need to wipe your data irreversibly, the current duress feature is sufficient, and implementing these complex features would not only weaken the security of the OS but also your security.

Handlebar6933

Trizzo Even something like a hidden veracrypt volume needs to be carefully used because opening it inside Windows, for instance, will leave forensic evidence of its existence in many locations. Properly integrating something like this inside Grapheneos would be much more complex than it appears to be.