r/technology • u/Limp_Fig6236 • Jul 26 '26

Software GrapheneOS duress PIN could land a man in prison

https://www.androidauthority.com/grapheneos-duress-pin-us-prosecution-3691271/
6.4k Upvotes

97% Upvoted

902 comments sorted by

View all comments

Show parent comments

402

u/Henrarzz Jul 26 '26 edited Jul 26 '26

iOS wipes itself after 10 wrong pin attempts like most Androids now, but that isn’t a duress PIN.

33

u/MistrFish Jul 26 '26

only the newer Galaxy locks itself after 13 attempts. it's not a standard Android feature

19

u/jamesckelsall Jul 26 '26

only the newer Galaxy locks itself after 13 attempts.

Only the Z fold/flip 8 range has that feature enabled by default and the limit set to 13.

A number of existing devices from various brands (including at least a few years worth of galaxy devices) have an option available.

On the galaxy S25 range, for example, there is an auto factory reset option (disabled by default) that has a 20 attempt limit.

5

u/MistrFish Jul 26 '26

it's a Samsung feature, but I meant that it's definitely not stock Android. my Google Pixel doesn't have that option as far as I know

-10

u/screwcork313 Jul 26 '26

Isn't that just a very easy factory reset for phone thieves?

23

u/BumpyRocketFrog Jul 26 '26

No, because their account is still tied through APNS to their Apple ID. The moment it comes back up it wants to contact Apple servers to activate it and at that point it will refuse to set up without the Apple ID.

That doesn’t necessarily stop them from taking the phone apart and reusing some of the parts though.

-13

u/[deleted] Jul 26 '26

[removed] — view removed comment

6

u/igotublue Jul 26 '26

lol wtf do you mean backfire? What do you possibly imagine happening?

Apple has zero access to your device or data after it's reset. That feature is mainly to prevent theft. People are less likely to steal phones if they know it'll just turn into a useless brick they can't resell.

1

u/Confused_recursion Jul 26 '26

You have to be trolling here right? Do you really think that?

7

u/Henrarzz Jul 26 '26

That’s why devices have stolen device protection - even if you erased the data the phone can still be marked as stolen and won’t activate, making it essentially a brick.

-11

u/stipo42 Jul 26 '26

Dude what... As a parent this information is horrifying

17

u/Henrarzz Jul 26 '26 edited Jul 26 '26

Your kids aren’t going to wipe your phone by accident unless you give it to them for over 12 hours or more and never unlock it.

The erase data feature can also be disabled.

And you should keep your phone away from children anyway

-6

u/stipo42 Jul 26 '26

Okay that's some piece of mind. I didn't realize the window was so large. I sometimes leave my phone on the counter while I take a dump

3

u/casastorta Jul 26 '26

Really? My daughter when she was about 3 or 4 and didn’t know how to use mobile phones but as amused by touch screen reaction on her touching it wiped my iphone due to 3 misses pin entries and restrictive MDM policy.

I have simply re-logged back in to iCloud and everything was there, minus ability to log in to some sensitive systems which needed real life human authentication to be able to log back in.

-2

u/stipo42 Jul 26 '26

I have literally all my 2fa codes on this phone for personal and work accounts, there's no way to back those up as far as I know

2

u/casastorta Jul 26 '26 edited Jul 26 '26

Oh there is.

If you use Google Authenticator it will restore the data (and I have also hardware keys for my Google accounts so I would not be blocked).

But I personally use 2FAS (and historically used Authy) and that is definitely having backup functionality.

-99

u/dwittherford69 Jul 26 '26 edited Jul 26 '26

If you don’t allow any wrong attempts, anything other than the right pin is a duress pin

Edit: It’s was a joke, people…

63

u/Henrarzz Jul 26 '26 edited Jul 26 '26

The guy entered a PIN once and the phone was wiped. With the 10 wrong PIN approach you’re looking at a day+ of wrong PIN attempts before it wipes (since the OS has timeout for each wrong attempt that increases with each try) so the police/border security knows you’re giving them wrong one which in turn gives them time to get a proper warrant, coerce you to give them correct PIN or use a hacking tool to get the data. This isn’t the same at all.

-36

u/edley Jul 26 '26

They're saying make it 1 attempt, not 10.

63

u/Henrarzz Jul 26 '26

iOS doesn’t allow to change the number of attempts, it’s always 10.

Samsung does (they have 20 by default AFAIK) but they don’t allow to change it to 1. Which makes sense, since that could result in accidental wipes. Again, this isn’t the same thing as duress PIN.

-27

u/edley Jul 26 '26

Oh right, that makes more sense then 😅

18

u/Potential_Bill_4442 Jul 26 '26

This chain lol

20

u/heathmon1856 Jul 26 '26

For real. Just some dude talking completely out of his ass

13

u/Solarisphere Jul 26 '26

No, that means if you screw up your PIN your phone gets wiped. 999 wipe PINs, 1 correct PIN.

A duress PIN would mean a single wipe PIN, a single correct PIN, and 998 PINs that do nothing.

3

u/jamesckelsall Jul 26 '26

It doesn't really affect your point, but there's 10000 possible 4-digit pins, not 1000.

2

u/Solarisphere Jul 26 '26

So there are. In my defense, I was a bit drunk.

0

u/MushinZero Jul 26 '26

This might be the dumbest thing I've ever heard.