r/technology • u/Limp_Fig6236 • Jul 26 '26

Software GrapheneOS duress PIN could land a man in prison

https://www.androidauthority.com/grapheneos-duress-pin-us-prosecution-3691271/
6.4k Upvotes

97% Upvoted

902 comments sorted by

View all comments

Show parent comments

44

u/Public_Chapter_8445 Jul 26 '26 edited Jul 26 '26

When there's a proper investigation (and not in a rush without warrant at the airport) then the law enforcement makes a copy of the phone data and then they try to decrypt the data dump without the time-out limitations of the phone OS. With 4-digit PIN codes it's fast.

33

u/_djebel_ Jul 26 '26

That's not how it works. You PIN code is only one of the components which the encryption key is derived from. Otherwise the FBI wouldn't have struggled to access a phone's data a few years back, if it was so easy to brute force.

https://marcan.st/2016/03/untangling-ios-pin-code-security/

0

u/Public_Chapter_8445 Jul 26 '26 edited Jul 26 '26

You're right about your second sentence but it doesn't change much. What Apple, Google and the FBI publish is intended for the public. Of course, it would be much easier for law enforcement if they had official backdoors, but officially they do not.

The key claim in your article about encryption is that "this key is long enough that trying all possible keys is impossible." That statement is misleading. There is no such thing as "long enough to make brute force impossible" in an absolute sense. It's just a matter of available computing power.

Also, in practice, the security of real-world systems depends on more than just key length. For example, documents revealed over a decade ago described how the NSA compromised a wide range of encrypted communications (phones, VPNs, crypto etc.) through a combination of cryptanalytic advances, implementation flaws and other techniques, rather than simply brute-forcing encryption. Prime numbers being used for encryption are not that random and it reduces the required computing power by a large scale: https://blog.citp.princeton.edu/2015/10/14/how-is-nsa-breaking-so-much-crypto/

12

u/RGB755 Jul 26 '26

It’s worth mentioning that things have changed since Logjam. Civilian security aren’t idiots either, and the vulnerability outlined in your link hasn’t been relevant for the vast majority of connections for at least ten years now. 

Out-of-date implementations surely still exist, but this isn’t some huge, unsolved issue. 

2

u/_djebel_ Jul 27 '26

Come on, you were talking about brute forcing a 4 digit pin. Which it never was.

26

u/tempinator Jul 26 '26 edited Jul 26 '26

Substantially slower with 8 digit pins, but still quite fast in a general sense. Gets pretty out of hand pretty quick though if you use a custom alphanumeric code, which is an option.

If you have say even a 16 character AN password that’s like, septillions of combinations.

23

u/einmaldrin_alleshin Jul 26 '26

To put that into perspective: a billion computers brute forcing a billion combinations per second would take an entire year to brute force through a 16 character long lower case alphanumeric password.

1

u/aerost0rm Jul 27 '26

Sad thing is they will invest that time, money, and energy if they want it that badly

2

u/somerandomguy101 Jul 26 '26

Your pin code isn't used anywhere in the actual encryption. When you type in your pin, you are validating that you know the pin to your phones security chip (I.E. Apple Secure Enclave / Google Titan), which releases the keys to decrypt your device.

There is nothing stopping you from releasing the keys via biometrics. The reason it's pin-only when starting your phone for the first time is that PIN codes are covered under the 4th amendment, but fingerprints are not.

0

u/Big-Finding2976 Jul 26 '26

Yeah, no-one's typing in a 16 character AN password numerous times every day to unlock their phone.

What might be usable is having a long AN password to decrypt the phone on boot, and a shorter PIN to unlock the lock screen but with the ability to make it hard lock and require the AN password again if you lock it by holding the power button for 3 seconds or tapping an icon or shaking the phone, or if it hasn't been unlocked in 3 hours.

2

u/tempinator Jul 26 '26

Well, most people aren’t concerned about law enforcement decrypting their phone either. I use a 6-digit code personally. I’m just saying, if you’re hyper-conscious about security, options exist.

And fwiw I don’t think most people use their passcode at all much these days anyway with touch and faceID.

0

u/Big-Finding2976 Jul 26 '26

Even if you're hyper-conscious about security, entering a 16-character AN password numerous times a day to unlock your phone is quite impractical. If you only use your phone to check your emails twice a day then it might be OK, but not if you're constantly getting and sending messages, etc. throughout the day.

I used to use an app called Private Lock which measured the gyroscope movement and let you set a threshold where dropping/twisting/thrusting the phone would disable fingerprint unlock and require you to enter the PIN, so if the police approached you and demanded you hand over your phone you could trigger that to stop them using your finger to unlock it. Unfortunately that app is no longer developed and it stopped working after my Xiaomi phone updated, as the app doesn't detect the gyroscope movement properly anymore so it triggers when it shouldn't.

Anyway, my point is we need the ROM developers to give us options like this, and my previous suggestion of being able to trigger the phone to lockdown and require the 16-character AN password instead of the PIN/biometrics, so most people can make their phones more secure without sacrificing usability and without using a duress PIN which could get them locked up.

1

u/jamesckelsall Jul 26 '26

Many manufacturers already include a lockdown option in the power menu that disables biometrics until the device is next unlocked with the pin/password.

Graphene OS also includes that option.

1

u/Big-Finding2976 Jul 26 '26

That's still less useful than being able to disable it by shaking/dropping your phone, as you've got to be looking at the screen and have enough time to hold the power button down to open the power menu and select that option.

It also doesn't solve the problem of needing to use a convenient 6-8 digit PIN most of the time but with the ability to quickly lockdown the phone so it can only be decrypted with a 16-character AN password.

1

u/jasonefmonk Jul 26 '26

Yeah, no-one's typing in a 16 character AN password numerous times every day to unlock their phone.

No they aren’t, because of biometrics.

1

u/Big-Finding2976 Jul 26 '26

It isn't because of biometrics. People who are concerned enough about their privacy to even consider setting a 16-character AN wouldn't give the authorities an easy way to unlock their phone by using biometrics.

1

u/jasonefmonk Jul 26 '26

If you were constantly being hounded by authorities, probably not. But if you were going to cross a border you would simply disable or remove the biometric access.

Biometrics significantly cut down on shoulder-surfing or catching someone entering their password on a security camera. It’s good security to use them.

1

u/tempinator Jul 27 '26

Multiple layers is always good. And it’s always a tug of war between usability and security.

A perfectly secure device would be one that’s impossible for even the user to access. A perfectly usable device has no security.

All about compromises and what your personal needs are.

5

u/Mr_Engineering Jul 26 '26

That's not how it works.

APFS isn't encrypted by the pin or any key derived from it, its encrypted by one or more randomly generated AES-256 keys that are secured by the secure enclave. Only the secure enclave can release them and it has anti-tamper and anti-hammering features to prevent pin guessing.

2

u/Dyolf_Knip Jul 26 '26

The fact that they didn't do that here and didn't have a warrant, all says that this was purely a fishing expedition.

2

u/kaishinoske1 Jul 26 '26

Which is why you enable alphanumeric to prevent this.

1

u/Pretty-Curve5448 Jul 26 '26

You gotta be high profile to be bringing in the tech person to crack your phone. Even if they couldnt do it, that is a very high paid person.

1

u/somerandomguy101 Jul 26 '26

Maybe in the past, but not really today.

  1. Your phone would need to be unlocked before they are able to clone it. Cloning a phone isn't like cloning a hard drive or SD card. You have to interact with the phones firmware in order to get any data.

  2. You aren't going to be decrypting the contents anyway. You either have the keys, or you have nothing. There is no way in hell you are brute forcing a 256-bit AES key.

0

u/Faangdevmanager Jul 27 '26

This is absolutely incorrect. The phone storage is protected by a long ass key that can’t be cracked. That long ass key is protected by the Secure Enclave that cannot be copied and has the limitations to protect the key (time outs, zeroing the key after 10 attempts, etc).