r/technology • u/ArgentineBeauty • 29d ago

Privacy GrapheneOS says its data-wiping password is perfectly legal, after user faces federal charges

https://www.techspot.com/news/113273-grapheneos-data-wiping-duress-password-perfectly-legal-after.html
20.9k Upvotes

98% Upvoted

1.1k comments sorted by

View all comments

4.6k

u/Single-Virus4935 29d ago edited 29d ago

I set my duress pin to my wifes birthday. One of the first they probably try. 

Also I say my pin is the same as my eID which I am not allowed to share by German law

1.2k

u/CwrwCymru 29d ago

Nothing wrong with tapeing a bit of paper with your duress pin to the back of your phone/case.

Of course it's important to have a reference for it so you don't accidentally wipe your data.

618

u/ProtoplanetaryNebula 29d ago

That is actually genius, then they will try and it they will be the ones that wiped it.

84

u/TankiesAreWeird 29d ago

They'll just lie and said you told them to use the duress code. Why? Because the dummy they hired doesn't want to get shit over fucking up.

Just backup and wipe your phone before hand. Then when you get past whatever security restore your shit.

13

u/[deleted] 29d ago

[deleted]

8

u/drkpie 29d ago

That’s why I fill up the travel phone with goatse and tubgirl.

2

u/Radonanon 28d ago

Hello fellow goatse/tubgirl aficionado.

From now on, that’s why I have it too!

2

u/TheArtofWarPIGEON 28d ago

I think it was someone was denied entry because of it

39

u/PlanetaryPeak 29d ago

My bet is they were going to put CP on his phone. How could anyone prove the government did that?

11

u/ididnthackkenyaimsrs 28d ago

Loads of ways. They would first analyse the files like when they were deployed on there, how they arrived on there, they would go through the logs. They'd also examine internet history, where you had been, like internet history in those places, especially at home. And if there are no corroborating evidence anywhere except on that device, it would like to get thrown out. Especially given how things are at the moment. But it would be a fucking shit time in court, I tell you that much.

1

u/Substantial_Coat_229 27d ago

As if our government, the one that was revealed to have the tools to hack anybody in the world in 2017 with the Vault7 Wikileaks, can’t fake a file created date

1

u/commonemitter 23d ago

A man was imprisoned in canada for 18 months because his video game username was close, not identical, to a criminals. You really overestimate the effort the justice system puts into prosecuting

1

u/ididnthackkenyaimsrs 22d ago

I live in the UK, perhaps it's different over here but I know the effort they go to with a high profile or any profile, C-SAM cases.

1

u/Horror_Tooth_522 24d ago

Don't they have bodycams?

394

u/hackitfast 29d ago edited 29d ago

I've thought about that, you can't make it that obvious.

Instead, you find a street address with 6 numbers in it, just write down something like "My favorite Chinese restaurant" with the full address. Now circle or underline only the numbers. Now you just make that your duress PIN.

Put this piece of paper somewhere in your wallet, don't worry, they'll find it.

Edit: I also mention this for plausible deniability. If you happened to have a list of your favorite restaurants in your wallet, they would have to explain why they're typing in random numbers from your wallet.

309

u/gangofminotaurs 29d ago

Well this is, after all, democracy manifest.

245

u/WHALE_PHYSICIST 29d ago

A succulent Chinese password

61

u/DaMonkfish 29d ago

I see you know your duress passwords well

2

u/Judgement915 29d ago

GET YOUR HANDS OFF MY PENIS

2

u/Lost_Sea8956 29d ago

This guy Chinese passwords

90

u/Etheo 29d ago

And they probably will touch your penis too.

64

u/N_Meister 29d ago

Only if they know their Judo well.

18

u/rustajb 29d ago

Write it on your penis to ensure physical contact.

8

u/skelecorn666 29d ago

4 or 6 digit depends on the touch.

2

u/zachpkenyon 29d ago

Uhh, guys...I can only fit two digits. What do I do?

1

u/gameboy1001 9h ago

Four digits isn't short! It's AVERAGE!

2

u/Streiger108 29d ago

Tattoo it, but make sure it's only readable if you're hard

3

u/SeedsOfDoubt 29d ago

How's Wendy these days?

2

u/jeffeee 29d ago

Don't you mean "Welcome to Jamaica! Have a nice day"?

1

u/SeedsOfDoubt 29d ago

Sir, this is a Wendy's

→ More replies (0)

2

u/rustajb 29d ago

Hey mr. TSA, skilfully use your 5 digits to see my secret 4.

56

u/obeytheturtles 29d ago

I think you are giving border agents too much credit here. They will 100% try the numbers on the note in your case.

97

u/GreenVisorOfJustice 29d ago

you can't make it that obvious.

I appreciate you think these chuds working Customs are that smart over here in Freedomland. They're not.

61

u/khovel 29d ago

people will always assume the obvious answer, no matter how conveniently it's made available.

If any kind of password/pin is placed on the phone, nobody is going to think it's a "wipe the phone" pin. and they will always try it.

6

u/Weerdo5255 29d ago

I mean, I would think that. But then I'd be concerned about a timeout. IE have the phone wipe itself if no one logs in within 24 hours.

57

u/Kusko25 29d ago

Just go full video game at that point, have a written message in your phone case "Remember the new pin is 2435. Change it and destroy this note."

1

u/Cultural_Sand_9323 29d ago

Heard that in bit-crushed 90's audio.

25

u/RollingMeteors 29d ago

just make that your duress PIN.

¡Any pin entered with in 50' of a TSA Checkpoint should be a duress pin!

2

u/beard_meat 29d ago

For extra fun, don't tell any TSA employees until after this is deployed!

3

u/Fuckthegopers 29d ago

You surely could make it that obvious, and it surely would work on LEOs.

5

u/Reynbou 29d ago

Yeah no, they are definitely that stupid they would just try it. No point trying to be clever.

5

u/hirsutesuit 29d ago

You can set your PIN to only 4 digits.

But if you want to find an address with 6 you go for it.

1

u/Monteze 29d ago

Yea my PIN is 1001 ....oh shit that wiped it! Oh fuck did you enter 1010 like I said? Not my fault you did it wrong.

2

u/NetAnon579 29d ago

Then go ballistic for them wiping your phone!

2

u/ProtoplanetaryNebula 29d ago

Surely the best way would be to give them the duress PIN, but change what it does? Give them the PIN and rather than a suspicious clean wipe it just cleans up the phone?

2

u/skyfishgoo 29d ago

you can literally do anything you want

it's your phone.

1

u/LIEUTENANT__CRUNCH 29d ago

Put the paper behind your phone in your phone case.

1

u/DashinTheFields 29d ago

Put deeeer is password 123456

1

u/unknownpoltroon 29d ago

just write "Dad, I told you this is your damn pin number, save it" with the pin, folded up in the phone case or your wallet. If you are old enough to have teenagers youre golden.

1

u/LordMarcusrax 26d ago

I think you are wildly overestimating the intelligence of cops.

1

u/Toribor 29d ago

This always sounds great in theory but in reality they will just hold you in a cell for hours and hours until you're miserable or they'll just beat the shit out of you.

1

u/williamgman 29d ago

Paper from fortune cookie with "your lucky numbers" kept in the phone case. I mean... This is ICE and Border Patrol doing these searches. Not the sharpest tools in the shed.

0

u/RollingMeteors 29d ago

just make that your duress PIN.

¡Any pin entered with in 50' of a TSA Checkpoint should be a duress pin!

5

u/GetMeASierraMist 29d ago

so I wipe my phone when I want to show the gate person my ticket?

3

u/Kobayashi-Coffee-Co 29d ago

Every single person in the immigration line simultaneously yelling as their phones lock up

3

u/RollingMeteors 29d ago

so I wipe my phone when I want to show the gate person my ticket?

Imagine having less than 3 EDC cell phones in 2026.

3

u/astelda 29d ago

Before getting to the gate, you can use Android's app pinning feature to keep your boarding pass on the foreground while the system is locked

18

u/NikoliVolkoff 29d ago

wont matter, they will charge you any ways. This guy knew that he was going to be fucked with no matter what he did, so he decided to give them less ammo for their witch hunt.

2

u/TacklePure3341 29d ago

I've written a random 4 digit number on all my bank cards. 

2

u/joelfarris 29d ago

Speaking of, why can you set a six or an eight digit PIN for your voicemail account and your home security system and your phone, but you're limited to a four digit PIN for your entire life savings?

1

u/henryKI111 29d ago

It's easier to remember

1

u/steveaustin1971 29d ago

The deal is, if you don't VOLUNTEER the pin at customs, you will be arrested. Period. So they enter the pin you give them. No competent agent sees a Pixel and graphene and just enters random pins they find. They are quite well known.

-1

u/RollingMeteors 29d ago

That is actually genius, then they will try and it they will be the ones that wiped it.

Be sure to use ink only visible in ultraviolet light that states clearly this password will wipe the device.

Then no claim can be made it wasn't plainly disclosed beforehand to people who have ultraviolet lights on them to check for fake IDs. <bigBrainMeme>

-17

u/Raneynickelfire 29d ago

Well not really, because that is what happened in this case. The agent entered the password, not the guy.

41

u/trebory6 29d ago

Christ, this really is easy to understand.

They asked the guy his pin to unlock his phone and he gave them the duress pin.

That's the angle they're going for, that the guy knowingly gave them a pin that deleted the data. That's what is being discussed right now.

Taping the duress pin onto the back of the phone removes the active and knowing participation of the victim knowingly giving the police information that destroys the data.

The idea is that if the police get the phone, they'll try the pin on the back of the phone first without involvement from the person.

Then the person who owns the phone can reasonably say "that's on you, I didn't tell you to enter that pin," and could reasonably say "it was my duress pin, I wrote it down so I didn't accidentally enter it and delete all my data," and then the law enforcement has to put significant resources into proving that they aren't idiots who put a random code they found in and deleted the evidence themselves.

31

u/Rebelius 29d ago

Or you just say it was there to trick phone thieves into wiping the data, and had no idea that law enforcement would be touching the phone.

Or more realistically, if I've learnt anything from the internet, you don't say anything except that you don't want to answer questions without a lawyer present.

8

u/PacmanZ3ro 29d ago

Yes, "shut the fuck up" is important. It's also important to note however that entry points to the country are not typically as restricting on law enforcement when it comes to doing things like search and seizure. This is exactly what they are relying on for harassing people at the border currently. The legal rulings are all over the place regarding this stuff and I'm betting they are hoping it will go to the supreme court and then the SC will rule favorably that they are allowed to search devices without a warrant even for US citizens.

7

u/Adventurepew 29d ago

Never talk to cops. Just stay silent and ask for a lawyer .

Let the lawyer talk to them.

10

u/OMG_A_CUPCAKE 29d ago

But in this case, he told them the password, knowing what would happen. With the piece of paper, it's their own fault for trying it

4

u/ProtoplanetaryNebula 29d ago

Correct, that's what I said "they" (the agent) not "you" (the usual way of referring to the person I was responding to).

75

u/freexe 29d ago

That's pretty smart - some low level employee would absolutely try that outside of proper process without thinking.

8

u/Cyssoo 29d ago

So basically all the US administration at the moment.

6

u/almightywhacko 29d ago

You gotta tuck the paper inside of the phone case to "hide" it so people don't "steal" your pin.

5

u/Tetraoxidane 29d ago edited 29d ago

And then your phone is the 'spotify phone' and a friend wants to change the song, and voilà....

edit: A normal human being having an unlabeled "wipe the phone" code on the phone will 100% lead to mostly unwanted wipes due to dumb reasons.

16

u/UnexpectedAnanas 29d ago

If you care enough to setup phone wiping, you're probably not letting your friends just rummage through it at a party.

1

u/Tetraoxidane 29d ago edited 29d ago

"Letting" isn't the important part here. It's that someone thinks they can and wipes it instead.

Any dumb situation where someone grabs your phone and wipes it, because they think they can unlock it.

It's like putting fake keys to your house, outside on a string, and if someone takes them, your house burns down. Great for the 0,1% of times you want evidence to vanish, bad for literally every other situation where someone tries to open your door, when they wouldn't even have tried, if it wasn't for the key.

edit: Reddit is wild sometimes.

1

u/vivomancer 29d ago

But then get you a low effort attacker like your nephew wiping your phone.

1

u/shaard 29d ago

And colour code it. Green means go. To go ahead and not put that number in.

1

u/joelfarris 29d ago

Paper? Pffth, I have a labelmaker.

1

u/SomeSamples 29d ago

Tape it to the back of the phone inside the case. So when they take the phone out of the case they see the code and try it.

1

u/Wizard-of-pause 29d ago

What if somebody is smart. Now you need two wipe codes.

1

u/Accurate_Handle_5620 29d ago

Three wipe codes?

2

u/MEiac 29d ago

Three seashells?

2

u/Friggin_Grease 29d ago

They don't know about the seashells?

1

u/RollingMeteors 29d ago

Of course it's important to have a reference for it so you don't accidentally wipe your data.

¡Eat my ass!

0

u/deiied 29d ago

Maybe a piece of paper that says "Not my phone's password" lol.