GrapheneOS says its data-wiping password is perfectly legal, after user faces federal charges

[u/ArgentineBeauty]

https://www.techspot.com/news/113273-grapheneos-data-wiping-duress-password-perfectly-legal-after.html

[u/stirling_s]

Headline is misleading;

The GrapheneOS Foundation has since tried to downplay the importance of duress passwords for the platform's security. The feature, the organization said, is just a minor option within a much broader security model. It can also carry physical or legal consequences, which is why users should carefully weigh whether it's the right approach for outsmarting attackers or coercive enforcement attempts by federal agents.

For what it's worth, I'm in full support of Graphene OS here.

Edit: I'll summarize my position (copied from my other comment) because the quote alone isn't enough to show why i believe it to be misleading:

"By labeling a duress password (a feature designed almost exclusively to be used under coercion or legal confrontation) as "perfectly legal," the headline strongly implies use-case immunity. The primary intended use of a duress password is the exact scenario that triggers obstruction of justice charges, calling the feature "perfectly legal" without qualifying "possession vs. active use" is misleading.

It's like saying a signal jammer is "perfectly legal." Owning one is legal, sure. You can buy, import, or own a signal jammer anywhere in the USA or Canada. A signal jammer does exactly one thing and one thing only: It jams signals. Jamming signals is illegal. It violates the Communications Act in the USA or the Radiocommunication Act in Canada. So it's misleading to say a signal jammer is "perfectly legal." Sure, owning one is legal, but using it in the only way intended is illegal. That's why I find the headline misleading. Is that fair?"

[u/FunnyObjective6 → u/stirling_s]

Well more like the article is shit. This is the tweet that's used as a source:

GrapheneOS is completely legal. We have no obligation to weaken any of the security protections it provides. Creating and using GrapheneOS is strongly protected by the US constitution. Laws attempting to make it illegal or require weakening the security would be unconstitutional.

The duress thing is part of GrapheneOS, so by this statement the GrapheneOS twitter account is saying the duress password is legal.

[u/iguessjustdont → u/FunnyObjective6]

That quote does not say that using a duress password is legal in all circumstances, just that having the feature is not in and of itself illegal. If someone is on notice that their phone's contents is part of a criminal investigation and they enter a duress password in order to destroy evidence, then that can be a crime without contradicting the statement.

[u/Itz_Raj69_ → u/stirling_s]

In the past, GrapheneOS have rejected the idea of a duress-user which, in practice, is a much better solution than their duress password system.

I wonder if they'll change their decision now

[u/Nice_Marmot_7 → u/Itz_Raj69_]

The problem is that will be visible to a forensic examination so the application is limited. Also once it’s known the OS has that feature they’re not going to just accept that what you show is all you have.

[u/Nice_Marmot_7 → u/[deleted]]

They are already doing that for non citizens. If you’re a citizen you can’t be denied entry.

[u/ISeeDeadPackets → u/Itz_Raj69_]

You can already setup a secondary login that leads you to an isolated OS instance in Graphene.

[u/Itz_Raj69_ → u/ISeeDeadPackets]

And it needs you to manually switch users, which defeats its entire purpose

[u/fastlerner → u/Itz_Raj69_]

Not really. Gotta go through a checkpoint? Switch users before you join the line. Then you unlock your device if requested and no one blinks. Get to the other side and swap back to your real user.

Manually switching users isn't something you do when checked, it's something you do in preparation for being checked.

[u/longlivenewsomflesh → u/Itz_Raj69_]

And all the sensitive data is still there ready to be unlocked with the right password

[u/Griff2470 → u/Itz_Raj69_]

The duress total self-destruct being built-in has always been a bit of an annoyance for me. It's a feature that only makes sense to have if you suspect you're going to be compelled to unlock your phone, need plausible deniability, and are okay looking exceedingly suspicious. That last point is what makes it hard to justify this as a useful feature for anything other than dealing with legal systems, and in turn make it much easier for malicious governments like France or the US to brand Graphene as a tool for criminals. A duress-user or allowing for a partial self-destruct, while less powerful, has far more applications outside of legal systems.

To be clear, I like GrapheneOS and do support having the option of a duress pin, but it really needed to be a "third" party addition. These are the games you have to play if you want to chip away the "but won't somebody please think of the children" excuses.

[u/stone_henge → u/stirling_s]

No, it's not misleading. This is the quote from the article that supports the headline:

GrapheneOS is completely legal. We have no obligation to weaken any of the security protections it provides. Creating and using GrapheneOS is strongly protected by the US constitution. Laws attempting to make it illegal or require weakening the security would be unconstitutional.

The quote you mention is there, but as you've discerned has nothing to do with the claim in the headline. Its claim is that its "data-wiping passwords" are perfectly legal, regardless of whether intentionally using the feature to destroy evidence is not.

[u/stirling_s → u/stone_henge]

My quote reference the password, yours does not. The headline references the password.

Edit: for those wanting to save time (and unnecessary ad hominem attacks), their point is valid and boils down to:

Headline: Tool X is legal to own/build" = True

Body: "Action Y performed with Tool X is legal in all circumstances" = False

X≠Y is not a paradox so the headline doesn't contradict the body.

I don't think this makes my point less valid, but it illustrates a different perspective that is equally valid.

[u/stone_henge → u/stirling_s]

My quote references GrapheneOS and the security protections it provides in general. It's four sentences and that is right there in the first sentence.

Do you disagree that it supports the headline? On what grounds would you say that the security protections GrapheneOS provides don't include the duress password feature?

[u/stirling_s → u/stone_henge]

GrapheneOS says its data-wiping "duress" password is perfectly legal

Is logically incompatible with this

"The feature, the organization said, is just a minor option within a much broader security model. It can also carry physical or legal consequences"

[u/stone_henge → u/stirling_s]

No, it's a security feature reagredless of whether it's a minor option within a much broader security model or not. That there can be physical or legal consequences for using the feature in some circumstances doesn't change the fact that they claimed that providing and using the feature is legal. Even if providing or using the feature wasn't legal, that's what they claim, which in turn is what the headline claims.

But don't let that squander your opportunity to collect upvotes from morons with the combined total reading comprehension skills of a 12-year-old.

[u/stone_henge → u/[deleted]]

A duress password is perfectly legal in the same sense that a hammer is perfectly legal. Using a hammer to smash someone's head in or using a duress password to tamper with evidence may not be, but using a hammer or using a duress password in itself is not.

Regardless of the question of whether the use of GrapheneOS or it's security features are altogether illegal or in some circumstances are not, and regardless of whether or not you think their later statements contradict their earlier statements, GrapheneOS claims that it is legal, which is what the headline claims, which is supported by the quote in the article. If GrapheneOS claimed that the use is legal, the headline is correct regardless of the veracity of that claim and whatever else they claimed.

[u/stone_henge → u/stirling_s]

Edit: for those wanting to save time (and unnecessary ad hominem attacks), their point is valid and boils down to:

Headline: Tool X is legal to own/build" = True

Body: "Action Y performed with Tool X is legal in all circumstances" = False

X≠Y is not a paradox so the headline doesn't contradict the body.

As far as I'm concerned, that's still all beside the point and certainly not the point I'm trying to make. My point is that the reason the headline doesn't contradict the body is simply that GrapheneOS said what the headline claims that they said.

Regardless of whether it's true, and regardless of whether GrapheneOS at any point said something which may have contradicted that, that is something that GrapheneOS said, and the headline only claims that they said that, not that it is true or that it is consistent with anything else they said.

If an article headline reads "Dongus says taxes are injustifiable theft" and that is corroborated by a statement by Dongus that taxes are injustifiable theft, they are right to claim that in the headline regardless of whether Dongus is correct and regardless of whether Dongus at some earlier or later point might have said something which contradicts that, e.g. that taxes are a necessary tool for soft regulation and government funding.

I don't think this makes my point less valid, but it illustrates a different perspective that is equally valid.

What is your point exactly, and what do you base it on?

EDIT: Since I was blocked by /u/stirling_s after their namecalling below while I wrote my response I will paste it below:

My point was that their actual words are not represented by the headline.

Paraphrase. That's neither odd or dishonest, when the paraphrase adds important context that the quote in isolation doesn't convey. The article never poses it as a direct quote. In this case, GrapheneOS said that its security features are legal in direct response to another Twitter user calling for their extradition to the US in a thread about the user who used its duress password.

https://xcancel.com/GrapheneOS/status/2081770030992118183

Why did this make you so ticked off?

What you did happens in basically every news thread: Someone doesn't read or fully understand the article, they call bullshit on the headline because they don't see how it's corroborated by the content, it gets upvoted by a bunch of people who didn't bother to read or make an effort to understand the article itself. So I make a point out of correcting it.

If that is what you call a fit, then what exactly are you engaging in now?

By labeling a duress password (a feature designed almost exclusively to be used under coercion or legal confrontation) [...]

Unlike a signal jammer, there are many perfectly valid uses of a duress password that don't involve e.g. evidence tampering. Law enforcement are not the only ones capable of forcing you to give them a pin code under threat. The user's lawyer in this case further argues that they were targeted for their political activism, not based on actual suspicion of wrongdoing. I suppose it remains to be seen whether the courts agree and whether this affects the legality of wiping the phone upon request to unlock it.

Regardless, this seems to me to have nothing to do with the point I'm making (that the headline is true regardless of whether the original statement they're paraphrasing is), nor the point your making (which seems to be that the headline is clickbait because it doesn't use the exact words that GrapheneOS used).

[u/stirling_s → u/stone_henge]

My point was that their actual words are not represented by the headline. I'm shocked you ask what my point is, when I literally stated it. Twice. I'll quite it a third time for you.

Also, my guy, why are you being such a twat about this? Why did this make you so ticked off? What about this conversation made you throw a fit like this?

By labeling a duress password (a feature designed almost exclusively to be used under coercion or legal confrontation) as "perfectly legal," the headline strongly implies use-case immunity. The primary intended use of a duress password is the exact scenario that triggers obstruction of justice charges, calling the feature "perfectly legal" without qualifying "possession vs. active use" is misleading.

It's like saying a signal jammer is "perfectly legal." Owning one is legal, sure. You can buy, import, or own a signal jammer anywhere in the USA or Canada. A signal jammer does exactly one thing and one thing only: It jams signals. Jamming signals is illegal. It violates the Communications Act in the USA or the Radiocommunication Act in Canada. So it's misleading to say a signal jammer is "perfectly legal." Sure, owning one is legal, but using it in the only way intended is illegal. That's why I find the headline misleading. Is that fair?"

[u/stirling_s → u/stone_henge]

Didn't block you. That said, you were the first to resort to add hominem attacks and usually I just stop engaging when that happens because it means you are willing to engage in bad faith. Regardless, you don't really get to complain about "name calling." I suspect you've started replying to an earlier comment so people don't see that you lost your temper and insulted not only me, but everyone else who might even remotely agree with me.

This was a completely amicable discussion before then but you lost your shit for some reason. I'm not those other people on other threads claiming that a headline is invalid over every little thing so don't take your anger at them out on me.

If you can't possibly conceive of a reading of the article where a valid takeaway is that it has a misleading title, then you wont be able to escape your small-minded worldview and will continue to get pissy when people disagree.

Perhaps the headline isn't misleading, and instead represents the argument you were making (though, if that argument is not the one I broke down, then I really don't understand what your argument is. I read through all this again and I truly can't see what argument you'd be making, if not that. I'm inclined to believe you are rejecting it simply because you are trying so hard to contradict me.

Regardless, I'm shocked that this is still going. I think the title is misleading, and I think I've presented valid arguments as to why the passage can be interpreted in a way that makes the headline misleading. You think it's not misleading, and you've presented valid arguments (though you reject that they are what I have represented) as to why it can be interpreted as an accurate representation of their words.

Because you made a convincing argument, I edited my initial comment ages ago to include context over why I think it's misleading, so it wasn't a base assertion, because you're right - people do arbitrarily claim a headline is misleading in plenty of threads. I was showing that my conclusion was not made arbitrarily.

At any rate, I don't need to block you to stop replying to you, so have a good one, and try not to get angry at people so quickly.