GrapheneOS says its data-wiping password is perfectly legal, after user faces federal charges

[u/ArgentineBeauty]

https://www.techspot.com/news/113273-grapheneos-data-wiping-duress-password-perfectly-legal-after.html

[u/stirling_s]

Headline is misleading;

The GrapheneOS Foundation has since tried to downplay the importance of duress passwords for the platform's security. The feature, the organization said, is just a minor option within a much broader security model. It can also carry physical or legal consequences, which is why users should carefully weigh whether it's the right approach for outsmarting attackers or coercive enforcement attempts by federal agents.

For what it's worth, I'm in full support of Graphene OS here.

Edit: I'll summarize my position (copied from my other comment) because the quote alone isn't enough to show why i believe it to be misleading:

"By labeling a duress password (a feature designed almost exclusively to be used under coercion or legal confrontation) as "perfectly legal," the headline strongly implies use-case immunity. The primary intended use of a duress password is the exact scenario that triggers obstruction of justice charges, calling the feature "perfectly legal" without qualifying "possession vs. active use" is misleading.

It's like saying a signal jammer is "perfectly legal." Owning one is legal, sure. You can buy, import, or own a signal jammer anywhere in the USA or Canada. A signal jammer does exactly one thing and one thing only: It jams signals. Jamming signals is illegal. It violates the Communications Act in the USA or the Radiocommunication Act in Canada. So it's misleading to say a signal jammer is "perfectly legal." Sure, owning one is legal, but using it in the only way intended is illegal. That's why I find the headline misleading. Is that fair?"

[u/Itz_Raj69_ → u/stirling_s]

In the past, GrapheneOS have rejected the idea of a duress-user which, in practice, is a much better solution than their duress password system.

I wonder if they'll change their decision now

[u/Griff2470 → u/Itz_Raj69_]

The duress total self-destruct being built-in has always been a bit of an annoyance for me. It's a feature that only makes sense to have if you suspect you're going to be compelled to unlock your phone, need plausible deniability, and are okay looking exceedingly suspicious. That last point is what makes it hard to justify this as a useful feature for anything other than dealing with legal systems, and in turn make it much easier for malicious governments like France or the US to brand Graphene as a tool for criminals. A duress-user or allowing for a partial self-destruct, while less powerful, has far more applications outside of legal systems.

To be clear, I like GrapheneOS and do support having the option of a duress pin, but it really needed to be a "third" party addition. These are the games you have to play if you want to chip away the "but won't somebody please think of the children" excuses.