this was a streisand effect for me because i didn't have duress password set up on my grapheneos phone (security & privacy => device unlock) before but i do now! :D
best promotion ever haha What is it? FU-123?
I imagine the best duress PIN is something you'd actually see a "normal" person set as a PIN, like their birth year or something innocuous and easy to remember (and easily believed by whoever's demanding your PIN), while their real PIN would be longer or more abstract.
Honestly I would use a stupid basic one that someone might try and use if they were guessing. Like a duress pin of 1-1-1-1, 1-2-3-4 or 2-4-6-8. It gets the people who take the device and then try and break into it without your permission as it's almost certain they will at least try one of those three.
Worst case scenario they ask you and you say what it is and they give you a blank stare of "really?..." it's not like they wouldn't try a pin you gave them.
I don't recommend a duress password of 1-1-1-1, because that could be set off accidentally.
Or those common dumb ones could be attempted by someone just trying to snoop on your phone.
Yeah, you actually gotta remember it too! So a 1234 pword is kind of great
On GrapheneOS, you can also set a "second factor PIN" in the unlock settings under "Fingerprint Unlock", so that to unlock your screen you need to first use the fingerprint unlock and then separately enter your PIN. This means BOTH are required every time you unlock. Your phone can't be unlocked unless it's your finger AND unless you enter the PIN that only you know.
And under the Screen Lock settings you can also enable "Scramble PIN input layout", so that the number buttons on your unlock screen will be out of order, so people watching you or recording you can't just make note of the shape your index finger is making when touching the numbers to unlock your phone(like people looking over your shoulder or recording on store security cameras).
This is why I'm never going to the US until all this shit is fixed. Which will probably be never
Tourists going to the US and US residents leaving should take a burner phone.
Citizens too, at this point.
I lost interest of ever visiting again when they started collecting fingerprints from everyone visiting.
Where are you located? Biometric passports needs your fingerprints since ages already.
Ages.... You young ones... (decades, yes)
Locally I am okay with it (possibly not having a choice anyway) but you got shafted post 9/11. So I was there a few times before that.
I can travel freely in the EU.
Good. Annoying to rebuild his phone, but better than handing it to fascists who don't even have a lawful court order for it.
In all likelihood they kept his phone and will retain possession until charges are dismissed. Get a burner phone and wipe it before going through security. I assume if they see your phone is "fresh" they'll take it on suspicion anyway.
Would you want the phone back after it's been in their hands? I wouldn't trust them to leave it alone.
I mean yeah, might be a fun reverse-engineering project to look for any backdoors or other modifications to the device.
GOS has boot attestation. But yeah, if I would travel to the US (I will no longer do that) I would bring a sacrificial device.

claimed they did not need a warrant to search Tunick’s phone because he had not yet crossed the U.S. border.
Also no right to search / seize his phone then. US law doesn't apply on non-US soil.
If it's not US soil, it's not a detention, it's a rendition, a kidnapping.
Also, I don't know how citizenship works I this respect in the US, but in my country a citizen cannot be denied entry. It can be detained upon entering, but by then you are in sovereign soil.
Its the same in the US. They can't deny entry to US citizens.
Hmm. Maybe DHS can fuck all the way off?
Sounds like the border guard wiped his phone, not him.
What? US police can ask you for the phone password? No way! That is 100% police state. Stalin was amateur comparing to present day USA.
Yes US citizens cannot be compelled to provide a password, but biometrics such as fingerprint or Face ID can. Disable these when crossing into the US.
Non citizens can be detained and rejected for not providing access to a device via password. Best to bring a second device if you must enter. Depressing times.
I don't believe you can be compelled to provide a password. That does after all (at the very least) constitute speech. And freedom of speech is also freedom of non-speech, they can't make you say something.
They will however try to make you do that... In many situations authorities are allowed to lie to you. So that's sucks. They can tell you that you're required to unlock your phone, you just have to know that your not actually.
Also they can't make you say anything, but they can make you do things, like for instance "put your finger here" or "look into this camera", which is why biometric unlock is unsafe around cops.
GrapheneOS - the only OS that i just installed and forget about it. Sure i spend time to tweak things like profiles but thats it.
And I am a distro and rom hopper.
The security model is that good: duress pin, scrambled pin, separate profiles with their own passwords, usb c restriction (you can set it charge only, charge while phone is off (most secure state).
and yet people even here don't understand why it would be useful even without the hardware security thinhs of the pixel
You can only install Graphene on a Google phone and there's two big issues with that:
- you are rewarding Google by buying their hardware.
- it doesn't matter how secure the os claims to be if the hardware is compromised and there is nothing you can do to convince me that a pixel doesn't have a backdoor into your data at a hardware level. If I was a conspiracy minded type I might say that Graphene is a Trojan Horse.
I may be about to move to a town near the border, and I fully plan on visiting Mexico as frequently as I can. It's one of the things I'm most excited about about moving there.
I will 100% be getting a second cheap phone, and only taking that when I cross the border.
He would have had a lot better legal leg to stand on I think if he had just refused to give them any passcode. Now instead of a potential case of being forced to compel speech, he is facing what will be argued is an attempt to destroy evidence. His defense is probably a lot stronger with the former than the latter.
That’s it. I’m getting a burner phone if I leave the country.
Edit: Serious question… what if you just wiped your phone and then restored it when you got wherever you were going?
Honestly I’m not considering leaving at all while this administration is in power. We’ve already heard too many stories of arbitrary detentions even for lawful citizens or visitors that I simply don’t want to roll the dice on whether my vacation ends with a nightmare or just another flight in as normal
This whole situation is making me strongly consider bringing a burner phone on my next vacation. That way I can wipe it before going through customs.
I did something similar when I last visited the US ~15 years ago. I uploaded an encrypted backup of my phone to a server in my home country and reset the device. I then downloaded and restored the backup when I arrived at the hotel.
„I think this case serves as a reminder that authorities may argue you knowingly destroyed data, so it’s better to not have that data on you when you cross certain borders.” Wow that’s an advice fitting entering Russia, Iran, etc. Nice club you’ve joined here
„unlawful to knowingly destroy or damage property to prevent authorities from seizing it” - but did it fucking explode, catch on fire, or blew some fuse on the phone or in any other way prevented it from working? No, they (not him) just wiped the data. I didn’t know deleting files off YOUR OWN DEVICE is a crime. I need to think twice before I empty trash on my computer next time.
Technology
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.