Hacker News Reader

Comment by iamleppert | Hacker News Reader

Instead of a PIN that wipes the device, it would be much better to setup a special PIN that logs the user into a sanitized, completely separate profile with generated content of no practical value. This would create plausible deniability, and be sufficient to allow low-level border agents to look through a phone and pass any checks without raising these kinds of alarms. The wipe PIN should still be an option, but should be separate, and only be for cases where you suspect a forensic imaging or search of the device is to take place and the legal consequences outweigh the risks.

View on HN

They would like to but it's not possible to make a robust feature like that because of low-level architecture of SSDs. Implementing a detectable solution would give people a false sense of security.

Also they can plant evidence if you unlock the phone.

https://nitter.net/GrapheneOS/status/2081471477174456340#m

This. Aka a Qubes style isolated image.

Anti-forensics just isn't a focus of the Qubes OS project. Beyond a typical LUKS/dm-crypt FDE implementation, there isn't much else in the way of protections. There have been some community efforts around it to make some relatively minor enhancements.

Once you've decrypted the disk, the contents of every permanent Qube is there for the taking, and it would be up to the user to further secure any data within specific Qubes if they desired any protection beyond what they get via FDE. Something like encrypted containers, for example, which isn't specific to Qubes (and has its own limitations).

In terms of running processes, Qubes OS benefits greatly from Xen's isolation between Qubes, but from a data forensics standpoint a recent Pixel running GrapheneOS has massively stronger (and more numerous) layers of protection against data extraction, and at all levels (I/O, memory, disk, etc.).

You can use a disposable Qube every time.

Disposable Qubes are not intended to be robustly anti-forensic in nature. Implementing robust anti-forensic measures in stateful hardware requires far more from the hardware layer than is on offer.

There have been and are some community efforts towards mitigations, but nothing remotely approaching what three (soon to be four) specific phone architectures provide.

Qubes OS is many wonderful things, but it is not particularly anti-forensic. If anti-forensics on PC hardware is the primary intention behind disposable VMs, there are better options.

Reply on news.ycombinator.com