Comment by patcon | Hacker News Reader

Comment by patcon | Hacker News Reader

I used to play around on projects adjacent to Tor and TailsOS, and had an idea for a setup I was researching. It's a little intense and probably has annoying failure modes, but sharing in case anyone else finds it helpful:

- Tasker is an automation app for setting up rules for triggers and actions. It allows extension apps to be created to add new triggers and actions.

- someone at one point made an extension to add an action for wiping or factory resetting when triggered

- there was an existing extension (or core feature) to trigger when certain signals are lost or found (e.g., wifi signals, Bluetooth LE beacons, etc)

So the idea is to carry a BLE beacon (any "item tracking" one works) on your keychain, and an unassuming faraday cage pocket alongside it. If you want to wipe your phone, slip the fob into the pocket, the signal disappears, and your phone wipes. And if you don't have the keychain on you, just refuse to open it right away, as when they put the phone itself in a faraday cage (to prevent it from being remote wiped), they cause the signal to be lost, and it gets reset.

Not sure if all the pieces still exist (I dont think the tasker extension for wiping existed outside a forum post...)

Or keep it in a faraday bag and have the phone wipe if it sees it. If you're ever searched (or otherwise indisposed), they'll open the bag and wipe your phone for you.

This depends on the beacon being visible. If they just take the phone and walk away, because that's where they think the evidence is, it won't wipe.

When I've gotten secondary screening the first thing they do is take all my belongings and rifle through them on a table. That seems to be standard practice and I'm sure it was step 1 in Tunick's ordeal.

Both approaches have situations they wouldn't work in. If you're extra paranoid you could do both.

> If you're ever searched (or otherwise indisposed), they'll open the bag and wipe your phone for you.

Isn't that the same issue here that resulted in felony charges? Border agent was given a duress PIN and wiped the phone for the owner. Now owner is charged.

I don't see how. Regardless of how you feel about the lawfulness of the overall situation, Tunick gave an agent false information which resulted in the phone being wiped. That's intent.

This requires no action whatsoever from the phone's owner, you could even be unconscious/dead and it would still work.

The intent in that scenario is to wipe your phone (destroy evidence) when a bag is searched by federal agents.

I think there's a version of this where you can reasonably say you forgot you'd set this up. Like if they disassemble your whole bag, lay the BLE beacon out, and wipe the phone... You can claim it's a theft deterrent for thieves who might steal your bag and rummage thru it?

I think this sums it up for me:

- wipe-on-lost-signal = easier to claim as legitimate anti-theft mechanism. Harder to claim you forgot about it (because you'd have the actively live a life where they don't lose signal)

- wipe-on-found-signal = easier to claim as accident. ("I forgot that little faraday keychain was in my bag, and haven't touched it in years since I was on company project X"). Harder to claim it's a general anti-theft mechanism, as it requires a threat model of someone laying all your stuff out together on a table.

EDIT: Maybe it's in a little pouch attached to the phone itself, and they think it's a find-my-object tracker to inspect, but it's actually a beacon that wipes on detection. But yes, this is getting a little ridiculous in terms of plausible deniability :)

It's not the exact same situation. Whether it's similar enough to be prosecuted or convicted is a different question.

Oh hey, I like this variant! So... both the BLE beacon and the phone have a faraday cage, and if they ever appear together outside their cages, the phone wipes?

Perhaps less likely to go wrong than my original proposal when living normal life, as it might wipe if the BLE signal randomly gets lost.

It would be nicer if you could leave phone in cage during security, and remove beacon while loading airport trays ("remove all electronics from their cases..."). the only chance for a failure mode is only when you're going through security, and have the fob outside its case..

But you'd need to be able to leave your phone in the faraday cage pouch while going thru security, which is only ok if they don't notice... (maybe they commonly don't notice small faraday pouches aren't empty... Maybe they wouldn't if you had a secondary mobile device...)

I was imagining only the BLE beacon living in one of those little faraday pouches people put their key fobs in. They should be pretty much transparent passing through the x-ray and a pouch with an airtag in it wouldn't raise any suspicion at all at the airport.

Only once you're getting invasively searched would they (ideally) dump the pouch out into the tray with your phone.

I like the idea of a phone that automatically wipes itself if I don’t act to stop it. I wonder about the legality of that if the duress code is considered “destroying evidence.”

Action vs inaction seems like an important distinction.

https://news.ycombinator.com/item?id=49040537

I used to contribute to this https://en.wikipedia.org/wiki/USBKill

Ah I recall I used to see the creator around :) thanks for your work!

Regarding the motivation for usbkill mentioned in the article: I too was motivated to think on this stuff in relation to my sense of injustice around Ross Ulbrecht, and wanting to think of some way that someone in his position could avoid getting caught. One creative variant in my thinking involved embedding the BLE beacon inside a rubber ball that could be launched and lost track of. Or maybe embedded in heel of a shoe and ditched in transit haha

With no third party apps you can set an iPhone to wipe itself after 10 failed passcode attempts.

US law enforcement is well aware of it.

They're also now well aware of the GrapheneOS duress PIN/password feature. It was designed to work against an attacker aware of it by acting as a deterrence. If they're aware of the feature, it discourages them from trying to coerce a PIN/password and attempt to unlock with it. We aren't fond of features depending on an attacker being unaware of them and this isn't one of those.

Pixels have a high quality secure element enforcing a maximum of 20 unique attempts to derive the encryption keys for each separately encrypted profile. There's also very aggressive rate limiting between the attempts. It filters out duplicate attempts by temporarily remembering the previous 5 unique attempts to make the rate limiting more usable. A misremembered PIN/password repeatedly entered over and over will only use up 1 attempt.

Android does have standard support for enabling wiping after N attempts and an open source app can be used to set a configurable limit rather than specifically after 10.

tfw face when I leave my phone on the table and go to the restaurant bathroom only to return to a brand new squeaky clean factory reset

Critically, don't brag about doing so. Don't tell the cops you wiped your phone. If asked, it's just a blank phone you brought (maybe you have a plausible excuse like gifting it).

Reply on news.ycombinator.com