Hacker News Reader

Comment by Cider9986 | Hacker News Reader

For those who don't know, automatic reboot restarts your device if you haven't unlocked it in a set amount of time. Cellebrite and other digital forensics companies are able to get into AFU devices much more often. The automatic reboot feature was first introduced by GrapheneOS and was later added to iOS and stock Pixels.

GrapheneOS's default is 18 hours and it can be set to between 10 minutes and 72 hours. iPhones and Stock pixels have it non customizable at 72 hours.

On GrapheneOS, for privacy and convenience, it's best to use a long random passphrase [1] for your primary unlock and then a fingerprint with a second factor pin as the secondary unlock. You enter the passphrase every time the device restarts.

If you're encountering someone that's going to seize your phone, try to restart/shut it down yourself so you don't have to trust the AFU protections.

[1] https://strongphrase.net give memorable ones which is cool.

View on HN

Never use a website to generate a password for something important like this. You can print out diceware passwords and roll dice.

You can just take a picture of a pile of dice, a pile of rice, or a tree, patch of grass, etc, and compute a secure hash/whatever and base six it to get the rolls.

I actually have a lava lamp next to my desk for this reason. Snap a photo, compute a hash!

Count the bubbels with your fingers while you count from 0 to 9. Every x fingers you write down the number.

Extra points if you hold you face really close and count in a dead language. You can also make ordered hand gestures in stead of counting on your fingers. Be a wizard about it!

Yer a cryptographer, Harry!

Are you saying to take a hash of a picture and convert that to base 6 for your dice rolls to plug into a word list for creating a passphrase?

Is that actually better (in practice, not in terms of entropy) than /dev/urandom? I have a lot less trust in my ability to successfully scrub a picture from my phone that deterministically created my passphrase.

> Is that actually better (in practice, not in terms of entropy) than /dev/urandom?

It offers protection in the event that your /dev/urandom is compromised. Otherwise no.

(Of course, if your /dev/urandom is compromised then whatever process you use to compute a hash of a photo is likely compromised as well.)

If you're concerned about that, you can concat your JPEG with a few bytes from /dev/random and you'll get the security of whichever is stronger. In practice none of this will be your weakest link.

It is possible that using a JPEG with its known bytes could make the final effort weaker than if you just used /dev/random.

No, that would fundamentally break the way (good) hashing works if I could add known data and get it to reveal the secret data

If you have a computer do something you cant know if it really did what you wanted.

> You can print out diceware passwords and roll dice.

Or on the CLI:

* https://packages.debian.org/search?keywords=diceware

* https://packages.debian.org/search?keywords=pwgen

you can play a round of scrabble and build the passphrase out of that

The entropy wouldn’t be very good compared to repeated dice rolls.

Why not automatically power down if any unknown USB device is attached?

So like you connect it to your computer for the first time and it shuts off?

Better wire it up to a thermite charge just to be sure. Untrusted USB device? Hope you enjoy 1400 degree molten iron

And now you're in violation of booby trap laws.

Yeah... that could be an option you configure.

that doesn't seem unreasonable. You only have one first time. Maybe two if you upgrade your computer more often than your phone.

My Android certainly doesn't know my computer. Every single time it defaults to charging only and I have to select if I want data transfer.

Is that because it cannot know your computer without you telling it every time, or is it just Android providing that default and not having a way to change that default?

is it just Android. SW is hard.

Or it’s not enabled by default.

Could request unlock and reboot if no valid pass is accepted within n minutes.

1. disable shutting down. 2. connect device and fingerprint it. 3. enable shutting down

How do you disable shutting down?

By changing a settibg in the settings menu?

TBF pretty much no one connects their devices anymore to anything other than charging. For those who do some timeout could work.

Or shut down when any USB device is attached while the phone is locked/inactive?

It'd work like this: Unlock phone, plug in USB widget; it works.

Or: Plug in USB widget without first unlocking phone; phone shuts down.

That's a great option.

I just wonder whether that could be too annoying for Android Auto / Car Play. But to be fair wireless is an option.

The other downside I guess is that a thief would just plug a USB drive in to disable device tracking. But they could just wrap the damn thing in foil so dunno if that should matter.

It's either that, or maintain a database of trusted USB devices...which seems iffy, at best.

And by that I mean, using the database itself is simple. But when it exists, then a list of targets for an attacker to emulate also exists.

Those boys at Cellebrite aren't dummies, at all, and they've been doing this stuff for quite a long time. They're a formidable opponent.

We used to use their kit to clone personal data between very different devices back in the dumb phone days. They were the only ones to get it right out of a sea of others that were also evaluated.

I should mention: Cellebrite's methods would tend to walk completely around whatever the phone thought was a normal, good idea.

When the usual manufacturer-prescribed method for reading contacts said to take some long-winded steps to put the phone into a special mode, Cellebrite's hardware just usually skipped that shit and read the data very directly without any fuss.

Plug it in, push the button, and the Cellebrite box just did the appropriate magic. It then interpreted the data and munged it into a useful form to shove into the next phone.

After that: The recovered personal data was pushed right up into the ass of the next phone with the same lack of consent. It was succinct and brutal in operation.

And: It worked. It was so dead-nuts simple that a cell phone salesperson could run it with ease. I stopped getting phone calls from the field about transfer problems when we started using Cellebrite kit.

Nothing else did this stuff with that measure of resolute nonchalance.

So at this point they've been uniquely hooning with cell phones for decades. It's kind of their schtick.

If we can speculate that something like the the USB-C charge rate negotiation on a given phone can open a pathway into the system, then it can be safe to say that Cellebrite is already using that method to get things done -- and that a person at the border can exploit it even if they're "not a tech person".

Simplifying these kinds of hacks is what they do.

People believed the reboot feature last time GrapheneOS was mentioned. It is of course nonsense.

Shut down the phone in areas with a high snatch risk. That means during landing for example, because the aircraft can be boarded covertly if on the ground.

> Shut down the phone in areas with a high snatch risk.

Yes this is of course safer. What evidence do you have that it doesn't work on GrapheneOS, though?

https://www.computerweekly.com/feature/Journalist-Richard-Me...

Medhurst has no evidence that it worked either. He hasn't tweeted since August 24th, I hope he is well and at liberty.

The internet exists and can transfer your data with no customs and borders, so if you are at risk of being snatched, the correct choice is to not carry a phone (or laptop, or..) at all.

https://en.wikipedia.org/wiki/Great_Firewall:

“The Great Firewall operates by checking transmission control protocol (TCP) packets for keywords or sensitive words. If the keywords or sensitive words appear in the TCP packets, access will be closed. If one link is closed, more links from the same machine will be blocked by the Great Firewall. The effect includes: limiting access to foreign information sources, blocking popular foreign websites and mobile apps, and requiring foreign companies to adapt to domestic regulations. Due to the Great Firewall, China has one of the lowest cross-border internet traffic rates in the world. Usage of foreign apps in China is minuscule; Asia Society estimated in 2026 that foreign apps blocked by the Great Firewall have extremely low traffic, particularly compared to domestic apps; the top five domestic apps saw traffic that was 1,000 times more than the top five foreign apps.”

The Great Firewall doesn't restrict SSH, so you can functionally ignore it (assuming using e.g. `ssh -D` is second-nature to you).

Last time I tried it (which was quite a while ago, but I'd be surprised if they became less restrictive) ssh was fine for interactive use, but they did some sort of traffic analysis to kill connections that got used for tunneling other traffic like that.

When I was there last year, it took some doing to get a VPN working. Mullvad was pretty good but it would take a few tries to find an endpoint I could connect to. The simplest escape hatch is to have a cellular connection from another country, but that's either expensive or slow.

If you live in the UK and travel to the US and are afraid of state actors, leaving your hardware at home seems like a bad idea, too.

Despite all the nonsense that's posted about UK on the internet, British agencies do require a warrant to enter your home. TSA on the other hand does not require a court order to confiscate and mirror your device before giving it back to you.

Edit: Just to be perfectly clear - Border Force in the UK can do the exact same thing to you once you return, British citizen or not. Leaving your device at home is still the safest choice.

I believe it's CBP that does this, not TSA. Therefore Americans don't have to worry about it during domestic flights.

> Despite all the nonsense that's posted about UK on the internet

How is it nonsense? I'm not debating the warrant thing, but it's very reasonable to assume the UK has terrible protections for these sorts of things.

https://en.wikipedia.org/wiki/Key_disclosure_law#:~:text=Uni...

https://eylenburg.github.io/countries.htm

I mean in a broad sense if you read any news about the UK it might looks like a dystopian surveillance state where you get arrested for criticising the king(I kid you not - I've had multiple American coworkers ask me if this is true).

And yes, UK has some awful laws around this. Yes it has put people in jail just for planning a protest before. Yes you can go to jail for not disclosing your passwords. But what you read on the internet is almost laughably out of proportion - no, you won't get arrested for posting a meme about the king.

> news about the UK it might looks like a dystopian surveillance state where you get arrested for criticising

Might it "seem" that way because it is that way?

https://www.forbes.com/sites/steveforbes/2025/09/09/people-a...

https://www.telegraph.co.uk/news/2026/08/22/britain-has-beco...

https://freespeechunion.org/news/more-than-62-000-people-hav...

Oh, and your government itself openly states it on record, too: https://hansard.parliament.uk/lords/2025-07-17/debates/F807C...

How many of those people got arrested for criticising the king?

Not that this is some kind of great bar to clear, but if you're going to argue with what I said, argue with what I actually wrote.

Ok then. Soviet Union had free speech too. Nobody got arrested for criticizing Reagan or Churchill.

Clearly the point is clear. Why nitpick pointlessly?

You've missed my point entirely, by a country mile.

Someone above asked me how it was nonsense. I responded that people parotting the point about getting arrested for criticising the king is nonsense - like for instance, my American coworkers asking if that's true, because they read it somewhere on the internet. That is nonsense.

If you want to argue with this point please do, but also please observe the rest of my comment and especially the parts that I haven't actually said.

Let me repeat reports about these arrests here as well, for your convenience.

6 people got arrested for trying to say "Not my king!" BEFORE his coronation: https://londondaily.com/not-my-king-anti-monarchy-protesters...

Before they had a chance of protest. After months of discussing the planned protest in details and getting a green light from the Met Police: https://www.bbc.co.uk/news/uk-65542558

52 people were arrested DURING the coronation, for example for holding a placard "not my king": https://londondaily.com/over-52-anti-monarchy-protestors-arr...

Police arrested despite KNOWING it's the member of public doesn't commit any offence: https://novaramedia.com/2025/03/11/police-officer-who-arrest...

I'm afraid you unwittingly misled your coworkers.

I'm aware you are still going to twist what I said to prove your point, but I really don't fancy repeating the exact same point for the third time just so you can say something unrelated.

They already said you can get in trouble for [planning] protesting. They said you won't get in trouble for online criticism. Your links about protests aren't proving anything.

It's not in the comment I'm responding to,

>> Someone above asked me how it was nonsense. I responded that people parotting the point about getting arrested for criticising the king is nonsense

Protesting against the king is criticising the king IMO. I didn't see his quantifier, since I would agree that online critique of the king in particular is not yet penalised.

Not surprising you're implying bad faith though, if we're splitting the hair this thin.

(and this specific planning of the protest was so heavy handed, because it belong to one of the two naughty protests, environmental. The second naughty one is protesting against the genocide. The rest is okay)

> It's not in the comment I'm responding to,

It's in the original comment you responded to, and it's a critical part of the conversation chain.

"And yes, UK has some awful laws around this. Yes it has put people in jail just for planning a protest before. Yes you can go to jail for not disclosing your passwords. But what you read on the internet is almost laughably out of proportion - no, you won't get arrested for posting a meme about the king."

I'm not saying bad faith, I'm saying you misread their argument pretty badly.

Your citations support the problems they already admitted. The hair was split before you got here because they're distinguishing in-person and online actions.

Yes, and no one mentioned parroting the king in this thread. Journalists under known observation from the state, which the UK does arrest from time to time, were mentioned however.

You can use other European countries like The Netherlands, which is a lawless police state with a liberal cover, as well.

Re-read my comment again.

FWIW the same applies to flying in the U.S. as long as you're not a person that the government cares about. I haven't had any issues with either TSA or CBP since 2011 (when, apparently, being multiracial with facial hair made me look Middle-Eastern and looking Middle-Eastern is a cardinal sin at U.S. ports of entry). Neither has anyone I've observed at the airport, and that's thousands of people per flight, and I fly about 3-4 times per year. There's plenty of stories on the Internet, and I don't doubt the stories are true, but the Internet can easily make a 1-in-a-million occurrence happen every day (indeed, given the sheer numbers, a 1 in a million occurrence does happen every day, it's just that it's unlikely to happen to you).

Yeah, it's true, you should go back to your coworkers and straighten it up.

6 people got arrested for trying to say "Not my king!" BEFORE his coronation: https://londondaily.com/not-my-king-anti-monarchy-protesters...

Before they had a chance of protest. After months of discussing the planned protest in details and getting a green light from the Met Police: https://www.bbc.co.uk/news/uk-65542558

It's not like Republicans in the UK are a violent group, unlike far right coddled by the same Met police.

52 people were arrested DURING the coronation, for example for holding a placard "not my king": https://londondaily.com/over-52-anti-monarchy-protestors-arr...

Police arrested despite KNOWING it's baseless and frankly illegal: https://novaramedia.com/2025/03/11/police-officer-who-arrest...

Tell me some more how it isn't arresting for criticising the king. Oh, well, technically he wasn't a king yet.... but that's even worse to be fair.

To add an extra layer of safety. Bring a secondary phone when travelling by airplanes, especially to other countries. You should also use it frequently, maybe with some side apps to make it look like it's your daily phone.

Or, just don't bring a phone if you're particularly vulnerable. What are they going to do? Deny you entry because you don't carry a phone? If we're really at that point, where merely not having some item is suspicious, we're in deep shit.

I wouldn't want to be the one to test this. That's an indication of how deep we dug ourselves in.

if you don't know yet, we are in deep

It's standard for many multinationals and universities to provide blank secondary devices for travel to China that are synchronized with data after getting past the border. They are then erased after one gets back, because Chinese intelligence has broken into hotel rooms and installed keyloggers before.

Adding the USA to the list of countries where this is done would increase costs but it wouldn't be some nightmarish unprecedented problem.

GrapheneOS is critical infrastructure. Questioning it is not like criticizing Neovim. People can get detained, killed and more.

Perhaps the reflexive genius downvoters can explain what happened to Richard Medhurst? After his phone was snatched and the authorities pretended not to be able to decrypt it, he went on a GrapheneOS promotion spree on X and wanted to write a book about computer security.

Now he has disappeared for nearly 6 weeks. How many more people do you want to get in trouble with your false promises?

What you really want is to wipe the device befoee landing.

Shutting it down won't help if you are forced by law to give out the password, which is the case in more and more countries.

Note that the iPhone also can be set to use a complicated password instead of a PIN and it will require it on first unlock.

>> then a fingerprint with a second factor pin as the secondary unlock

Unless you have a 4 or 4XL which are pretty popular with graphene os users. The weird thing is the 4 and 4XL are the only models without fingerprint because Google was pushing its #D Face Unlock System at the time.

The funny part is Graphene by default now disables face unlock on newer Pixel models.

> On GrapheneOS, for privacy and convenience, it's best to use a long random passphrase

Why do you call out just one OS? It's a good idea for any OS.

Yes, in fact on GrapheneOS it's less necessary and it's only necessary if you don't want to rely on the secure element rate limiting.

GrapheneOS allows using a passphrase with more convenience because of the fingerprint plus second factor pin (I don't think you can just have a pin as a secondary unlock). You don't need to enter the passphrase every time you unlock with this setup, only when first starting up.

The official opinion: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

This seems specific to GrapheneOS (unique as far as I know though I'd be happy to learn otherwise) where you could set a very long first unlock passphrase and have a shorter less cumbersome fingerprint plus pin option for subsequent unlocks. I wouldn't want to have to enter a long passphrase every time I unlock but once a day isn't so bad.

I don't run GrapheneOS, but I have an >15 character passphrase that must be used before biometrics can be used after reboot. I haven't used a 4-digit pin since the option to not use it was available.

The specific extra that grapheneOS adds is that you can have a required Fingerprint + PIN with a shorter easier to enter pin while also having a long first unlock passcode. Only a first unlock passcode then biometrics is not secure in the US if your device is in the AFU/biometric-only (after first unlock) state because you can be easily and legally compelled to provide a biometric unlock.

https://threecats.au/two-factor-pin-fingerprint-unlock-graph...

The option was there in Cyanogenmod back during the OnePlus One days. It was such a step backwards when it was removed. You almost had to wonder if it was deliberately done at the request of some TLA to prevent users from using too strong of a password for decryption.

I doubt it, mostly because phones were a lot easier to crack back in those days already so I doubt a TLA needed to push for it to be removed.

Because apart of the IOS, according to GrayKey and Cellebrite, GrapheneOS on Pixels is the only phone where it even makes sense (realistically).

Reply on news.ycombinator.com