this post was submitted on 26 Jul 2026
537 points (98.6% liked)
Technology
86633 readers
3124 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
They asked to unlock his phone, he entered the wipe instead personal pin, and the wipe starts, with no possible reversal.
I mean yeah they discover it when he hands them the phone and it shows something other than an unlocked screen... But he is still in detention? Making a fake homescreen will fool them for like 30 secs tops until they open literally any app and sees it's either completely empty or that it doesn't work.
What would that solve? It just drags out the procedure
The purpose of a duress code is plausible deniability.
There is an encryption product for Windows called VeraCrypt (aka TrueCrypt). You can create a hidden decoy volume inside an outer encrypted volume which has all your stuff in it. When mounted an observer cannot tell the difference between the hidden volume and the real volume since they are mounted the same way with different passcodes. You can put files in the decoy for plausibility but not the things you actually want to hide.
The same should be true of a duress code in a phone. It should be possible to put files, apps and stuff in the decoy that show activity e.g. email, pictures etc. Providing the other profile is wiped while this screen is showing then there is no immediate way of proving it was a duress code.
It would have to at least convince the border guard, but it should withstand forensic analysis too. So it might be necessary to do what VeraCrypt does.
"The duress PIN doesn’t give you a second chance and will trigger anywhere you enter it: on the lockscreen, while enabling Developer options, or even while unlocking an app that requests authentication. And unlike a regular factory reset, a duress PIN will erase all encryption keys and your phone’s eSIM partition as well. This makes it impossible for an attacker to access my data just by having physical possession of your device and knowledge of the PIN.
I think the real strength of GrapheneOS’ duress PIN lies in its subtlety. There are no confirmation prompts, no announcements, and no obvious signs that the wipe was intentional on your part. Of course, GrapheneOS is no longer a fringe operating system these days — it has even attracted the ire of law enforcement in some jurisdictions. In other words, a professional attacker might be aware of the existence of a duress PIN. But if you can enter it quickly enough, it achieves its intended effect: no data can be lifted from your phone."
Pretty plainly stated:
Main purpose - delete all data
A nice bonus - the process is semi hidden, no way to confirm mistakes or not
Purpose is NOT - Fool any attacker to think they have your phone even though it's wiped
So it's most definitely doing it's job. You think that job is not enough, fair, but it's living up to it's own stated purposes.
Lol that's just str8 false in this case, the stated purpose of the duress pin in the article is a system wipe, not plausible deniability.
So whoever has you under duress cannot steal your data
It's not a 'get out of duress free'-card
Empty apps or no apps aren't necessarily a sign of guilt, but they will look at you like you are because its not normal.
Companies often have travel laptops which are a clean install and no private corporate info exposed.