Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PAM Duress – Alternate passwords for panic situations

github.com

Post reply on HN
Print view View original

61–70 of 358 posts

Re: PAM Duress – Alternate passwords for panic situations

#61

Post by DangitBobby »

bredren wrote: post #30
DangitBobby wrote: post #25

This could result in serious personal harm if the individual(s) causing the duress sense something is up, which they almost certainly will if things start magically disappearing or locking up. You better make sure that whatever you are protecting with this is more important than your personal safety.

I think they would be more likely to notice that you did not put up enough fight. Most people are not great actors. Also, if you're being physically compelled to provide a passwords it seems your personal safety is already compromised.

Your safety is compromised, but that does not mean the danger cannot be escalated. If you are mugged at gunpoint, are you going to hand over all your cash and keep your hands up as much as possible or are you going to swiftly cut up your credit cards?

Re: PAM Duress – Alternate passwords for panic situations

#63

Post by bonzini »

dredmorbius wrote: post #52
anigbrowl wrote: post #37

Earlier quoted context omitted.

I do not understand why any security concerned person would use biometric identification for anything, ever.

If that's what's mandated, you may have little choice.

Somebody mandates using biometric identification instead of a PIN?!?

Re: PAM Duress – Alternate passwords for panic situations

#64

Post by bonzini »

joefife wrote: post #41
C19is20 wrote: post #33

Earlier quoted context omitted.

Practise.

Don't be that person, especially when you're wrong. Both forms are acceptable. "In Australian and British English, 'practise' is the verb and 'practice' is the noun. In American English, 'practice' is both the verb and the noun."

I thought he wrote that reply as a suggestion, i.e. that you should practise typing the duress password beforehand.

Re: PAM Duress – Alternate passwords for panic situations

#65

Post by lights0123 »

ChrisMarshallNY wrote: post #7

It's a very cool idea, but I think it would be most useful if applied to things like phones. I suspect most people pressed for passwords, are using a GUI system.

It uses the same authentication system everything else uses, so it would work in any login screen on a system that uses PAM (Linux and macOS), not just a terminal.

Re: PAM Duress – Alternate passwords for panic situations

#66

Post by dogma1138 »

EamonnMR wrote: post #57
f1refly wrote: post #8

There's always a big issue with systems like this: Any sophisticated attacker will have an image of the machine he's trying to get into at hand to stop exactly what this pam module is trying to achieve from happening. All this would do is make you appear in a worse light to the deciding judge when it comes to trial or get your other kneecap shattered in a not so civil situation.

If your attacker has a full image of your system why are they bothering with duress?

Also depending on the jurisdiction depending on the circumstances triggering it can be a felony the same as destroying evidence or tampering with an investigation, if a court compelled you congrats you’ve just earned yourself a contempt of court charge that can last pretty indefinitely.

In a jurisdiction that doesn’t adhere to the rule of law you are already screwed.

What people often don’t seem to comprehend is that if you get picked up by a “secret police” in the middle of the night it’s pretty much game over already.

Re: PAM Duress – Alternate passwords for panic situations

#67

Post by eurasiantiger »

shawnz wrote: post #50
dailyanchovy wrote: post #43

Earlier quoted context omitted.

They can try their luck again at having you give access.

The duress login shouldn't reveal that anything is happening, so they have no reason to suspect you're using such a feature at all. Thus there would be no reason to ask you to log in again, and even if they do, you can simply use the duress credentials a second time.

If they can monitor network connections, they can see the duress connections, too.

Re: PAM Duress – Alternate passwords for panic situations

#69

Post by sleavey »

The Hello World example shows echoing to stdout from the duress script. Seems like a bad idea. I don't want to get beaten or shot when some rm -rf fails with an I/O error, alerting the attacker to what's going on. It seems like it would be more sensible for the module to suppress all output by design.

Re: PAM Duress – Alternate passwords for panic situations

#70

Post by lxgr »

anigbrowl wrote: post #37
ChrisMarshallNY wrote: post #26

Earlier quoted context omitted.

It would need to be baked into the OS. With FaceID, I guess I could use eyes crossed, as a queue.

I do not understand why any security concerned person would use biometric identification for anything, ever.

Why would being security conscious automatically disqualify biometrics?

Security is all about threat models, and I can imagine quite a few scenarios where biometrics might fare better than passwords. Shoulder surfing and trivial passwords/PINs come to mind, for example.

And who said that it's biometrics vs. anything else? It's quite advisable to combine authentication factors.

Post reply on HN