Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PAM Duress – Alternate passwords for panic situations

github.com

Post reply on HN
Print view View original

131–140 of 358 posts

Re: PAM Duress – Alternate passwords for panic situations

#131

Post by grecy »

nexus7556 wrote: post #128
necovek wrote: post #75

There are multiple levels of protection one might want. I.e. when you are being selected for random questioning entering US as a non-US citizen, you'd benefit from steganography-like approach: you give a password, and relatively bland, non-personal stuff shows up, giving appearance of full access to a system. If you only care about your privacy, the next one is to have a destroy-everything script (and it's not that h…

Even US Citizens are subject to search at the border without warrant or probable cause. Recently I had a CBP officer at SFO ask to search photo gallery when returning from vacation.

Does a US Citizen have to comply?

Re: PAM Duress – Alternate passwords for panic situations

#132

Post by salawat »

yosito wrote: post #118
hirundo wrote: post #111

Earlier quoted context omitted.

Even if it isn't lying, it's destruction of evidence. 18 U.S. Code 1519: > Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed u…

Would that apply to a warrantless search?

Yes. Sadly.

Re: PAM Duress – Alternate passwords for panic situations

#133

Post by withinboredom »

If your threat model is “guy with guns,” they’ll just follow you and snatch it when you think you’re safe and unlock the device. If your threat model is “government at border” just mail the device or data to yourself overnight. Don’t be that guy…

I was flying into Atlanta (Intl) with “radioactive” rocks (not on purpose, just picked some up near a volcano, they looked cool) and they flipped their collective shit. I was taken to a separate area where they dumped my stuff next to another guy who got pulled into “routine” inspection. This other guy “forgot” his phone pin earlier that day… he was still there four hours later, after my four hours of reasonably straight forward BS.

Re: PAM Duress – Alternate passwords for panic situations

#134

Post by anigbrowl »

sabas123 wrote: post #110
anigbrowl wrote: post #93

Earlier quoted context omitted.

Shoulder surfing and weak passwords are both something you can control at any time. Biometric identification can be exploited involuntarily by someone literally using force to apply your finger to a device or similar. I shouldn't need to say this, it's so obvious that it's a common plot device in action movies.

And with a little bit more force they beat the password out of me anyway regardless which system I use...

If you are so easily swayed, you would probably not be in an adversarial situation with a government anyway.

But this article is about a system for giving up passwords under duress without necessarily compromising all your security, such that your antagonist has no way of knowing or showing that there's another password concealing more important information.

Re: PAM Duress – Alternate passwords for panic situations

#135

Post by jjeaff »

grecy wrote: post #131
nexus7556 wrote: post #128

Earlier quoted context omitted.

Even US Citizens are subject to search at the border without warrant or probable cause. Recently I had a CBP officer at SFO ask to search photo gallery when returning from vacation.

Does a US Citizen have to comply?

Yes. Courts have upheld that a manual search of your phone by customs is legal. But more invasive, forensic investigation of your devices has been found to be unconstitutional. I'm not sure exactly where or how the line is drawn between the two.

https://www.americanbar.org/groups/business_law/publications...

Re: PAM Duress – Alternate passwords for panic situations

#136

Post by salawat »

bonzini wrote: post #64
joefife wrote: post #41

Earlier quoted context omitted.

Don't be that person, especially when you're wrong. Both forms are acceptable. "In Australian and British English, 'practise' is the verb and 'practice' is the noun. In American English, 'practice' is both the verb and the noun."

I thought he wrote that reply as a suggestion, i.e. that you should practise typing the duress password beforehand.

I thought he was demonstrating how. Make your password a very unlikely but relevant typo of your actual one.

Now tge real question is, was the poster in a state of duress when thy typed that response?

Re: PAM Duress – Alternate passwords for panic situations

#137

Post by adrianba »

grecy wrote: post #131
nexus7556 wrote: post #128

Earlier quoted context omitted.

Even US Citizens are subject to search at the border without warrant or probable cause. Recently I had a CBP officer at SFO ask to search photo gallery when returning from vacation.

Does a US Citizen have to comply?

The law here is not completely developed. The US Supreme Court has not ruled on the extent to which electronic devices of a US person may be searched at a border.

In practice, courts have generally allowed manual, cursory searches of electronic devices (such as looking at recent photos) as being similar to a search of luggage. However, courts have disagreed on how intrusive the search can be and whether a more invasive search at the border can be conducted without some additional suspicion.

Re: PAM Duress – Alternate passwords for panic situations

#138

Post by AussieWog93 »

Spooky23 wrote: post #113
jeroenhd wrote: post #28

Earlier quoted context omitted.

If you're held under gunpoint, that script that wipes your entire hard drive will only make your day worse. AFAIK if you actually get detained and questioned at airports, your drive will already get imaged before any password is even tried. You may be able to get away with this on a mobile device where this feature isn't generally expected (because who uses Linux on a smartphone in the first place). I always wonder a…

It’s silly nerd porn. The “real” problem is either: (a) You know the authorities want access to your data because , and you travel across a border with it. (b) You possess sensitive information and are not aware of law enforcement’s desire to get it; (c) You’re swept up at random; (d) You’re a criminal, or carry a paper trail of potential illegal activity. Solutions: (a) Means you are stupid. The only way to win is n…

(e) You are a whistleblower who doesn't want to be dragged off to a military prison and tortured

Re: PAM Duress – Alternate passwords for panic situations

#139

Post by technological »

necovek wrote: post #75

There are multiple levels of protection one might want. I.e. when you are being selected for random questioning entering US as a non-US citizen, you'd benefit from steganography-like approach: you give a password, and relatively bland, non-personal stuff shows up, giving appearance of full access to a system. If you only care about your privacy, the next one is to have a destroy-everything script (and it's not that h…

I love multiple accounts in Android. When at airport I can switch to non personal account and show anything they want
Post reply on HN