Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PAM Duress – Alternate passwords for panic situations

github.com

Post reply on HN
Print view View original

141–150 of 358 posts

Re: PAM Duress – Alternate passwords for panic situations

#141

Post by Nextgrid »

muti wrote: post #105
yosito wrote: post #87

Comments are full of gunpoint scenarios, but I think a far more likely scenario for most HN readers is law enforcement / customs agents asking you to unlock your device during travel or some other random checkpoint so they can scan it. In that case, I doubt the officer would even have a clue about the use of a duress password to selectively and silently delete some private data. I think the biggest risk would be that…

"You could even spawn a process to remove the pam_duress module so the threat actor won't be able to see if the duress module was available" This scenario was considered by the author

Technically you'd also need to rewrite the logs in a plausible manner (removing the mentions of the PAM module and potentially replacing it with their "normal" equivalents) and depending on your threat model, actually securely erase the files so that disk recovery software can't later restore the deleted files.

Re: PAM Duress – Alternate passwords for panic situations

#142

Post by Aeolun »

hirundo wrote: post #111
yosito wrote: post #106

Earlier quoted context omitted.

I don't know the legal implications, but if the duress password unlocks your device and simply deletes a directory or two, and the officer only asked you to unlock your device (without a warrant, by the way), how is that lying?

Even if it isn't lying, it's destruction of evidence. 18 U.S. Code 1519: > Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed u…

> investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States

I mean, you’re not seeking to obstruct anything other than a federal agent looking at your personal pictures, which they explicitly do not need to fulfill their duty.

Now if you were removing evidence of your crimes.

Anyway, I know it doesn’t work that way, but I think it should.

Re: PAM Duress – Alternate passwords for panic situations

#143

Post by Haegin »

HPsquared wrote: post #90
thomascgalvin wrote: post #74

Earlier quoted context omitted.

I worked at a place where the duress code was ROT5: 1234 was your normal access code, 6789 lerted security.

Could use the method in The Wire: press the key on the opposite side to the usual key (e.g. 8 instead of 2, 6 instead of 4, etc.)

Better hope nobody uses 5555 as their pin then!

Re: PAM Duress – Alternate passwords for panic situations

#144

Post by accountofme »

Haegin wrote: post #143
HPsquared wrote: post #90

Earlier quoted context omitted.

Could use the method in The Wire: press the key on the opposite side to the usual key (e.g. 8 instead of 2, 6 instead of 4, etc.)

Better hope nobody uses 5555 as their pin then!

5 and 0 also swap

Edit: made it make sense

Re: PAM Duress – Alternate passwords for panic situations

#145

Post by sokoloff »

oasisbob wrote: post #29

Training is very important in duress systems. I once worked in a place with a keypad duress code on the security system. If you prefixed your security PIN with NN-, it was the duress version of the code and would trigger a silent alarm. This was setup long-ago, and not communicated. One night, the keypad was acting glitchy. Partially out of frustration (countdown is running), and partially to test, I ended up acciden…

I had a similar false trigger trying to make an international call from our office phones. I didn’t know the exact incantation of the prefix, but knew it was 9 for an outside line and at home I used 011 then the country code. That didn’t seem to work, so I thought maybe I needed to drop the zero, resulting in me inadvertently dialing 911 and hanging up when that didn’t give me the dial tone I expected. I found the right sequence and was interrupted multiple times in the call as our floor fire coordinator showed up, then a few minutes later facilities, then a few minutes later local police.

I guess the system worked and I never forgot the correct prefix after that.

Re: PAM Duress – Alternate passwords for panic situations

#146

Post by isatty »

Spooky23 wrote: post #115
yosito wrote: post #106

Earlier quoted context omitted.

I don't know the legal implications, but if the duress password unlocks your device and simply deletes a directory or two, and the officer only asked you to unlock your device (without a warrant, by the way), how is that lying?

Despite rumors to the contrary, the police aren’t stupid. They are trained to ask questions in ways that elicit a confession or falsehood. The simplest example is asking “Do you know why I pulled you over?”. Typically, people spontaneously confess to speeding, sometimes they break down and admit that someone is wrapped up in a rug in the trunk. The courts have consistently ruled that customs is different and you can…

Time to post this again: https://www.youtube.com/watch?v=d-7o9xYp7eE (Don't talk to the police)

Re: PAM Duress – Alternate passwords for panic situations

#147

Post by m-ee »

grecy wrote: post #131
nexus7556 wrote: post #128

Earlier quoted context omitted.

Even US Citizens are subject to search at the border without warrant or probable cause. Recently I had a CBP officer at SFO ask to search photo gallery when returning from vacation.

Does a US Citizen have to comply?

They cannot refuse entry because of but they make take your device indefinitely.

Re: PAM Duress – Alternate passwords for panic situations

#148

Post by wowaname »

sleavey wrote: post #80
dheera wrote: post #72

Earlier quoted context omitted.

Just do this in your script rm -rf /secret/files > /dev/null 2>&1 That pipes STDOUT to /dev/null and redirects STDERR to STDOUT.

Seems like this should be baked in to the module. There don't seem to be any circumstances where you would want stdout/stderr from duress.d scripts to appear.

You have the freedom to do whatever you want with the script. It's trivial to `exec >/dev/null 2>/dev/null` first thing in a script if you want it to be silent.

Re: PAM Duress – Alternate passwords for panic situations

#149

Post by wowaname »

solatic wrote: post #4

I mean, that's pretty cool, but who enables password logins for SSH anymore? If I'm an attacker, I'm going to wonder why my target of duress is giving me a password and not a private key; most likely if I have access to my target of duress, then I have access to some kind of client / endpoint that my target uses to connect to the network, and that client will have the SSH private keys likely already loaded into ssh-a…

I use an authentication PGP subkey for SSH so I have to unlock it with a passphrase before using it. Normal SSH keys can be encrypted similarly, and either gpg-agent or ssh-agent can save your passphrase in memory for an amount of time.

Re: PAM Duress – Alternate passwords for panic situations

#150

Post by mgbmtl »

michael-ax wrote: post #99

perhaps i could use that as a screensaver password to share with my girlfriend? it would close spreadsheets, emacs, un-mount journals and personal drives. PAM's used to reauth from the screen-saver, right?

Might be easier to create a separate login?

Some partners expect to share passwords as a trust thing, but my work does not allow it (and most personal devices have access to work stuff).

Post reply on HN