PAM Duress – Alternate passwords for panic situations • Hacker News Board

Re: PAM Duress – Alternate passwords for panic situations

#201

Post by nullc » Mon, Aug 23, 2021, 5:07 AM UTC

o-__-o wrote: post #185

nullc wrote: post #162

Earlier quoted context omitted.

On linux distros, at least before wayland, it was easy to make your account hidden from the gdm chooser (e.g. by putting it in a different group). Then you could setup a dummy account that doesn't have too much of interest in it. Combined with pam crypto to encrypt your home on login, the result is something that is reasonably private against casual inspection. I used to use this back when I couldn't afford to travel…

> Forensics agent pulls and mounts hard drive > Agent sees /home/hiddenuser > Government seeks search warrant for content > DA demonstrates recent knowledge/use of /home/hiddenuser > Judge holds you in contempt until you provide encryption keys

No basis for such a warrant for some US citizen entering the country. No such case has ever occurred, at least at the time when I received legal advice on the subject.

Consider the alternative: You're not worse off than you would be if you didn't hide it.

Hiding your login is a good security practice against all kinds of potential coercion.

Re: PAM Duress – Alternate passwords for panic situations

#202

Post by brokenmachine » Mon, Aug 23, 2021, 5:18 AM UTC

joefife wrote: post #41

C19is20 wrote: post #33

Earlier quoted context omitted.

Practise.

Don't be that person, especially when you're wrong. Both forms are acceptable. "In Australian and British English, 'practise' is the verb and 'practice' is the noun. In American English, 'practice' is both the verb and the noun."

I'm Australian. Never seen "practise", only "practice".

Re: PAM Duress – Alternate passwords for panic situations

#203

Post by jc01480 » Mon, Aug 23, 2021, 5:33 AM UTC

o-__-o wrote: post #185

nullc wrote: post #162

Earlier quoted context omitted.

On linux distros, at least before wayland, it was easy to make your account hidden from the gdm chooser (e.g. by putting it in a different group). Then you could setup a dummy account that doesn't have too much of interest in it. Combined with pam crypto to encrypt your home on login, the result is something that is reasonably private against casual inspection. I used to use this back when I couldn't afford to travel…

> Forensics agent pulls and mounts hard drive > Agent sees /home/hiddenuser > Government seeks search warrant for content > DA demonstrates recent knowledge/use of /home/hiddenuser > Judge holds you in contempt until you provide encryption keys

Forgetting the keys is established as protected speech under 1A. Don’t have the case handy atm. Fairly new. Knowing the keys and intentionally withholding them has yet to be established either way. But there will be a case soon enough. Funny thing about law is that both sides (prosec. & defense) often don’t want many things clarified further because they usually have far-reaching impacts to parallel legal issues. Roe v Wade is a perfect example.

Re: PAM Duress – Alternate passwords for panic situations

#204

Post by gnicholas » Mon, Aug 23, 2021, 5:48 AM UTC

I hate when my bank calls me about something and then asks to confirm my identity prior to giving out details about my account. Even when I think I know what it is about (e.g., a transaction with my card was declined just before the phone call), I feel very strange giving out any information to an inbound caller.

One thing I have thought about doing is providing mistaken information to the caller and see if they go along with it. I came up with this idea when one bank said they could send me a text message and I could read back the number to them (huge red flag).

Does anyone else have any ideas for how to authenticate a BigCorp caller whose corporate policies do not allow them to provide any account information to the people they are calling?

Re: PAM Duress – Alternate passwords for panic situations

#205

Post by gnicholas » Mon, Aug 23, 2021, 5:54 AM UTC

jjeaff wrote: post #135

grecy wrote: post #131

Earlier quoted context omitted.

Does a US Citizen have to comply?

Yes. Courts have upheld that a manual search of your phone by customs is legal. But more invasive, forensic investigation of your devices has been found to be unconstitutional. I'm not sure exactly where or how the line is drawn between the two. https://www.americanbar.org/groups/business_law/publications...

Relatedly, make sure you trigger the password lock on your device before handing it over. They may be able to compel you to give your biometrics but not your password (the latter is considered compelled speech, and the courts have not fully litigated whether the former is treated the same).

Re: PAM Duress – Alternate passwords for panic situations

#206

Post by sReinwald » Mon, Aug 23, 2021, 6:00 AM UTC

gnicholas wrote: post #204

I hate when my bank calls me about something and then asks to confirm my identity prior to giving out details about my account. Even when I think I know what it is about (e.g., a transaction with my card was declined just before the phone call), I feel very strange giving out any information to an inbound caller. One thing I have thought about doing is providing mistaken information to the caller and see if they go a…

Tell them you feel uneasy giving out details over the phone to an inbound caller, hang up and call their service line directly.

The only way you can be sure you are talking to your bank is if you are calling them.

Re: PAM Duress – Alternate passwords for panic situations

#207

Post by k12sosse » Mon, Aug 23, 2021, 6:02 AM UTC

necovek wrote: post #75

There are multiple levels of protection one might want. I.e. when you are being selected for random questioning entering US as a non-US citizen, you'd benefit from steganography-like approach: you give a password, and relatively bland, non-personal stuff shows up, giving appearance of full access to a system. If you only care about your privacy, the next one is to have a destroy-everything script (and it's not that h…

Plausible deniability!

Re: PAM Duress – Alternate passwords for panic situations

#208

Post by gnicholas » Mon, Aug 23, 2021, 6:06 AM UTC

sReinwald wrote: post #206

gnicholas wrote: post #204

I hate when my bank calls me about something and then asks to confirm my identity prior to giving out details about my account. Even when I think I know what it is about (e.g., a transaction with my card was declined just before the phone call), I feel very strange giving out any information to an inbound caller. One thing I have thought about doing is providing mistaken information to the caller and see if they go a…

Tell them you feel uneasy giving out details over the phone to an inbound caller, hang up and call their service line directly. The only way you can be sure you are talking to your bank is if you are calling them.

Yeah that works, but it's usually time-consuming to get to the specific department that actually called. I wish these companies could route your call to their fraud dept if their fraud dept had just called you, but sadly this doesn't seem to have caught on yet.

Re: PAM Duress – Alternate passwords for panic situations

#209

Post by abestic9 » Mon, Aug 23, 2021, 6:15 AM UTC

gnicholas wrote: post #204

I hate when my bank calls me about something and then asks to confirm my identity prior to giving out details about my account. Even when I think I know what it is about (e.g., a transaction with my card was declined just before the phone call), I feel very strange giving out any information to an inbound caller. One thing I have thought about doing is providing mistaken information to the caller and see if they go a…

Google called me wanting to confirm my business address and asked me a bunch of personal details, as well as a 6 digit code that was going to be sent to my number (the one they called me on?). I refused and told them to give me a number to call them back on and they said they didn't have that facility. I then asked if they could email me or point me to a form and they said they could only do it on that same call.

After 10 minutes in a verification tug-of-war, the rep escalated me to someone who did provide proof they were actually Google (using a field I updated in my account). All up it took 15 minutes and felt very fraudulent until they finally gave me some helpful context.

Re: PAM Duress – Alternate passwords for panic situations

#210

Post by Angostura » Mon, Aug 23, 2021, 6:18 AM UTC

sReinwald wrote: post #206

gnicholas wrote: post #204

I hate when my bank calls me about something and then asks to confirm my identity prior to giving out details about my account. Even when I think I know what it is about (e.g., a transaction with my card was declined just before the phone call), I feel very strange giving out any information to an inbound caller. One thing I have thought about doing is providing mistaken information to the caller and see if they go a…

Tell them you feel uneasy giving out details over the phone to an inbound caller, hang up and call their service line directly. The only way you can be sure you are talking to your bank is if you are calling them.

Wait a couple of minutes or call back from a different phone. In the UK it may still be possible for an attacker to hold the line open after you hang up - and then simulate the dial tone.