Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PAM Duress – Alternate passwords for panic situations

github.com

Post reply on HN
Print view View original

241–250 of 358 posts

Re: PAM Duress – Alternate passwords for panic situations

#241

Post by oasisbob »

gorgoiler wrote: post #200
oasisbob wrote: post #29

Training is very important in duress systems. I once worked in a place with a keypad duress code on the security system. If you prefixed your security PIN with NN-, it was the duress version of the code and would trigger a silent alarm. This was setup long-ago, and not communicated. One night, the keypad was acting glitchy. Partially out of frustration (countdown is running), and partially to test, I ended up acciden…

Out of interest, were you arrested? As part of a duress protocol — where your extortioner is likely observing you — law enforcement would be required to go through the motions of arresting you and taking you offsite. You can expect to be held for X hours regardless of whether they believed you had simply made a mistake. Long and unavoidable administrative delays make it much harder for villains to subvert protocols.…

No arrests. False alarms on silent alarm systems are common. Other factors made it clear that a real threat was unlikely.

All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems.

Re: PAM Duress – Alternate passwords for panic situations

#242

Post by ThrustVectoring »

abestic9 wrote: post #209
gnicholas wrote: post #204

I hate when my bank calls me about something and then asks to confirm my identity prior to giving out details about my account. Even when I think I know what it is about (e.g., a transaction with my card was declined just before the phone call), I feel very strange giving out any information to an inbound caller. One thing I have thought about doing is providing mistaken information to the caller and see if they go a…

Google called me wanting to confirm my business address and asked me a bunch of personal details, as well as a 6 digit code that was going to be sent to my number (the one they called me on?). I refused and told them to give me a number to call them back on and they said they didn't have that facility. I then asked if they could email me or point me to a form and they said they could only do it on that same call. Aft…

> told them to give me a number to call them back on

I hope you managed to communicate that you needed it to be able to independently verify that this number belonged to the purported caller. Eg, if it's from your "credit card company", the number should show up on the credit card company's website.

Re: PAM Duress – Alternate passwords for panic situations

#243

Post by atoav »

Sebb767 wrote: post #167
drexlspivey wrote: post #78

Earlier quoted context omitted.

You don’t understand how someone can remember a password under stress?

If you used that password twice two years ago when you installed the module and you're suddenly pulled in an interrogation room in a foreign country? When you have about one chance to enter it right while some very angry officers look over your shoulder? I can absolutely see that.

This is why usually these trigger-passwords are just a variation suffix away. If your real password was 123456 + Ok a system like that would trigger if you e.g. append a certain sign to it: 123451 + Ok. So you don't have to remember a different password, you just have to remember the one character or button that makes it call security.

Re: PAM Duress – Alternate passwords for panic situations

#244

Post by magicalhippo »

stephenr wrote: post #219
jtnag wrote: post #216

Earlier quoted context omitted.

My working theory is that in old times phones had rotary dial instead of key pad. Number 1 was the longest to dial, 9 was the shortest (as I remember from childhood days). Thus, fastest way to dial 3 digit code was to use numbers with as much as 9 as possible (997,998,999).

I grew up with a rotary phone. From memory, 1 was the shortest to dial, 9 the longest.

Actually this is country specific AFAIK. Wikipedia has a picture[1] of a phone from New Zealand which has 9 as the shortest.

[1]: https://en.wikipedia.org/wiki/Rotary_dial#/media/File:New_Ze...

Re: PAM Duress – Alternate passwords for panic situations

#245

Post by GoblinSlayer »

hirundo wrote: post #111
yosito wrote: post #106

Earlier quoted context omitted.

I don't know the legal implications, but if the duress password unlocks your device and simply deletes a directory or two, and the officer only asked you to unlock your device (without a warrant, by the way), how is that lying?

Even if it isn't lying, it's destruction of evidence. 18 U.S. Code 1519: > Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed u…

Does it prohibit encryption?

Re: PAM Duress – Alternate passwords for panic situations

#246

Post by Mordisquitos »

tjmc wrote: post #196
Spooky23 wrote: post #115

Earlier quoted context omitted.

Despite rumors to the contrary, the police aren’t stupid. They are trained to ask questions in ways that elicit a confession or falsehood. The simplest example is asking “Do you know why I pulled you over?”. Typically, people spontaneously confess to speeding, sometimes they break down and admit that someone is wrapped up in a rug in the trunk. The courts have consistently ruled that customs is different and you can…

This reminds me of a physics joke: "Dr Heizenburg, do you know how fast you were driving?" "No, but I know exactly where I am"

>This reminds me of a physics joke:

>"Dr Heizenburg, do you know how fast you were driving?"

>"No, but I know exactly where I am"

To which the police officer replies "You were driving at 145 km/h!"

Heisenberg whispers to his passenger, "Great Erwin, now thanks to this idiot we're lost". The officer overhears him, and angrily orders them out of the car. He searches their glove compartment, and then opens the car boot. He reels back in shock:

"Did you know there's a dead cat in your boot‽"

The passenger grumbles "Well, we do now…"

Re: PAM Duress – Alternate passwords for panic situations

#247

Post by stephenr »

magicalhippo wrote: post #244
stephenr wrote: post #219

Earlier quoted context omitted.

I grew up with a rotary phone. From memory, 1 was the shortest to dial, 9 the longest.

Actually this is country specific AFAIK. Wikipedia has a picture[1] of a phone from New Zealand which has 9 as the shortest. [1]: https://en.wikipedia.org/wiki/Rotary_dial#/media/File:New_Ze...

Kiwis don't count /s

Re: PAM Duress – Alternate passwords for panic situations

#248

Post by pyuser583 »

gorgoiler wrote: post #200
oasisbob wrote: post #29

Training is very important in duress systems. I once worked in a place with a keypad duress code on the security system. If you prefixed your security PIN with NN-, it was the duress version of the code and would trigger a silent alarm. This was setup long-ago, and not communicated. One night, the keypad was acting glitchy. Partially out of frustration (countdown is running), and partially to test, I ended up acciden…

Out of interest, were you arrested? As part of a duress protocol — where your extortioner is likely observing you — law enforcement would be required to go through the motions of arresting you and taking you offsite. You can expect to be held for X hours regardless of whether they believed you had simply made a mistake. Long and unavoidable administrative delays make it much harder for villains to subvert protocols.…

Is it legal for them to arrest you simply to keep up the appearance? You haven’t done anything illegal.

Re: PAM Duress – Alternate passwords for panic situations

#249

Post by inglor »

pyuser583 wrote: post #248
gorgoiler wrote: post #200

Earlier quoted context omitted.

Out of interest, were you arrested? As part of a duress protocol — where your extortioner is likely observing you — law enforcement would be required to go through the motions of arresting you and taking you offsite. You can expect to be held for X hours regardless of whether they believed you had simply made a mistake. Long and unavoidable administrative delays make it much harder for villains to subvert protocols.…

Is it legal for them to arrest you simply to keep up the appearance? You haven’t done anything illegal.

Not from the US, but here at a bank I worked with: If you trigger the silent alarm they'd have reason to suspect you are threatened and would take you to custody to make sure you are safe and release you once it's sorted out (probably an hour or so).

Re: PAM Duress – Alternate passwords for panic situations

#250

Post by [deleted] »

ThrustVectoring wrote: post #242
abestic9 wrote: post #209

Earlier quoted context omitted.

Google called me wanting to confirm my business address and asked me a bunch of personal details, as well as a 6 digit code that was going to be sent to my number (the one they called me on?). I refused and told them to give me a number to call them back on and they said they didn't have that facility. I then asked if they could email me or point me to a form and they said they could only do it on that same call. Aft…

> told them to give me a number to call them back on I hope you managed to communicate that you needed it to be able to independently verify that this number belonged to the purported caller. Eg, if it's from your "credit card company", the number should show up on the credit card company's website.

[deleted]
Post reply on HN