Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PAM Duress – Alternate passwords for panic situations

github.com

Post reply on HN
Print view View original

281–290 of 358 posts

Re: PAM Duress – Alternate passwords for panic situations

#281

Post by csunbird »

gnicholas wrote: post #205
jjeaff wrote: post #135

Earlier quoted context omitted.

Yes. Courts have upheld that a manual search of your phone by customs is legal. But more invasive, forensic investigation of your devices has been found to be unconstitutional. I'm not sure exactly where or how the line is drawn between the two. https://www.americanbar.org/groups/business_law/publications...

Relatedly, make sure you trigger the password lock on your device before handing it over. They may be able to compel you to give your biometrics but not your password (the latter is considered compelled speech, and the courts have not fully litigated whether the former is treated the same).

For iphones, just tap the power button repeatedly, it will force a password entry to unlock.

Re: PAM Duress – Alternate passwords for panic situations

#282

Post by nudpiedo »

ljm wrote: post #117
nudpiedo wrote: post #51

Earlier quoted context omitted.

Why not honeypot into a docker with fake data? Everyone would be happy (during a first moment). Sure if the attacks t is well informed then they will double check whether the target they got in is real or not.

"Okay okay! The password is hunter2, go on and try it, just don't shoot me!" Bad guy types in honeypot password A new update to Docker is available. Restart now to apply the update or subscribe to a Pro account to delay this update. "Oh, bugger."

Sorry, my bad for assuming a system admin has enough reasoning capacity to avoid dumb mistakes.

Re: PAM Duress – Alternate passwords for panic situations

#283

Post by adwww »

bennyp101 wrote: post #265
gnicholas wrote: post #204

I hate when my bank calls me about something and then asks to confirm my identity prior to giving out details about my account. Even when I think I know what it is about (e.g., a transaction with my card was declined just before the phone call), I feel very strange giving out any information to an inbound caller. One thing I have thought about doing is providing mistaken information to the caller and see if they go a…

Most banks here (UK) have a mobile app, so I've always wondered why they don't use that to auth the call? Bank: Hey I'm calling from HSBC, want to verify it? Me: Sure Bank: Ok, so open you mobile app, and enter 637482 Me: Ok, cool thats given me 274893 Bank: Yep, that's all confirmed so ...

Should even be possible for the apps to trigger a notification saying a valid inbound call is about to happen.

Re: PAM Duress – Alternate passwords for panic situations

#284

Post by JulianMorrison »

matrixagent wrote: post #279
oasisbob wrote: post #241

Earlier quoted context omitted.

No arrests. False alarms on silent alarm systems are common. Other factors made it clear that a real threat was unlikely. All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems.

> All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems. Could you give some examples?

IIRC, over here, banks are required to give employees at least one two-week contiguous block of leave, during which they can't get into the office, use work systems, or log in remotely. The idea being that oh-so-clever scams generally require the operator to be there keeping all the balls in the air, and locking them out will reveal their tricks.

Re: PAM Duress – Alternate passwords for panic situations

#285

Post by solatic »

matrixagent wrote: post #279
oasisbob wrote: post #241

Earlier quoted context omitted.

No arrests. False alarms on silent alarm systems are common. Other factors made it clear that a real threat was unlikely. All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems.

> All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems. Could you give some examples?

Mostly cases where businesses rely on individuals instead of process.

As a simple example, it's very easy, when starting a company, to issue personalized email addresses to early employees and then people communicate using those email addresses. It's perfectly fine to email the CTO at first-name@example.com, because everyone knows everyone else and it works.

As you grow large, it becomes important for people to address roles rather than individuals. This way, if people leave their role, they can (semi-transparently) be replaced by someone else taking that role who will then continue to receive all of the same emails, be able to respond to them, etc. So then it becomes important to have e.g. a cto@example.com address. When the CTO takes a vacation, their email gets routed to someone taking over their duties, you don't need to communicate to everyone to start emailing somebody-else@example.com instead.

Re: PAM Duress – Alternate passwords for panic situations

#286

Post by Draken93 »

Verdex wrote: post #164
HomeDeLaPot wrote: post #103

Earlier quoted context omitted.

And you'd want to hide the eye choosing/scanning process so nobody could just watch an employee to figure out their preference.

Scanner is something you look in with both eyes. And then while your eyes are completely hidden you close one eye. Heck. You could set it up so that it scans both eyes and then does a second scan where you choose what your ok signal is (both eyes, right only, left only, no eyes).

Yeah i think technicaly it could work. But I actually think that is a terrible idea. Humans have a lot less self control then we think. This will lead to many false alarms.

Re: PAM Duress – Alternate passwords for panic situations

#287

Post by matrixagent »

solatic wrote: post #285
matrixagent wrote: post #279

Earlier quoted context omitted.

> All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems. Could you give some examples?

Mostly cases where businesses rely on individuals instead of process. As a simple example, it's very easy, when starting a company, to issue personalized email addresses to early employees and then people communicate using those email addresses. It's perfectly fine to email the CTO at first-name@example.com, because everyone knows everyone else and it works. As you grow large, it becomes important for people to addre…

Thanks, that's a great example. I've actually encountered this exact thing at my current employer as well.

Re: PAM Duress – Alternate passwords for panic situations

#288

Post by stordoff »

benelvin wrote: post #214
SamBam wrote: post #170

Earlier quoted context omitted.

I always find it crazy when systems make you dial 9 for an outside line, for this very reason. Did the same thing myself my first week in college. Got the police. Told them what I did and I could hear the eye-roll on the other end of the line, and was told I was the third person that day.

I'd always assumed (UK) that 9 was a deliberate choice to make it easier to dial the emergency number, 999, because you can just mash 9 until something happens. I guess if it's the same number in all other countries who have a range of emergency numbers, then that might not be the reason.

According to Wikipedia:

> The 9-9-9 format was chosen based on the 'button A' and 'button B' design of pre-payment coin-operated public payphones in wide use (first introduced in 1925) which could be easily modified to allow free use of the 9 digit on the rotary dial in addition to the 0 digit (then used to call the operator), without allowing free use of numbers involving other digits

There's a citation, but it's a book from 1950, so not particularly easy to verify.

https://en.wikipedia.org/wiki/999_(emergency_telephone_numbe...

Re: PAM Duress – Alternate passwords for panic situations

#289

Post by stordoff »

theshrike79 wrote: post #275
Angostura wrote: post #210

Earlier quoted context omitted.

Wait a couple of minutes or call back from a different phone. In the UK it may still be possible for an attacker to hold the line open after you hang up - and then simulate the dial tone.

How? If I explicitly push the red button on my mobile phone, how does the line still stay open? I can understand this attack via land line, but who seriously has a land line in 2021? Even my 93 year old grandma has a mobile phone. (Albeit we did get her one that looks like a land line phone :D )

My grandmother (80s) and her circle of friends all use landlines to communicate. Technically her's is a VoIP line since about six months ago, but it's designed as a drop in replacement (uses the same phones/numbers) so I wonder if there's a possibility the attack is still open.

I also use a landline fairly often (mostly out of habit), and most companies only have my landline number as I don't want them contacting me while I'm out/busy.

You're right that it's a dwindling number, but it's certainly not at zero yet.

Re: PAM Duress – Alternate passwords for panic situations

#290

Post by unixhero »

oasisbob wrote: post #29

Training is very important in duress systems. I once worked in a place with a keypad duress code on the security system. If you prefixed your security PIN with NN-, it was the duress version of the code and would trigger a silent alarm. This was setup long-ago, and not communicated. One night, the keypad was acting glitchy. Partially out of frustration (countdown is running), and partially to test, I ended up acciden…

Is it really called "duress systems"? I work in the IT security field and have never heard that term :)
Post reply on HN