Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PAM Duress – Alternate passwords for panic situations

github.com

Post reply on HN
Print view View original

321–330 of 358 posts

Re: PAM Duress – Alternate passwords for panic situations

#321

Post by jaclaz »

BrandoElFollito wrote: post #311
jaclaz wrote: post #236

Earlier quoted context omitted.

I would add that 911 is a "queer" choice (for rotary phones), in other countries the emergency numbers are lowish numbers, in Italy 112 or 113 (or 115), and there are several records in the past of people managing to "dial" them by quickly pushing and releasing the hook switch. There was another reason for this as it was common, many, many years ago, to restrict the possibility to make phone calls by using a little l…

> in Italy 112 Did you introduce the EU emergency number as the national one? If so - good choice. In France we have the plethora of numbers (15, 17, 18 - I actually do not know what 16 does), and also 112. We are still teaching "18" as the primary number (you get the firemen who will either come for a fire, or for an accident, or dispatch). We could go for 112 (and keep the older number for a generation, redirecting…

JFYI, besides and before the EU emergency number, in Italy we traditionally had:

112 Carabinieri (one of the two national "police" corps)

113 Polizia (the other national police corps)

115 Pompieri (Fire Brigade)

118 Ambulanza (Ambulance)

In Italian it is a common phrase "roba da chiamare il 112" o "roba da chiamare il 113" (something that needs a call to 112 or 113) as a synonym of "a serious emergency" and of course if you called those numbers they would anyway forward the call to the appropriate service (like ambulance, fire brigade, etc.).

The EU emergency number is slowly being introduced (some regions have it already, some not yet), but the 112 is already well in the minds of anyone.

Re: PAM Duress – Alternate passwords for panic situations

#322

Post by RealStickman_ »

atoav wrote: post #243
Sebb767 wrote: post #167

Earlier quoted context omitted.

If you used that password twice two years ago when you installed the module and you're suddenly pulled in an interrogation room in a foreign country? When you have about one chance to enter it right while some very angry officers look over your shoulder? I can absolutely see that.

This is why usually these trigger-passwords are just a variation suffix away. If your real password was 123456 + Ok a system like that would trigger if you e.g. append a certain sign to it: 123451 + Ok. So you don't have to remember a different password, you just have to remember the one character or button that makes it call security.

Maybe using a prefix would be better. Similar ease of remembering it but you won't have to fight your muscle memory at the end of the password.

Re: PAM Duress – Alternate passwords for panic situations

#323

Post by sokoloff »

jaclaz wrote: post #321
BrandoElFollito wrote: post #311

Earlier quoted context omitted.

> in Italy 112 Did you introduce the EU emergency number as the national one? If so - good choice. In France we have the plethora of numbers (15, 17, 18 - I actually do not know what 16 does), and also 112. We are still teaching "18" as the primary number (you get the firemen who will either come for a fire, or for an accident, or dispatch). We could go for 112 (and keep the older number for a generation, redirecting…

JFYI, besides and before the EU emergency number, in Italy we traditionally had: 112 Carabinieri (one of the two national "police" corps) 113 Polizia (the other national police corps) 115 Pompieri (Fire Brigade) 118 Ambulanza (Ambulance) In Italian it is a common phrase "roba da chiamare il 112" o "roba da chiamare il 113" (something that needs a call to 112 or 113) as a synonym of "a serious emergency" and of course…

How does/did a citizen make the decision of which police force to call?

Re: PAM Duress – Alternate passwords for panic situations

#324

Post by addingnumbers »

TuringTest wrote: post #240
jtnag wrote: post #224

Earlier quoted context omitted.

I stand corrected then!

Pedantic tidbit of archaic lore: this was so because each digit was represented by the number of clicks that the rotating disc triggered on the line (with 10 clicks for 0).

If the dial was locked or missing, you could still "dial" a number by quickly tapping it with the on-hook switch the receiver would rest on, because that was the same effect the rotary dial mechanism was producing

Re: PAM Duress – Alternate passwords for panic situations

#325

Post by wildfire »

Sebb767 wrote: post #163
isatty wrote: post #146

Earlier quoted context omitted.

Time to post this again: https://www.youtube.com/watch?v=d-7o9xYp7eE (Don't talk to the police)

Customs is different in two crucial points: 1. The probability of your being in a stressful situation without the option to leave is high - you probably arrived via plane, so you can't simply go back, and you don't know the local laws well. 2. You usually know that a customs checkpoint is upcoming. So, in that case, it's far better to prepare (i.e. don't bring things you don't want searched/compromised) and cooperate…

Indeed.

I was once "detained" whilst going from France to England while the customs official searched my bag.

I complained to the UK immigration and the same customs officier called me back, searched my bag again, and said "unless you agree to withdraw your complaint, we are going to have to continue searching your bag until the train departs and you miss it".

i.e. costing me about £150 in expenses.

As expected, I withdraw it and went on my way.

However I now make a point to record the name / number of custom officials I make a complaint to -- in case they turn out to be jerks like the UK one was.

Re: PAM Duress – Alternate passwords for panic situations

#326

Post by wildfire »

egberts1 wrote: post #318
ThrustVectoring wrote: post #242

Earlier quoted context omitted.

> told them to give me a number to call them back on I hope you managed to communicate that you needed it to be able to independently verify that this number belonged to the purported caller. Eg, if it's from your "credit card company", the number should show up on the credit card company's website.

ummmm, caller ID are easily spoofed, no?

yes.

And they are starting to understand more and people know that too.

Typically banks, when challenged here in Australia, will ask you to hang up and call the number on the back of your card (debit or credit).

Normally they give you a reference number so when you are speaking with someone, you can bypass things and pick-up with the person you were originally speaking with.

Re: PAM Duress – Alternate passwords for panic situations

#327

Post by matrixagent »

35fbe7d3d5b9 wrote: post #308
matrixagent wrote: post #279

Earlier quoted context omitted.

> All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems. Could you give some examples?

As JulianMorrison notes, this is common in finance. The FDIC strongly recommends that banks enforce this[1] – you can't cook the books when you have no access to the systems. But sometimes it's not just about cooking the books: the last "SSL cert expiration" fire I lived through happened because the person who had credentials to Digicert had to take sick leave. It was never a documented/defined process because "just…

Thank you, that’s another good example, to which I wish I could relate less. ;)

Re: PAM Duress – Alternate passwords for panic situations

#328

Post by anigbrowl »

lxgr wrote: post #258
anigbrowl wrote: post #134

Earlier quoted context omitted.

If you are so easily swayed, you would probably not be in an adversarial situation with a government anyway. But this article is about a system for giving up passwords under duress without necessarily compromising all your security, such that your antagonist has no way of knowing or showing that there's another password concealing more important information.

> If you are so easily swayed, you would probably not be in an adversarial situation with a government anyway. Complying in the face of threats of physical violence is equivalent to "being easily swayed"? You seem to have a pretty specific threat/defense model that you didn't clarify. I wouldn't generalize from that to "biometrics are bad for all users in all situations".

People who realistically anticipate opponents (the state, kidnappers) using force to get at information on a personally targeted basis are likely willing to deal with a degree of real pressure, as shown by the long-term intransigence of many political prisoners through history.

What I'm saying is that if such threats are unacceptable to a person, chances are they are not going to involve themselves in the sort of activities that require keeping secrets in the first place, or are sufficiently disciplined to have weak device security because they don't write anything down.

Re: PAM Duress – Alternate passwords for panic situations

#329

Post by anigbrowl »

lxgr wrote: post #255
anigbrowl wrote: post #93

Earlier quoted context omitted.

Shoulder surfing and weak passwords are both something you can control at any time. Biometric identification can be exploited involuntarily by someone literally using force to apply your finger to a device or similar. I shouldn't need to say this, it's so obvious that it's a common plot device in action movies.

> Shoulder surfing and weak passwords are both something you can control at any time. How, exactly? And "require users to watch out for shoulder surfing and use strong passwords" does not count. Any chance you are thinking about pretty specific circumstances here (security-aware, technical employees generally not having to enter passwords in public spaces)?

I don't understand why you wouldn't think those count. At some point security rests upon the discipline and good judgment of the person with information to secure. I don't believe you can make a technological system which offers perfect security and perfect convenience. Biometrics are very convenient, but can be exploited by force. Strong passwords and environmental awareness (of snoopers) are quite robust, but at a considerable loss of convenience.

Re: PAM Duress – Alternate passwords for panic situations

#330

Post by atok1 »

dogma1138 wrote: post #66
EamonnMR wrote: post #57

Earlier quoted context omitted.

If your attacker has a full image of your system why are they bothering with duress?

Also depending on the jurisdiction depending on the circumstances triggering it can be a felony the same as destroying evidence or tampering with an investigation, if a court compelled you congrats you’ve just earned yourself a contempt of court charge that can last pretty indefinitely. In a jurisdiction that doesn’t adhere to the rule of law you are already screwed. What people often don’t seem to comprehend is that…

But at this point, we are not caring about 'law' are we? This is used when you are fear for your life because of law enforcement entities.
Post reply on HN