Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PAM Duress – Alternate passwords for panic situations

github.com

Post reply on HN
Print view View original

341–350 of 358 posts

Re: PAM Duress – Alternate passwords for panic situations

#341

Post by unixhero »

nuvious wrote: post #340
unixhero wrote: post #290

Earlier quoted context omitted.

Is it really called "duress systems"? I work in the IT security field and have never heard that term :)

Author here; it relates more with physical security and I've used them in the military and in corporate structures. Most duress word programs are designed to be spoken; say security calls because an alarm is set off and the aggressors are coercing you to get the security off their backs. One may say, "Sorry I was working late and fumbled the alarm. Mr. Rogers has a board meeting tomorrow so I've been working late," w…

I see, thanks a lot for your clarification.

Re: PAM Duress – Alternate passwords for panic situations

#342

Post by BrandoElFollito »

cmehdy wrote: post #320
BrandoElFollito wrote: post #311

Earlier quoted context omitted.

> in Italy 112 Did you introduce the EU emergency number as the national one? If so - good choice. In France we have the plethora of numbers (15, 17, 18 - I actually do not know what 16 does), and also 112. We are still teaching "18" as the primary number (you get the firemen who will either come for a fire, or for an accident, or dispatch). We could go for 112 (and keep the older number for a generation, redirecting…

If you can read french, here's a page about why 16 isn't used (anymore!) https://www.guichetdusavoir.org/viewtopic.php?t=36236 TL;DR Running out of numbers and putting in temporary measures requiring the 16 as prefix. Measures that likely didn't scale as well as expected since we moved on to a different system within basically 10 years.

Ahhh! Of course - 16 for long distance calls! How could I have forgotten (it was introduced when I was a teenager).

Thanks for reminding me :)

Re: PAM Duress – Alternate passwords for panic situations

#343

Post by BrandoElFollito »

sokoloff wrote: post #323
jaclaz wrote: post #321

Earlier quoted context omitted.

JFYI, besides and before the EU emergency number, in Italy we traditionally had: 112 Carabinieri (one of the two national "police" corps) 113 Polizia (the other national police corps) 115 Pompieri (Fire Brigade) 118 Ambulanza (Ambulance) In Italian it is a common phrase "roba da chiamare il 112" o "roba da chiamare il 113" (something that needs a call to 112 or 113) as a synonym of "a serious emergency" and of course…

How does/did a citizen make the decision of which police force to call?

In France we also have two "police" forces: the "gendarmerie" and the "police nationale".

You may know "gendarmerie" from the Louis de Funes movies (Le gendarme de St Tropez, ...) - this is a military unit that mostly works in the countryside.

The "police nationale" is an entity attached to the ministry of interior and does more or less the same things, but more in the cities.

There is a history of hatred between these organizations - yes, this is how stupid we are. They share competencies (the most well known being the elite units - GIGN and RAID)

When you want to call the police, you dial 17 and you get the right one, depending on where you are.

If you have a health problem, you call the 18 (firemen), or the 15 (ambulance).

If there is a fire, you call the 18.

This is why having a single 112 number is easier to teach to children and tourists.

Re: PAM Duress – Alternate passwords for panic situations

#344

Post by jaclaz »

sokoloff wrote: post #323
jaclaz wrote: post #321

Earlier quoted context omitted.

JFYI, besides and before the EU emergency number, in Italy we traditionally had: 112 Carabinieri (one of the two national "police" corps) 113 Polizia (the other national police corps) 115 Pompieri (Fire Brigade) 118 Ambulanza (Ambulance) In Italian it is a common phrase "roba da chiamare il 112" o "roba da chiamare il 113" (something that needs a call to 112 or 113) as a synonym of "a serious emergency" and of course…

How does/did a citizen make the decision of which police force to call?

> How does/did a citizen make the decision of which police force to call?

It is a good question.

It depends.

There may be territorial choices or also "political" ones.

Typically Carabinieri have more presence in the country/villages/small towns whilst Police have more presence in larger cities (but there are Carabinieri there as well and - additionally - the local police, which were once called Vigili Urbani and now are called Polizia Municipale, and there is also the Polizia Regionale, to the joy of foreigners that do have a really hard time to understand the subtleties), highways and main roads are typically Police only (Polizia Stradale), but minor roads are usually patroled by the Carabinieri.

So usually you call (called) 112 or 113 depending on where you are (where the emergency happens).

The "political" part is even more subtle.

The Carabinieri are a branch of the military, whilst the Police are "civil", people leaning to the right tend to trust the Carabinieri (whose motto is "nei secoli fedele" i.e. "faithful in centuries") more than Police, whilst people leaning to the left tend to trust the Police as being more independent.

Until not so many years ago if you (or your family) had some relationship/contacts with some (left side) parties or association you would have not been allowed to join the Carabinieri (whether this was official policy or simply what happened is another thing).

The popular perception was (is) that the Carabinieri operate strictly by the Law, whilst Police is a little more "giving/flexible" (on minor things).

On the other hand, once it was easier to join the Carabinieri with a lower level of school/education than to join the Police, so we have here all the jokes about stupidity/ignorance targeting the Carabinieri (the same ones that traditionally in the UK are about the Irish or the Polish).

Re: PAM Duress – Alternate passwords for panic situations

#345

Post by nullc »

Surprised to not see this mentioned here: https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29

And http://dmsteg.sourceforge.net/

Alas, work in this space appears to be abandoned, too bad too because much could be done to improve robustness when writing with umounted aspects, or preserving security against attackers that can take images of the disk at different times.

Not to mention: integrating the results in standard software so the mere presence of the software on your host doesn't harm the deniability.

Re: PAM Duress – Alternate passwords for panic situations

#346

Post by LorenPechtel »

sokoloff wrote: post #145
oasisbob wrote: post #29

Training is very important in duress systems. I once worked in a place with a keypad duress code on the security system. If you prefixed your security PIN with NN-, it was the duress version of the code and would trigger a silent alarm. This was setup long-ago, and not communicated. One night, the keypad was acting glitchy. Partially out of frustration (countdown is running), and partially to test, I ended up acciden…

I had a similar false trigger trying to make an international call from our office phones. I didn’t know the exact incantation of the prefix, but knew it was 9 for an outside line and at home I used 011 then the country code. That didn’t seem to work, so I thought maybe I needed to drop the zero, resulting in me inadvertently dialing 911 and hanging up when that didn’t give me the dial tone I expected. I found the ri…

I've seen it with someone with a certain amount of dementia trying to make a modem work. What he was trying to do was actually impossible and he responded to failure by trying variations on it.

Perhaps it needs the 1 for long distance? (No, it doesn't, the software knows better.) Perhaps it needs a 9 for an outside line? (No, the modem already has an outside line, it doesn't go through the phone system.)

I'm sure you can see what he did.

Re: PAM Duress – Alternate passwords for panic situations

#347

Post by sleavey »

wowaname wrote: post #299
sleavey wrote: post #226

Earlier quoted context omitted.

Do you want to first find that out when you're under duress? Sensible defaults matter.

Are you seriously writing a script when the cops are at your door? No, you aren't. You always need to verify that your protective mechanisms work before actually relying on them.

As I alluded to in my original comment, you might not pick up on a transient error like an I/O error during testing. This is exactly the sort of thing a sensible default setting in the program should cover.

Re: PAM Duress – Alternate passwords for panic situations

#348

Post by dogma1138 »

atok1 wrote: post #330
dogma1138 wrote: post #66

Earlier quoted context omitted.

Also depending on the jurisdiction depending on the circumstances triggering it can be a felony the same as destroying evidence or tampering with an investigation, if a court compelled you congrats you’ve just earned yourself a contempt of court charge that can last pretty indefinitely. In a jurisdiction that doesn’t adhere to the rule of law you are already screwed. What people often don’t seem to comprehend is that…

But at this point, we are not caring about 'law' are we? This is used when you are fear for your life because of law enforcement entities.

If you have an actual reason to fear for your life it’s game over, the “Stasi” doesn’t care if they find evidence or not.

If it’s the FBI then fearing for your life isn’t exactly part of the equation really.

Re: PAM Duress – Alternate passwords for panic situations

#349

Post by o-__-o »

jaywalk wrote: post #313
o-__-o wrote: post #181

Earlier quoted context omitted.

>The simplest example is asking “Do you know why I pulled you over?”. Typically, people spontaneously confess to speeding, sometimes they break down and admit that someone is wrapped up in a rug in the trunk. I was asked this once, after I read a hilarious reddit comment, and found myself in a similar situation. I looked at the cop and said "it's not because of the pot in my trunk is it?". "Step out and open your tru…

Yeah, what you did was not smart. If you're being pulled over for a minor traffic infraction and you already know that you're guilty, simply admitting to it is usually the best option. I've gotten out of many tickets this way, because cops really do appreciate when you're not trying to BS them. I was also pulled over once and accused of running a stop sign that I knew I didn't run, because I had seen the cop sitting…

Why wasn't it smart (besides actually talking to the cop)? I was not guilty of anything but making a joke in bad taste (and maybe doing 59 in a 55). It was an inconvenience to be detained for an hour, but it wasn't a hot day, I didn't have any obligations...

>simply admitting

no your best option is not to say a GD thing. story time: i was once pulled over on the eastern shore by a cop that was barely my age. i didn't say a word to him for the 10 minute stop. that really messed with his mental state and I could tell his internal hard drive was returning a seek error. at the end he stammered out "o-okay, w-well you slow down and haveaniceday" then he quick walked back to his car and turned down a side road.

NEVER TALK TO COPS.

Re: PAM Duress – Alternate passwords for panic situations

#350

Post by jjeaff »

csunbird wrote: post #281
gnicholas wrote: post #205

Earlier quoted context omitted.

Relatedly, make sure you trigger the password lock on your device before handing it over. They may be able to compel you to give your biometrics but not your password (the latter is considered compelled speech, and the courts have not fully litigated whether the former is treated the same).

For iphones, just tap the power button repeatedly, it will force a password entry to unlock.

At least on Android, turning off or restarting your phone will work as well. Because you must enter your pin or password upon first starting up rather than use biometrics. At least, that seems to be the default. It may be a setting somewhere to turn that off.
Post reply on HN