Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS protections against data extraction from locked devices

discuss.grapheneos.org

Post reply on HN
Print view View original

201–210 of 284 posts

Re: GrapheneOS protections against data extraction from locked devices

#201

Post by inigyou »

kmeisthax wrote: post #195
inigyou wrote: post #152

Earlier quoted context omitted.

The only really plausibly deniable way to do it is for every graphene phone to come pre-partitioned for this. E.g. 128GB main + 128GB duress, random selection of whether partition 0 or 1 is the duress partition. But that means giving up half your storage. You can't even make them different sizes because that gives away which one is duress. You could have more partitions with a static split like 32+32+32+32+32+32+32+3…

Deniable encryption has gotten way more advanced than this, though - the state-of-the-art is to have a bunch of independently unlockable data stores along with a mechanism to add chaff data that doesn't decrypt with any key. That's how bunnie's Betrusted project works, and it's the same idea as PhonebookFS from yesterdecade. The main problem with any deniable encryption system is that while your adversary might not b…

That requires a whole new OS from scratch. It won't work to support Android. Even if it did, would you unlock your duress partition every time you used your phone to prevent overwriting?

Re: GrapheneOS protections against data extraction from locked devices

#202

Post by grapheneos »

cromka wrote: post #43
prmoustache wrote: post #9

What GrapheneOS is missing is a complete backup and restore solution so that people can preventively wipe their smartphone before crossing the border. It would be nice to have the possibility to backup/restore every app and their data from an ssh/sftp server the way google/apple users do with google cloud / icloud. I'd rather wipe my smartphone, only add a couple of direct contacts, a copy of my passport and the pdf…

I think more useful would be to be able to boot into another data partition with a different password, which, in turn, would hide the other "daily" partition. I believe LUKS is capable of that. The storage dump looks like a random set of data and only a valid password can find and decrypt a matching hidden partition. Ideally this should also work on lock screen, e.g. if you type in a non-standard PIN, it would boot f…

That isn't truly hidden and can be detected as a low level from the SSD.

Re: GrapheneOS protections against data extraction from locked devices

#203

Post by grapheneos »

inigyou wrote: post #146
Cider9986 wrote: post #82

Earlier quoted context omitted.

GrapheneOS seems to be consistently the hardest to exploit AFU based on various Cellubrite leaks. iPhones have better protection than all other Androids except Pixels.

IIRC it was the only one that Cellebrite couldn't break, but this was based on quite old news.

There are more recent leaks. The last release of GrapheneOS they've been able to exploit on locked device is still from 2022 as of a couple months ago. They take longer to break into iPhones than stock Pixels but that may largely be due to Google giving much earlier access for public testing. They have a far shorter window to prepare for a new iOS release before it's in production as a regular update for users.

Re: GrapheneOS protections against data extraction from locked devices

#204

Post by prmoustache »

inigyou wrote: post #178
hamper653 wrote: post #175

Earlier quoted context omitted.

> Is that a success? Definitely. > Maybe, if your data really is that valuable and a successful border crossing isn't. Even if my data consisted entirely of cat pictures, it would be more valuable than successfuly crossing the border into a country that actively tries to invade my privacy.

Well why are you showing up at a border crossing if you don't want to cross the border?

You may wish to cross the border but not at all costs.

Re: GrapheneOS protections against data extraction from locked devices

#205

Post by skitsofrandom »

inigyou wrote: post #159
skitsofrandom wrote: post #107

Earlier quoted context omitted.

This may feel like a good idea as a “gotcha” justification but it just doesn’t matter. It’s still extremely abnormal and you will stick out. The only way to protect yourself is by blending in, not sticking out.

I think it would work. It's plausible enough. It doesn't have to be the most common answer to be accepted.

Well but the point goes beyond “do they let you through.” All of this goes past the here and now. It’s about getting flagged in some system that causes you to get picked out 3 stops down the line when these odd occurrences add up to you not being trustworthy based on your profile history.

That kind of history is already being collected about people. That’s what you should be worried about when it comes to engineering some scheme that sounds clever.

Re: GrapheneOS protections against data extraction from locked devices

#206

Post by prmoustache »

xnickb wrote: post #151
iamnothere wrote: post #145

Earlier quoted context omitted.

Restoring from remote backup when you reach your destination, then wiping again before you cross borders. Or shipping the (encrypted) data separately and picking it up after safe arrival.

What's the difference between this and wiping when under duress using the special PIN? If you aren't being checked you don't wipe and are gopd to go.

Wiping under duress is unlawful and could lead to prosecution in some juridictions.

On the other hand I don't know of any juridiction that force you to carry all the personal data in a single device when crossing borders. It would moat likely not even be possible.

Re: GrapheneOS protections against data extraction from locked devices

#207

Post by prmoustache »

mystifyingpoi wrote: post #117
kotaKat wrote: post #77

Earlier quoted context omitted.

This is where we need "cloud phones as a service" / "selfhosting a cellphone at home with some kind of remote access system". Not even kidding here, it's time to bring out thin client computing to cellphones. Let the spicy stuff sit somewhere else. I could bootstrap a Tailscale or Netbird signin remotely, install the access client, and remote back into the 'normal phone'. Would be then funny to map that to lockscreen…

> "selfhosting a cellphone at home with some kind of remote access system You can use TeamViewer for that. Or maybe scrcpy could be coerced into working in a similar way.

Good luck making it work again remotely after a long power outage.

Re: GrapheneOS protections against data extraction from locked devices

#208

Post by t1234s »

Cider9986 wrote: post #130
t1234s wrote: post #87

I always leave my phone and laptop off when going through TSA or Passport Control. I don't think in the US you an be compelled into giving up your password. They are free to confiscate the device but with it powered down good luck trying to break the password.

Powering down or restarting is ideal because BFU is much more secure. Although, based on the latest Cellubrite leaks, GrapheneOS can't be exploited in AFU either. There's also the reboot timer which brings the device to a BFU state. GrapheneOS implemented it and then Google and apple implemented their own version with fixed timers. GrapheneOS's is configurable down to 10 minutes, the default is 18 hours. On iPhones a…

they need a shortcut where you triple tap the power button and it just does a fast hard power off similar to removing the battery.

Re: GrapheneOS protections against data extraction from locked devices

#209

Post by cromka »

grapheneos wrote: post #202
cromka wrote: post #43

Earlier quoted context omitted.

I think more useful would be to be able to boot into another data partition with a different password, which, in turn, would hide the other "daily" partition. I believe LUKS is capable of that. The storage dump looks like a random set of data and only a valid password can find and decrypt a matching hidden partition. Ideally this should also work on lock screen, e.g. if you type in a non-standard PIN, it would boot f…

That isn't truly hidden and can be detected as a low level from the SSD.

No it can't. The the thing, it's obfuscated.

Re: GrapheneOS protections against data extraction from locked devices

#210

Post by xnickb »

iamnothere wrote: post #188
xnickb wrote: post #182

Earlier quoted context omitted.

That's not my point. Rather that any self-hosted solution would. Encryption is completely optional and can be illegal in some places. As long as you trust the endpoint you only care about encryption in transit. If your devices are seized having encrypted data can pose extra risk. Deniable encryption exists and burden of proving that you haven't used it can be put on you. Basically I'm trying to say "it depends". I'm…

> If your devices are seized having encrypted data can pose extra risk. I don’t think you can even set up an iPhone anymore without encryption. It’s just “on”, not even “on by default”. > My home servers aren't encrypted and I see no reason to do so. Sensitive data is encrypted based on the sensitivity. If you do sensitive work, you should be concerned about someone breaking in and running off with your storage. It’s…

No you just chose to ignore other cases that OP mentioned and focused on this one
Post reply on HN