Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US citizen charged after GrapheneOS phone wipes during airport search

techspot.com

Post reply on HN
Print view View original

221–230 of 1001 posts

Re: US citizen charged after GrapheneOS phone wipes during airport search

#221

Post by SubiculumCode »

sfRattan wrote: post #25

Ultimately, when you choose to enter a duress PIN that will wipe your device, you have to recognize that choice may have legal consequences. I don't like the amount of power our government has at the national border when it comes to detaining and pressuring citizens, but our Constitution explicitly grants it at least some of the power it now exercises in that context. If your threat model includes US state actors at…

Not a lawyer, but destruction of evidence would only be valid if there was first some reasonable suspicion of a crime? Is that right?

Re: US citizen charged after GrapheneOS phone wipes during airport search

#222

Post by refurb »

incompatible wrote: post #32

One of the GrapheneOS people (I think) suggested keeping a bit of paper in your wallet with the duress pin, perhaps thinly disguised. Then the cops could try it on their own initiative. I suppose they'd become aware of that trick eventually, but then they wouldn't be able to use all those other genuine pins they find.

A far better approach is for the US citizen to simply say "I chose not to provide my PIN".

The officer will say something like "That's your choice, but I will need to seize the device to conduct an analysis. It will be returned once the analysis is complete".

Then you shrug, and they will let you enter the US. The cops will try to get into the phone, fail, and return it to you.

Just bring a phone you don't mind losing for a few months.

Re: US citizen charged after GrapheneOS phone wipes during airport search

#223

Post by abofh »

TheDong wrote: post #159
cameldrv wrote: post #74

I’ve seen a lot of people on the internet over the years say things like “the government can’t make x illegal, it’s just y.” For example, the government can’t make wiping your phone at the border illegal, it’s just punching four numbers into your phone, just like a pin, only a different four numbers, which could just have well been your pin. U.S. law though is highly non-autistic and what you were trying to do is jus…

This was really well written in "What color are your bits": https://ansuz.sooke.bc.ca/entry/23 Programmers have trouble seeing color (two identical numbers are the same bits, how can typing '1234' to unlock one phone be legal, and '1234' to unlock another phone be illegal?) Courts care about color (intent, provenance, permission), even though that color cannot be digitally represented.

Indeed, but should he say his real code was one digit swap off, could you prove intent? Color matters, but you can't paint with only one

Re: US citizen charged after GrapheneOS phone wipes during airport search

#224

Post by SubiculumCode »

kube-system wrote: post #134
bubblethink wrote: post #28

Earlier quoted context omitted.

>destroy evidence Who said it was evidence? Did a judge authorize or issue a warrant to collect said evidence? Absent that, it's just your property, and you can do with it as you please.

"Evidence" has never been limited to the subject of a warrant. Destruction of evidence statutes typically include material that is subject to a police investigation.

But are not investigations typically under some reasonable suspicion that a crime had occurred?

Re: US citizen charged after GrapheneOS phone wipes during airport search

#225

Post by SubiculumCode »

xdennis wrote: post #126
bubblethink wrote: post #28

Earlier quoted context omitted.

>destroy evidence Who said it was evidence? Did a judge authorize or issue a warrant to collect said evidence? Absent that, it's just your property, and you can do with it as you please.

> Who said it was evidence? Did a judge authorize or issue a warrant to collect said evidence? Absent that, it's just your property, and you can do with it as you please. Why do people go sovereign citizen when reality doesn't work their way? Stop imagining that the way you want things to be is the way things really are. Cops do not need a judge to authorize the seizing of evidence. Cops do not need judges to decide…

How about, is there reasonable suspicion that a crime has occurred?

Re: US citizen charged after GrapheneOS phone wipes during airport search

#226

Post by sire-vc »

To everyone who thinks this is somehow a violation of rights: if you were being questioned by border officers, and were asked 'Sir could you please open your suitcase', and you pressed a button that caused it to burst into flames, there isn't a country in the entire world that wouldn't arrest you on the spot. Why would 'wipe a phone when officer requests it opened' be treated any differently? Suspicious behaviour is treated as suspicious by normal people.

Re: US citizen charged after GrapheneOS phone wipes during airport search

#227

Post by teravor »

jauntywundrkind wrote: post #218
teravor wrote: post #16

Earlier quoted context omitted.

this will likely fail as block devices aren't dumb anymore, the firmware state will out the hidden volume. counting on the laziness/unsophistication of an adversary isn't a great move. this problem may be solvable by a purpose-built abstraction where every write no matter what address will look identical to the firmware (naively, a randomized key-value map).

I agree that trying to outcompete seems really hard, but also: Given what the experience of using a non-rooted phone is like, how very very tight the sandboxing is and how useless it is a General Purpose Computer that will tell you anything: I find it very hard to believe the unlocked phone is going to let you start probing firmware & snooping on hidden volumes. This post sent my BS detector on high alert. I'm strugg…

you do realize what the threat model behind a hidden volume is right?

no one will be accessing the firmware through the OS, they will access it from the PCB/chip/debug port. there is no point to a hidden volume if you cannot credibly deny its existance.

Re: US citizen charged after GrapheneOS phone wipes during airport search

#228

Post by greycol »

dyauspitr wrote: post #84
treetalker wrote: post #40

Earlier quoted context omitted.

To me it’s all quite analogous to walking up to, but not crossing, a border with, say, a fruit that’s legal to possess on the side you’re on, but not on the other side, and either eating or throwing away that fruit before crossing. “Hey! I saw you holding that Mexican pepper in Mexico, and then you threw it in that Mexican trash can before crossing into Texas!” “Yeah, so?”

This is more like bringing the pepper across and then quickly swallowing it when they ask you to look at it.

Or emptying your bottle of water when the TSA found it on the XRAY. Unlike the pepper he's actually allowed to have that data on his phone both sides of the border.

Re: US citizen charged after GrapheneOS phone wipes during airport search

#229

Post by OGWhales »

teravor wrote: post #16
Grimblewald wrote: post #2

VeraCrypt has a cool function which is a reserved space for a decoy OS.[1] Everything else registers as free space while decrypting to dummy volume. You make the dummy volume look lived in, and forget. provide dummy password, volume decrypts such that only dummy is accessible/readable. give proper password, real OS and FS decrypt and load. Something like this may need to become the standars over duress pins which sho…

this will likely fail as block devices aren't dumb anymore, the firmware state will out the hidden volume. counting on the laziness/unsophistication of an adversary isn't a great move. this problem may be solvable by a purpose-built abstraction where every write no matter what address will look identical to the firmware (naively, a randomized key-value map).

Not that shufflecake solves the issue you highlighted, but I found the shufflecake FAQ to be a good intro to the topic for anyone curious. It does a good job explaining the threat vectors and the relevant trade offs, in particular the TRIM and ORAM sections. It’s also just a cool project: https://shufflecake.net/

Re: US citizen charged after GrapheneOS phone wipes during airport search

#230

Post by itake »

zuzululu wrote: post #85

why not just have a separate device for traveling ?

- e-sims make it much more difficult to swap sim cards between devices.

- presumably border patrol wants to see his photos, social accounts, and email. A separate device with a copy of the information they want isn't a defense. Creating fresh travel-only accounts is tedious, b/c fresh accounts aren't connected to your friends or network (with whom you'd want to share your trip with).

Post reply on HN