Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US citizen charged after GrapheneOS phone wipes during airport search

techspot.com

Post reply on HN
Print view View original

801–810 of 1001 posts

Re: US citizen charged after GrapheneOS phone wipes during airport search

#801

Post by gruez »

CGamesPlay wrote: post #160
gruez wrote: post #17

Earlier quoted context omitted.

If you read the linked thread, you'd see the reasons are: 1. SSDs (including phones) have TRIM/discard, so you need to disable it, otherwise the hidden volume would get wiped. You going out of your way to disable it is going to be suspicious. 2. Even if the above wasn't an issue, you can't really use the outer os to any meaningful extent, because you run the risk of overwriting the inner volume. That makes your decoy…

I last used this feature probably more than a decade ago, but: you provide 2 passwords when decrypting. If the first password is the main volume, the second is attempted as a hidden volume. If both match, the main volume registers the hidden volume as free space but prevents writing to it. If the hidden volume doesn't match, the main volume will clobber the hidden volume. So the main/hidden volumes really works like…

>So the main/hidden volumes really works like a duress: you might destroy your hidden volume while using the main one under duress, but that does not apply when using the main volume while able to additionally unlock the hidden volume.

The problem is that if the main volume doesn't have any signs of activity, then that's highly suspicious. Why are you carrying around a laptop that's mostly empty and hasn't been used in months? Why is it that despite seemingly not being used in months, there's physical signs of wear, like scratches or dust accumulation? If you do try to make the main volume seem "used", you run the risk of accidentally overwriting your hidden volume.

Re: US citizen charged after GrapheneOS phone wipes during airport search

#802

Post by __MatrixMan__ »

Grimblewald wrote: post #2

VeraCrypt has a cool function which is a reserved space for a decoy OS.[1] Everything else registers as free space while decrypting to dummy volume. You make the dummy volume look lived in, and forget. provide dummy password, volume decrypts such that only dummy is accessible/readable. give proper password, real OS and FS decrypt and load. Something like this may need to become the standars over duress pins which sho…

I worry about approaches like this because maybe the forensics tool fills all available space and then clears it, noticing that this particular phone is an anomaly re:

    manufacturer published space = allegedly available space + size of known files
If you're hiding something in "empty space" it won't behave like empty space when you try to fill it.

I think we need to be stenographically smarter. Like if there's some mechanism of deduplicating blocks across volumes, then perhaps when given the special key you could temporarily render a volume whose parts are hidden in the data already occupied by the other volume and then just run it in memory so that a reboot clears it.

Re: US citizen charged after GrapheneOS phone wipes during airport search

#803

Post by cortesoft »

throwawayffffas wrote: post #797
schoen wrote: post #383

I co-wrote a border search guide for EFF some years ago. I was very interested in finding clever technical approaches but I later ended up feeling that I hadn't given enough thought to the overall threat model questions (even though the guide did address them, perhaps even somewhat usefully). The big picture problem is that the agents performing the searches have an enormous amount of power in terms of potentially se…

There are 2 cases routine inspections and targeted investigations. If it's a routine inspection, being uncooperative will probably lead them to escalate. You generally want to keep things routine and boring. If they want to access your device you have to weigh the costs, just log out of everything before you fly and throw away your device after they have had access to it, it's now compromised. If you are targeted you…

> just log out of everything before you fly and throw away your device after they have had access to it, it's now compromised.

I get what you are saying, but this is incredibly expensive and not really practical for most people.

Re: US citizen charged after GrapheneOS phone wipes during airport search

#804

Post by nxc18 »

mattlondon wrote: post #681
schoen wrote: post #383

I co-wrote a border search guide for EFF some years ago. I was very interested in finding clever technical approaches but I later ended up feeling that I hadn't given enough thought to the overall threat model questions (even though the guide did address them, perhaps even somewhat usefully). The big picture problem is that the agents performing the searches have an enormous amount of power in terms of potentially se…

I think in these situations your absolute best bet is fawning compliance. Ask precisely how high they want you to jump. Perhaps your friendly smiling Yes-Sir-No-Sir-3-bags-Full-Sir act might just be enough to let you get on your way without anything else happening apart from a stamp in your passport. Even the slightest hint of defiance or surliness from you to a border guard/policeman/etc - potentially at the end of…

It’s weird how few people understand that just being courteous/polite eases most encounters considerably.

Absolutely astonishing seeing people try the “I’m going to be as annoying as humanly possible” to the guy with the gun with the “my YouTube lawyer says I can” defense. You don’t want to have to defend your civil rights in court.

This goes doubly when at immigration where you basically don’t have rights.

This guidance also applies to: bank tellers, call takers, baristas, waiters, other people standing in line with you, the bus driver, your mom, the neighbors upstairs, the raccoon across the street, …

Re: US citizen charged after GrapheneOS phone wipes during airport search

#805

Post by cortesoft »

pbmonster wrote: post #712
jvanderbot wrote: post #678

Earlier quoted context omitted.

A phone with a backup account, unlocked with duress pin makes sense to me. How hard would it be to admin-allow some apps to work across barriers. E.g., wallet apps work, airline tickets work, but email/socials do not. the issue is that when a phone is unlocked, they can just plug in a USB device and scrape everything off it. The TSA agent may not be eyeballing a facebook account so much as plugging in an exfiltration…

> the issue is that when a phone is unlocked, they can just plug in a USB device and scrape everything off it That's useless if the backup account and the main account use different keys for the home partition. VeraCrypt (used to?) have this. It was called a hidden volume. One volume, but two keys, two passwords, and two different containers full of data. Technically, the second volume is written into the partition "…

Yep, and there is also no way to tell if a hidden volume exists, because a volume without a hidden volume would fill that space with random data indistinguishable from a hidden volume.

Re: US citizen charged after GrapheneOS phone wipes during airport search

#806

Post by tmp10423288442 »

throwawayffffas wrote: post #797
schoen wrote: post #383

I co-wrote a border search guide for EFF some years ago. I was very interested in finding clever technical approaches but I later ended up feeling that I hadn't given enough thought to the overall threat model questions (even though the guide did address them, perhaps even somewhat usefully). The big picture problem is that the agents performing the searches have an enormous amount of power in terms of potentially se…

There are 2 cases routine inspections and targeted investigations. If it's a routine inspection, being uncooperative will probably lead them to escalate. You generally want to keep things routine and boring. If they want to access your device you have to weigh the costs, just log out of everything before you fly and throw away your device after they have had access to it, it's now compromised. If you are targeted you…

> I am not a lawyer but if you are a citizen they probably can't deny you entry but can probably detain you for an uncomfortable amount of time, and seize whatever they want. Your best defense is to have a burner phone and no other devices nothing they can seize that would hurt you.

Even having a burner phone without any personal information on it can be deemed suspicious. It would be best for your phone to have a recently-reinstalled OS, with a few critical apps like Whatsapp or iMessage set up with a few personal messages sent. You need to be able to set those up without a password manager. Anything else needs to take place on devices that you aren't carrying with you. Fortunately enough people don't update their Facebook these days that just having an account that exists but you don't use will probably work, assuming you don't look like someone that would be obsessed with their socials.

Maybe there are USB thumb drives that operate like a YubiKey unless special setup is performed to access the storage inside? That's one way to carry data with you if you have to.

Re: US citizen charged after GrapheneOS phone wipes during airport search

#807

Post by radu_floricica »

voakbasda wrote: post #699
piltdownman wrote: post #690

Earlier quoted context omitted.

"If you want a picture of the future, imagine a boot stamping on a human face - for ever"

I will ask this here again: At what point did the German people find it morally acceptable to start killing Nazis? At what point will the US stop accepting the boot and act to remove the tyranny stamping on our collective face?

If it helps, the nazis themselves probably asked this very question before they started killing ... whatever the contemporary term for nazis was back than.

Re: US citizen charged after GrapheneOS phone wipes during airport search

#808

Post by Cider9986 »

Grapheneos comment on hidden profiles/veracrypt style plausible deniability:

>It's possible to make a semi-hidden feature but hiding it well enough to avoid detection by software forensic tools requires not basing it around profiles. It would really need to be a nested GrapheneOS in a virtual machine. It could also still be detected at an SSD level

https://nitter.net/GrapheneOS/status/2081471477174456340#m

Here's some info from veracrypt on the SSD level.

https://veracrypt.io/en/Wear-Leveling.html

https://veracrypt.io/en/Trim%20Operation.html

Re: US citizen charged after GrapheneOS phone wipes during airport search

#809

Post by throwawayffffas »

tmp10423288442 wrote: post #806
throwawayffffas wrote: post #797

Earlier quoted context omitted.

There are 2 cases routine inspections and targeted investigations. If it's a routine inspection, being uncooperative will probably lead them to escalate. You generally want to keep things routine and boring. If they want to access your device you have to weigh the costs, just log out of everything before you fly and throw away your device after they have had access to it, it's now compromised. If you are targeted you…

> I am not a lawyer but if you are a citizen they probably can't deny you entry but can probably detain you for an uncomfortable amount of time, and seize whatever they want. Your best defense is to have a burner phone and no other devices nothing they can seize that would hurt you. Even having a burner phone without any personal information on it can be deemed suspicious. It would be best for your phone to have a re…

You can offer the I don't travel with my real phone because it got stolen a bunch of times excuse.

The point is even if they become suspicious all they can do is seize the burner ask you a bunch of questions etc. search you, etc they can't get access to your data. You can't get in real trouble, just majorly inconvenienced.

Re: US citizen charged after GrapheneOS phone wipes during airport search

#810

Post by Cider9986 »

northernsausage wrote: post #354

If this happened in an EU country you'd all be wetting yourselves, but for some reason the rooms different today. The professional advice we are given traveling to the US is back up you phone, wipe it, travel and restore once you are comfortable. Sad state of affairs guys

In the US, he could have refused to give the pin and that's protected under the 5th Amendment. They would have nothing because they couldn't get into the encrypted phone.

In many countries other then the US like Ireland, they have key disclosure laws which require you to testify against yourself.

In the UK, police can even require key disclosure without a judge.

Post reply on HN