PAM Duress – Alternate passwords for panic situations

Post by Nursie » Sun, Aug 22, 2021, 10:20 PM UTC

mimimi31 wrote: post #97

necovek wrote: post #75

There are multiple levels of protection one might want. I.e. when you are being selected for random questioning entering US as a non-US citizen, you'd benefit from steganography-like approach: you give a password, and relatively bland, non-personal stuff shows up, giving appearance of full access to a system. If you only care about your privacy, the next one is to have a destroy-everything script (and it's not that h…

>usually, passphrases are only used to decrypt the actual encryption keys, so overwriting those keys should be super fast I'm not sure if it's really that simple with modern flash storage. There might be no guarantee that attempting to overwrite some data will actually affect the particular memory cells where it is stored. You would probably have to trigger a secure erase to reset all memory cells and hope that it is…

Post by roblabla » Sun, Aug 22, 2021, 10:24 PM UTC

packet_nerd wrote: post #108

necovek wrote: post #75

There are multiple levels of protection one might want. I.e. when you are being selected for random questioning entering US as a non-US citizen, you'd benefit from steganography-like approach: you give a password, and relatively bland, non-personal stuff shows up, giving appearance of full access to a system. If you only care about your privacy, the next one is to have a destroy-everything script (and it's not that h…

> I.e. when you are being selected for random questioning entering US as a non-US citizen, you'd benefit from steganography-like approach: you give a password, and relatively bland, non-personal stuff shows up, giving appearance of full access to a system. Is there a practical way to implement this today with Linux? I know VeraCrypt supports hidden operating systems, but I think only Windows?

Post by dheera » Sun, Aug 22, 2021, 10:35 PM UTC

canada_dry wrote: post #119

dheera wrote: post #73

Earlier quoted context omitted.

I think on Android you can set up multiple users.

I'd love that feature (android 9+) if it allowed me to install some of the gazillion apps (e.g. every bloody fast food place that only has deals via their app) but restricts them from accessing my real user contacts, emails, msgs, gps/location, etc. Blackberry phones had this feature and it was pretty bulletproof.

Post by nexus7556 » Sun, Aug 22, 2021, 10:37 PM UTC

necovek wrote: post #75

There are multiple levels of protection one might want. I.e. when you are being selected for random questioning entering US as a non-US citizen, you'd benefit from steganography-like approach: you give a password, and relatively bland, non-personal stuff shows up, giving appearance of full access to a system. If you only care about your privacy, the next one is to have a destroy-everything script (and it's not that h…

Post by dredmorbius » Sun, Aug 22, 2021, 10:47 PM UTC

dheera wrote: post #79

oasisbob wrote: post #29

Training is very important in duress systems. I once worked in a place with a keypad duress code on the security system. If you prefixed your security PIN with NN-, it was the duress version of the code and would trigger a silent alarm. This was setup long-ago, and not communicated. One night, the keypad was acting glitchy. Partially out of frustration (countdown is running), and partially to test, I ended up acciden…

An interesting way to use this PAM-Duress system would be to write a program that (a) begins recording your microphone and webcam video immediately upon login (b) Aggressively try the hell out of every passwordless Wi-Fi network it can detect, then use headless chrome to aggressively smack every button to get past the stupid login pages (c) Stream that video and audio to a server that saves it.