Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PAM Duress – Alternate passwords for panic situations

github.com

Post reply on HN
Print view View original

221–230 of 358 posts

Re: PAM Duress – Alternate passwords for panic situations

#221

Post by andrewshadura »

jtnag wrote: post #216
benelvin wrote: post #214

Earlier quoted context omitted.

I'd always assumed (UK) that 9 was a deliberate choice to make it easier to dial the emergency number, 999, because you can just mash 9 until something happens. I guess if it's the same number in all other countries who have a range of emergency numbers, then that might not be the reason.

My working theory is that in old times phones had rotary dial instead of key pad. Number 1 was the longest to dial, 9 was the shortest (as I remember from childhood days). Thus, fastest way to dial 3 digit code was to use numbers with as much as 9 as possible (997,998,999).

One was the shortest to dial since it's just one pulse, nine was the longest one. The purpose was to make it hard to dial 999 accidentally.

Re: PAM Duress – Alternate passwords for panic situations

#222

Post by lisper »

jtnag wrote: post #216
benelvin wrote: post #214

Earlier quoted context omitted.

I'd always assumed (UK) that 9 was a deliberate choice to make it easier to dial the emergency number, 999, because you can just mash 9 until something happens. I guess if it's the same number in all other countries who have a range of emergency numbers, then that might not be the reason.

My working theory is that in old times phones had rotary dial instead of key pad. Number 1 was the longest to dial, 9 was the shortest (as I remember from childhood days). Thus, fastest way to dial 3 digit code was to use numbers with as much as 9 as possible (997,998,999).

You have it backwards. 1 is the shortest to dial. Zero is longest. 9 is second longest.

Re: PAM Duress – Alternate passwords for panic situations

#223

Post by RKearney »

jtnag wrote: post #216
benelvin wrote: post #214

Earlier quoted context omitted.

I'd always assumed (UK) that 9 was a deliberate choice to make it easier to dial the emergency number, 999, because you can just mash 9 until something happens. I guess if it's the same number in all other countries who have a range of emergency numbers, then that might not be the reason.

My working theory is that in old times phones had rotary dial instead of key pad. Number 1 was the longest to dial, 9 was the shortest (as I remember from childhood days). Thus, fastest way to dial 3 digit code was to use numbers with as much as 9 as possible (997,998,999).

Was the arrangement of the numbers backwards from the US rotary phone? Because in the US 1 was the shortest. That’s why large cities like New York got 212 and Los Angeles got 213 which were the fastest to dial on a rotary phone.

Re: PAM Duress – Alternate passwords for panic situations

#224

Post by jtnag »

stephenr wrote: post #219
jtnag wrote: post #216

Earlier quoted context omitted.

My working theory is that in old times phones had rotary dial instead of key pad. Number 1 was the longest to dial, 9 was the shortest (as I remember from childhood days). Thus, fastest way to dial 3 digit code was to use numbers with as much as 9 as possible (997,998,999).

I grew up with a rotary phone. From memory, 1 was the shortest to dial, 9 the longest.

I stand corrected then!

Re: PAM Duress – Alternate passwords for panic situations

#225

Post by Ikatza »

gnicholas wrote: post #205
jjeaff wrote: post #135

Earlier quoted context omitted.

Yes. Courts have upheld that a manual search of your phone by customs is legal. But more invasive, forensic investigation of your devices has been found to be unconstitutional. I'm not sure exactly where or how the line is drawn between the two. https://www.americanbar.org/groups/business_law/publications...

Relatedly, make sure you trigger the password lock on your device before handing it over. They may be able to compel you to give your biometrics but not your password (the latter is considered compelled speech, and the courts have not fully litigated whether the former is treated the same).

Nova Launcher on Android (and maybe other launchers, I do not know) has a nifty little feature to activate password lock bypassing biometrics with a gesture. Which comes in handy everytime I go through the border.

Re: PAM Duress – Alternate passwords for panic situations

#226

Post by sleavey »

wowaname wrote: post #148
sleavey wrote: post #80

Earlier quoted context omitted.

Seems like this should be baked in to the module. There don't seem to be any circumstances where you would want stdout/stderr from duress.d scripts to appear.

You have the freedom to do whatever you want with the script. It's trivial to `exec >/dev/null 2>/dev/null` first thing in a script if you want it to be silent.

Do you want to first find that out when you're under duress? Sensible defaults matter.

Re: PAM Duress – Alternate passwords for panic situations

#227

Post by gnicholas »

nucleardog wrote: post #220
gnicholas wrote: post #204

I hate when my bank calls me about something and then asks to confirm my identity prior to giving out details about my account. Even when I think I know what it is about (e.g., a transaction with my card was declined just before the phone call), I feel very strange giving out any information to an inbound caller. One thing I have thought about doing is providing mistaken information to the caller and see if they go a…

> Does anyone else have any ideas for how to authenticate a BigCorp caller whose corporate policies do not allow them to provide any account information to the people they are calling? I mean, it's really their problem, isn't it? If you need something from them, call their customer line and ask. If they need something from you, then they'll figure it out. I had a financial institution call me one time and ask "Is thi…

I've tried having them give me a checksum of the last four digits of my card number. They refused.

Re: PAM Duress – Alternate passwords for panic situations

#228

Post by VMG »

sReinwald wrote: post #206
gnicholas wrote: post #204

I hate when my bank calls me about something and then asks to confirm my identity prior to giving out details about my account. Even when I think I know what it is about (e.g., a transaction with my card was declined just before the phone call), I feel very strange giving out any information to an inbound caller. One thing I have thought about doing is providing mistaken information to the caller and see if they go a…

Tell them you feel uneasy giving out details over the phone to an inbound caller, hang up and call their service line directly. The only way you can be sure you are talking to your bank is if you are calling them.

Can you really be sure though?

How hard is it really to redirect outgoing calls?

Re: PAM Duress – Alternate passwords for panic situations

#229

Post by GoblinSlayer »

solarengineer wrote: post #213
gnicholas wrote: post #208

Earlier quoted context omitted.

Yeah that works, but it's usually time-consuming to get to the specific department that actually called. I wish these companies could route your call to their fraud dept if their fraud dept had just called you, but sadly this doesn't seem to have caught on yet.

In Singapore, Banks send regular reminders that they will never ask us for our personal information over a phone call. It is slowly becoming "common knowledge" among the non-tech-savvy folk I meet in everyday life.

Then there's an antifraud scenario, when the bank still calls you and asks stuff, now you need precise classification what they can ask you and what you can tell them.
Post reply on HN