This is highly unlikely, but; What is someone guesses your duress password and triggers your fail safe commands to delete everything?
PAM Duress – Alternate passwords for panic situations
291–300 of 358 posts
Re: PAM Duress – Alternate passwords for panic situations
#292Earlier quoted context omitted.
In the US they can’t do anything unless they have “probable cause” you committed a crime. That’s broad, but it excludes “this guy pushed the number 6 three times in a row.” And “imprison” and “arrest” are pretty darn close. In the US, when you are arrested, you are usually searched, fingerprinted, and a mugshot is taken. The mugshot can become a public record. There are websites that match mugshots to names, and make…
Probable cause isn't "pushed button multiple times" it is "silent alarm was triggered and this guy is on the only guy in the building". If US is doing stupid shit then US is doing stupid shit. What else can we expect a third world country to do? In civilized world you are processed yes, but since you are just arrested and not accused you will just be held until the pre-investigation has concluded
[deleted]
Re: PAM Duress – Alternate passwords for panic situations
#293Nice idea! I have this on my social site, people have two passwords, their regular one and an 'under duress' one that wipes their profile/locks it down.
I always wondered why more services don't offer it.
The reason we have it is it's a fairly political place (not by design, but when you offer 'free speech' you get everyone booted from every other place) and we've had a fair few members arrested, and I'd hate to think my site contributes to that so easy wipe.
Re: PAM Duress – Alternate passwords for panic situations
#294This is highly unlikely, but; What is someone guesses your duress password and triggers your fail safe commands to delete everything?
Then everything worked as intended. Your privacy is still safe.
Re: PAM Duress – Alternate passwords for panic situations
#295I hate when my bank calls me about something and then asks to confirm my identity prior to giving out details about my account. Even when I think I know what it is about (e.g., a transaction with my card was declined just before the phone call), I feel very strange giving out any information to an inbound caller. One thing I have thought about doing is providing mistaken information to the caller and see if they go a…
Most banks here (UK) have a mobile app, so I've always wondered why they don't use that to auth the call? Bank: Hey I'm calling from HSBC, want to verify it? Me: Sure Bank: Ok, so open you mobile app, and enter 637482 Me: Ok, cool thats given me 274893 Bank: Yep, that's all confirmed so ...
That would save you giving out personal details to authenticate yourself, but may lull people into dropping their guard & divulging personal details before the bank authenticates on _their side_ — as in, nothing in that script prevents a scammer saying "Yep, that's all confirmed" no matter what the person says & then a lay person may feel more secure even though they've proved nothing
Re: PAM Duress – Alternate passwords for panic situations
#296Training is very important in duress systems. I once worked in a place with a keypad duress code on the security system. If you prefixed your security PIN with NN-, it was the duress version of the code and would trigger a silent alarm. This was setup long-ago, and not communicated. One night, the keypad was acting glitchy. Partially out of frustration (countdown is running), and partially to test, I ended up acciden…
I had a similar false trigger trying to make an international call from our office phones. I didn’t know the exact incantation of the prefix, but knew it was 9 for an outside line and at home I used 011 then the country code. That didn’t seem to work, so I thought maybe I needed to drop the zero, resulting in me inadvertently dialing 911 and hanging up when that didn’t give me the dial tone I expected. I found the ri…
To dial out at my office, you have to dial 991. It’s only a matter of time before I either accidentally dial 911 at work or accidentally dial 991 in an actual emergency.
Re: PAM Duress – Alternate passwords for panic situations
#297Earlier quoted context omitted.
>imprison an innocent person. Kind a hard word to use for an arrest. In many places police can arrest you for some period if they suspect you have committed a crime. This is no different. No need for sensational language.
In the US they can’t do anything unless they have “probable cause” you committed a crime. That’s broad, but it excludes “this guy pushed the number 6 three times in a row.” And “imprison” and “arrest” are pretty darn close. In the US, when you are arrested, you are usually searched, fingerprinted, and a mugshot is taken. The mugshot can become a public record. There are websites that match mugshots to names, and make…
In the US, they cannot arrest you without probable cause. They can however detain you while they figure out what's going on.
Imprisoning is a much later step after being arrested. When you're arrested you may end up in a holding cell, or you may not.
Re: PAM Duress – Alternate passwords for panic situations
#298Earlier quoted context omitted.
I don't know the legal implications, but if the duress password unlocks your device and simply deletes a directory or two, and the officer only asked you to unlock your device (without a warrant, by the way), how is that lying?
Despite rumors to the contrary, the police aren’t stupid. They are trained to ask questions in ways that elicit a confession or falsehood. The simplest example is asking “Do you know why I pulled you over?”. Typically, people spontaneously confess to speeding, sometimes they break down and admit that someone is wrapped up in a rug in the trunk. The courts have consistently ruled that customs is different and you can…
Yeah but one other thing to consider is just how technically advanced having a duress password is for the average joe. I think about it like this. Say you're a CBP border agent on the US/Canada border. You inspect peoples phones for images of contraband, etc upon entry. You probably inspect ~150-200 phones per day, now say among the sea of people that are coming through, one of the people's whose phone you searched was actually in "duress mode" and was hiding the real data on the phone. You can't tell me an officer is going to pick that out unless it's something really obvious.
I would go as so far as to say that most border agent's that search phones are probably not even aware that this is a thing that people do. Sure they might have gotten training in a classroom for it, but as far as real world experience goes, maybe 1 out of every 5000 people has a setup like this.
Re: PAM Duress – Alternate passwords for panic situations
#299Earlier quoted context omitted.
You have the freedom to do whatever you want with the script. It's trivial to `exec >/dev/null 2>/dev/null` first thing in a script if you want it to be silent.
Do you want to first find that out when you're under duress? Sensible defaults matter.
Are you seriously writing a script when the cops are at your door? No, you aren't. You always need to verify that your protective mechanisms work before actually relying on them.
Re: PAM Duress – Alternate passwords for panic situations
#300Earlier quoted context omitted.
Most banks here (UK) have a mobile app, so I've always wondered why they don't use that to auth the call? Bank: Hey I'm calling from HSBC, want to verify it? Me: Sure Bank: Ok, so open you mobile app, and enter 637482 Me: Ok, cool thats given me 274893 Bank: Yep, that's all confirmed so ...
That would save you giving out personal details to authenticate yourself, but may lull people into dropping their guard & divulging personal details before the bank authenticates on _their side_ — as in, nothing in that script prevents a scammer saying "Yep, that's all confirmed" no matter what the person says & then a lay person may feel more secure even though they've proved nothing
This is exactly why I’ve thought of giving a fake reply, since the only way for me to know that they’re who they say they are is to see if they can recognize both an invalid response and a valid one.