The "guy with the gun" narrative comes up a lot, so this seems to counter that? I love the concept. It seems like something that would work well in a movie but fail miserably in real life.
PAM Duress – Alternate passwords for panic situations
31–40 of 358 posts
Re: PAM Duress – Alternate passwords for panic situations
#32I think it should be pretty trivial to have a hidden dualboot, let's say you have some plain boring Windows that takes 10% of you drive and 90% is unassigned. In reality that's encrypted LVM disk with bootloader on a flash drive that is easily tossed away if necessary. Or zapped in a microwave if you watched too much of Mr. Robot.
I think VeraCrypt already enables this. It's called Hidden OS or something like that.
https://veracrypt.eu/en/docs/hidden-operating-system/
Not sure if there's a linux alternative.
Re: PAM Duress – Alternate passwords for panic situations
#33What I never quite understand is how this can work in practice. When someone is under real duress, they do not always behave in a logical way and may be too stressed to remember certain details like a password that they never use...
Practise.
Re: PAM Duress – Alternate passwords for panic situations
#34Earlier quoted context omitted.
Using #3 could land you in jail indefinitely in the UK I believe: if they don’t believe you forgot the password, they can interpret that as a refusal to give them the password (or unlock the computer), and jail you for this… until you give them the password. Which you can’t, because there is no password at this point. So either you admit that you just wiped your computer with the panic password, or you can shut up an…
Depends on the crime, I guess. If you face execution for murder or treason because of the data on your hard drive, life in prison is an upgrade.
This is why I don’t keep evidence of committing murder/treason on my computer.
Re: PAM Duress – Alternate passwords for panic situations
#35The company that was pitching my employer retina scanners on data center doors 20 years ago had an idea like this. Left eye gets you in, right eye gets you in and alerts security.
As long as the sides are the employee's choice (i.e. the threat actor needs to not be able to know which eye is the duress one).
Re: PAM Duress – Alternate passwords for panic situations
#36Real password: woD3PRBgELFHH9nuABH]ksD Duress password: duress123
This is a joke, but the person under duress also has to sell that they are under duress. This isn't something you can really "train" the average person to do on command.
It reminds me a bit of Jon Lovitz Pathological Liars Anonymous bit. "Okay! Here's the password...ya that's the ticket."
Re: PAM Duress – Alternate passwords for panic situations
#37Earlier quoted context omitted.
Exactly. It would be great to have a secondary pin (or my middle finger fingerprint, for example) in my phone to enter in a dummy environment with a few games, some family pics and so.
It would need to be baked into the OS. With FaceID, I guess I could use eyes crossed, as a queue.
I do not understand why any security concerned person would use biometric identification for anything, ever.
Re: PAM Duress – Alternate passwords for panic situations
#38Earlier quoted context omitted.
So you're saying if I'm held at gunpoint or forced to surrender my password at the US airport that a password to clear my account of anything would be useless? Neither of them know anything about me. It reminds me of the Trezor hardware wallet that allows you to have multiple passwords into your account. If your forced to give access you can log into the version with little in it. Nobody knows that you have secondary…
If you're held under gunpoint, that script that wipes your entire hard drive will only make your day worse. AFAIK if you actually get detained and questioned at airports, your drive will already get imaged before any password is even tried. You may be able to get away with this on a mobile device where this feature isn't generally expected (because who uses Linux on a smartphone in the first place). I always wonder a…
It doesn't have to wipe your drive, just do reasonable things like kill your sensitive messenger accounts and clean up the history.
Re: PAM Duress – Alternate passwords for panic situations
#39There's always a big issue with systems like this: Any sophisticated attacker will have an image of the machine he's trying to get into at hand to stop exactly what this pam module is trying to achieve from happening. All this would do is make you appear in a worse light to the deciding judge when it comes to trial or get your other kneecap shattered in a not so civil situation.
So you're saying if I'm held at gunpoint or forced to surrender my password at the US airport that a password to clear my account of anything would be useless? Neither of them know anything about me. It reminds me of the Trezor hardware wallet that allows you to have multiple passwords into your account. If your forced to give access you can log into the version with little in it. Nobody knows that you have secondary…
Without knowing what your captor already knows about your device, deleting data they may expect to find is a pretty high risk gambit.
Re: PAM Duress – Alternate passwords for panic situations
#40Earlier quoted context omitted.
So you're saying if I'm held at gunpoint or forced to surrender my password at the US airport that a password to clear my account of anything would be useless? Neither of them know anything about me. It reminds me of the Trezor hardware wallet that allows you to have multiple passwords into your account. If your forced to give access you can log into the version with little in it. Nobody knows that you have secondary…
If you're held under gunpoint, that script that wipes your entire hard drive will only make your day worse. AFAIK if you actually get detained and questioned at airports, your drive will already get imaged before any password is even tried. You may be able to get away with this on a mobile device where this feature isn't generally expected (because who uses Linux on a smartphone in the first place). I always wonder a…
What does it matter if your drive is imaged if you are using full disk encryption?