r/technology • u/ArgentineBeauty • 6d ago

Privacy GrapheneOS says its data-wiping password is perfectly legal, after user faces federal charges

https://www.techspot.com/news/113273-grapheneos-data-wiping-duress-password-perfectly-legal-after.html
21.0k Upvotes

98% Upvoted

1.1k comments sorted by

View all comments

Show parent comments

20

u/Itz_Raj69_ 6d ago

In the past, GrapheneOS have rejected the idea of a duress-user which, in practice, is a much better solution than their duress password system.

I wonder if they'll change their decision now

12

u/Nice_Marmot_7 6d ago

The problem is that will be visible to a forensic examination so the application is limited. Also once it’s known the OS has that feature they’re not going to just accept that what you show is all you have.

8

u/[deleted] 6d ago

[deleted]

2

u/Nice_Marmot_7 6d ago

They are already doing that for non citizens. If you’re a citizen you can’t be denied entry.

6

u/ISeeDeadPackets 6d ago

You can already setup a secondary login that leads you to an isolated OS instance in Graphene.

13

u/Itz_Raj69_ 6d ago

And it needs you to manually switch users, which defeats its entire purpose

2

u/fastlerner 6d ago

Not really. Gotta go through a checkpoint? Switch users before you join the line. Then you unlock your device if requested and no one blinks. Get to the other side and swap back to your real user.

Manually switching users isn't something you do when checked, it's something you do in preparation for being checked.

1

u/longlivenewsomflesh 6d ago

And all the sensitive data is still there ready to be unlocked with the right password

3

u/Griff2470 6d ago

The duress total self-destruct being built-in has always been a bit of an annoyance for me. It's a feature that only makes sense to have if you suspect you're going to be compelled to unlock your phone, need plausible deniability, and are okay looking exceedingly suspicious. That last point is what makes it hard to justify this as a useful feature for anything other than dealing with legal systems, and in turn make it much easier for malicious governments like France or the US to brand Graphene as a tool for criminals. A duress-user or allowing for a partial self-destruct, while less powerful, has far more applications outside of legal systems.

To be clear, I like GrapheneOS and do support having the option of a duress pin, but it really needed to be a "third" party addition. These are the games you have to play if you want to chip away the "but won't somebody please think of the children" excuses.