5 ms·

I wish there was a kind of "dead man switch" app that would wipe a device if it is not unlocked for x days or met some other kind of personalized criteria.

alwillis 9y ago
You mean like automatically erasing the device after 10 incorrect passcode attempts? That option has been built in to the iPhone pretty much since the beginning.
- julianj 9y ago
  No. An example would be automatically erase if the device has not been unlocked in 3 days.
  - lostlogin 9y ago
    This would be inconvenient at times.
    - lb1lf 9y ago
      -To most users, probably. But if you are a high-ish profile target, the (potential) inconvenience is probably worth the effort for the added peace of mind. After all, when was the last time you spent three days without fondling your phone?
pdkl95 9y ago
An app would need an environment to run in, but the main CPU/etc may not be available if the recovery process involves removing chips or other hardware modifications. A better idea would be to put an RTC + watchdog timer[1] into the security chip that holds the keys and power it continuously with a small amount of external power. The power must be available and the watchdog timer must have time remaining to disconnect a circuit that pulls the memory holding the keys to ground. More advanced types of tamper resistance and self-destructing chips are possible, but they tend to have significant downsides. [1] https://en.wikipedia.org/wiki/Watchdog_timer https://en.wikipedia.org/wiki/Watchdog_timer
- julianj 9y ago
  Good points. Thank you for this reading material.
- Godel_unicode 9y ago
  Apple is being sued for making phones slightly slower, can you imagine the lawsuit if they were "deliberately lobotomizing" phones? You know that's how it would be said...
gruez 9y ago
I think that's how some HSMs work to guard against tampering. The keys are stored on volatile memory, and there's a internal battery/capacitor. You can unplug it, but its tamper intrusion mechanisms will still be active because of the internal battery. If you trip the tamper detection mechanisms, the keys get wiped. If the battery runs out, the key gets wiped. So if you're relocating the HSM, you have x days to replug it in before you lose your keys. I imagine if you're designing a high security phone, you could possibly want this as a feature, but I doubt most people want a phone that wipes their data if the battery went flat for 7 days.
- julianj 9y ago
  I agree, but based on some people's risk profile, the option would be nice.
rphlx 9y ago
Many years ago someone (possibly/probably Dan Kaminsky) suggested storing your gpg-encrypted+signed full device encryption key in the global DNS cache. If you don't do a lookup every X days, it'll expire from the cache and the drive will be unrecoverable assuming no other copies of the key exist.
- jsjohnst 9y ago
  > global DNS cache No such thing exists > If you don't do a lookup every X days, it'll expire from the cache Requerying a cached DNS record doesn’t extend its TTL. TTL is based on when it was first added to the cache.
  - mrweasel 9y ago
    You're not wrong, but it has been shown that you can store small amounts of data in open resolving dns servers. https://github.com/benjojo/dnsfs https://github.com/benjojo/dnsfs
    - jsjohnst 9y ago
      That's definitely true and I didn't dispute that part, I focused on the parts which were factually not correct.
      - rphlx 9y ago
        I'll be the first to admit that to a DNS expert my original phrasing was not fully precise or fully complete, but calling it "factually not correct" is unfair. As the GP hints the idea is that you cycle through a large number of open resolvers around the world, putting the key into, let's say, 10 of them each time for redundancy & availability. As you usually cannot extend the timeout on those servers, you simply move to a different set of 10 servers during each refresh.
        jsjohnst 9y ago
        > As you usually cannot extend the timeout on those servers, you simply move to a different set of 10 servers during each refresh. Think about that from a technical perspective and you’ll realize the flaw. :) You can’t cycle to a new set unless the authoritative server is still responding with the key. If the authoritative server still has it, what difference does the fact a caching name server has it? Furthermore, there’s zero guarantees a caching resolver will cache for the length of the specified TTL, so you literally have a land mine that’ll explode randomly and cause you to lose your data. > As the GP hints Read it again. GP’s Github link doesn’t allude to what you imply it does. Storing arbitrary data in DNS is of course possible and others will cache it for you, but implying anything like what you described as feasible just doesn’t hold merit. > but calling it "factually not correct" is unfair. This entire theory you posted originally doesn’t hold up to even basic technical review. It’s nothing against you personally, the idea simply doesn’t provide any actual benefit and very fairly is factually incorrect.
tonyztan 9y ago
This is not exactly what you are looking for, but G Suite MDM has an "Auto Account Wipe" feature that "Automatically removes corporate account data when a device reaches a specified number of days of inactivity." Presumably, this would automatically delete your G Suite email, contact, calendar, and other data from your device. https://support.google.com/a/answer/6328708?hl=en#general https://support.google.com/a/answer/6328708?hl=en#general
- jsjohnst 9y ago
  That’s not a feature implemented on device by Google, Apple built the feature explicitly to make this available to corporate customers. Same thing exists for Exchange.
  - tonyztan 9y ago
    Interesting. The feature is also available on Android.
    - jsjohnst 9y ago
      Same thing exists on Windows Phone, BlackBerry, WebOS, even all the way back to Symbian I think.
      - tonyztan 9y ago
        Okay, likely a standard Exchange feature then.
alwillis 9y ago
The dead man switch isn’t an option, but using the Apple Configurator (https://support.apple.com/apple-configurator https://support.apple.com/apple-configurator), there are lots of additional security features that can be enabled that aren’t accessible via the iPhone’s UI. EDIT Using Apple Configurator, you can change the number of times unsuccessful attempts can occur before erasing an iPhone to anything between 2-10.

alwillis 9y ago

You mean like automatically erasing the device after 10 incorrect passcode attempts? That option has been built in to the iPhone pretty much since the beginning.

julianj 9y ago
No. An example would be automatically erase if the device has not been unlocked in 3 days.
- lostlogin 9y ago
  This would be inconvenient at times.
  - lb1lf 9y ago
    -To most users, probably. But if you are a high-ish profile target, the (potential) inconvenience is probably worth the effort for the added peace of mind. After all, when was the last time you spent three days without fondling your phone?

pdkl95 9y ago

An app would need an environment to run in, but the main CPU/etc may not be available if the recovery process involves removing chips or other hardware modifications. A better idea would be to put an RTC + watchdog timer[1] into the security chip that holds the keys and power it continuously with a small amount of external power. The power must be available and the watchdog timer must have time remaining to disconnect a circuit that pulls the memory holding the keys to ground. More advanced types of tamper resistance and self-destructing chips are possible, but they tend to have significant downsides. [1] https://en.wikipedia.org/wiki/Watchdog_timer https://en.wikipedia.org/wiki/Watchdog_timer

julianj 9y ago
Good points. Thank you for this reading material.
Godel_unicode 9y ago
Apple is being sued for making phones slightly slower, can you imagine the lawsuit if they were "deliberately lobotomizing" phones? You know that's how it would be said...

gruez 9y ago

I think that's how some HSMs work to guard against tampering. The keys are stored on volatile memory, and there's a internal battery/capacitor. You can unplug it, but its tamper intrusion mechanisms will still be active because of the internal battery. If you trip the tamper detection mechanisms, the keys get wiped. If the battery runs out, the key gets wiped. So if you're relocating the HSM, you have x days to replug it in before you lose your keys. I imagine if you're designing a high security phone, you could possibly want this as a feature, but I doubt most people want a phone that wipes their data if the battery went flat for 7 days.

julianj 9y ago
I agree, but based on some people's risk profile, the option would be nice.

rphlx 9y ago

Many years ago someone (possibly/probably Dan Kaminsky) suggested storing your gpg-encrypted+signed full device encryption key in the global DNS cache. If you don't do a lookup every X days, it'll expire from the cache and the drive will be unrecoverable assuming no other copies of the key exist.

jsjohnst 9y ago
> global DNS cache No such thing exists > If you don't do a lookup every X days, it'll expire from the cache Requerying a cached DNS record doesn’t extend its TTL. TTL is based on when it was first added to the cache.
- mrweasel 9y ago
  You're not wrong, but it has been shown that you can store small amounts of data in open resolving dns servers. https://github.com/benjojo/dnsfs https://github.com/benjojo/dnsfs
  - jsjohnst 9y ago
    That's definitely true and I didn't dispute that part, I focused on the parts which were factually not correct.
    - rphlx 9y ago
      I'll be the first to admit that to a DNS expert my original phrasing was not fully precise or fully complete, but calling it "factually not correct" is unfair. As the GP hints the idea is that you cycle through a large number of open resolvers around the world, putting the key into, let's say, 10 of them each time for redundancy & availability. As you usually cannot extend the timeout on those servers, you simply move to a different set of 10 servers during each refresh.
      - jsjohnst 9y ago
        > As you usually cannot extend the timeout on those servers, you simply move to a different set of 10 servers during each refresh. Think about that from a technical perspective and you’ll realize the flaw. :) You can’t cycle to a new set unless the authoritative server is still responding with the key. If the authoritative server still has it, what difference does the fact a caching name server has it? Furthermore, there’s zero guarantees a caching resolver will cache for the length of the specified TTL, so you literally have a land mine that’ll explode randomly and cause you to lose your data. > As the GP hints Read it again. GP’s Github link doesn’t allude to what you imply it does. Storing arbitrary data in DNS is of course possible and others will cache it for you, but implying anything like what you described as feasible just doesn’t hold merit. > but calling it "factually not correct" is unfair. This entire theory you posted originally doesn’t hold up to even basic technical review. It’s nothing against you personally, the idea simply doesn’t provide any actual benefit and very fairly is factually incorrect.

tonyztan 9y ago

This is not exactly what you are looking for, but G Suite MDM has an "Auto Account Wipe" feature that "Automatically removes corporate account data when a device reaches a specified number of days of inactivity." Presumably, this would automatically delete your G Suite email, contact, calendar, and other data from your device. https://support.google.com/a/answer/6328708?hl=en#general https://support.google.com/a/answer/6328708?hl=en#general

jsjohnst 9y ago
That’s not a feature implemented on device by Google, Apple built the feature explicitly to make this available to corporate customers. Same thing exists for Exchange.
- tonyztan 9y ago
  Interesting. The feature is also available on Android.
  - jsjohnst 9y ago
    Same thing exists on Windows Phone, BlackBerry, WebOS, even all the way back to Symbian I think.
    - tonyztan 9y ago
      Okay, likely a standard Exchange feature then.

alwillis 9y ago

The dead man switch isn’t an option, but using the Apple Configurator (https://support.apple.com/apple-configurator https://support.apple.com/apple-configurator), there are lots of additional security features that can be enabled that aren’t accessible via the iPhone’s UI. EDIT Using Apple Configurator, you can change the number of times unsuccessful attempts can occur before erasing an iPhone to anything between 2-10.