13 ms·

Adding a “duress” password with PAM Duress (2021)

252 points by marcodiego 5y ago

nunez 5y ago
Something like this would be great for online voting. If a voter is under duress (i.e. being watched while they vote, etc), they can enter a specific ballot unique to them that discards the ballot and allows them to re-vote in a safer environment.
- HideousKojima 5y ago
  Or just completely get rid of anything internet connected or electronic for voting and go back to pen and paper. Any claims that online voting can be secure should be kept far away an buried as though they were radioactive waste.
  - teddyh 5y ago
    “Wear gloves.” — https://xkcd.com/2030/ https://xkcd.com/2030/ Longer explanation: https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI and https://www.youtube.com/watch?v=LkH2r-sNjQs https://www.youtube.com/watch?v=LkH2r-sNjQs
  - sfifs 5y ago
    I find it hilarious that people think pen and paper voting is more secure. The introduction of electronic voting (plus security through out of state paramilitary forces) was a major factor in reducing electoral fraud in India, the world's largest democracy. https://en.m.wikipedia.org/wiki/Booth_capturing https://en.m.wikipedia.org/wiki/Booth_capturing
    - f1refly 5y ago
      Your link doesn't suggest that paper voting doesn't work, it suggests that india is a corrupt nation that couldn't manage to enforce its monopoly on violence during that time. You could in principle also just beat up everyone in the vicinity of the booth, steal their digital voting access and vote for them. You can't hack a container filled with pieces of paper.
    - HideousKojima 5y ago
      Pen and paper isn't "more secure." As a voting system it's "significantly harder to commit voter fraud against at scale" and "significantly harder to commit fraud against from halfway around the world" and "significantly harder to commit fraud against without one of your conspirators ratting you out." With electronic voting, changing one vote is as easy as changing a million.
deknos 5y ago
i wish the luks guys would also do this, but they denied the request back then.
bombcar 5y ago
As mentioned in the article itself these cutesy things are inadequate for their intended use case. Could still be made useful in some cases perhaps as part of a larger “defense in depth” scenario, but if you’re actually afraid of rubber hose cryptography you should utilize methods that directly work against that (which may result in your death).
- marcodiego 5y ago
  Hmmm... Can't pam_duress be used to fix https://xkcd.com/538/ https://xkcd.com/538/ ?
  - mholt 5y ago
    No, because if the adversary is convinced you used a duress password, they'll just keep hitting you with a hammer.
    - deleted 5y ago
      [deleted]
    - emptyparadise 5y ago
      That won't help them if the duress password is used to erase secrets in a way that would prevent even you from unlocking the drive again.
      - 41b696ef1113 5y ago
        Step one for any kind of serious data extraction project would be to make a bit-for-bit duplicate of the origin.
        emptyparadise 5y ago
        Thankfully a lot of data extraction projects serious enough to beat somebody with a hammer are not serious enough to tamper with TPM.
      - 5y ago
Brian_K_White 5y ago
I think I first encountered the idea of essentially using passwords as commands for a variety of custom actions in a Larry Niven book from the 60s? Earlier? It must be as old as passwords, meaning as old as language, relatively straightforward to implement in any kind of software, yet I've never seen it actually implemented in all this time. Closest has been the single triggered action to wipe everything after n failures.
- djur 5y ago
  It's been implemented in video games, at least! The "NARPAS SWORD" password in Metroid comes to mind. The practical issue here is that a secret password to release the hounds or whatever is only useful if someone is able to use it at the appropriate time. It's hard to memorize a password you don't use. The number of cases where a "release the hounds" password is going to be usable and useful where a "log into admin account which has a 'release the hounds' button" wouldn't be is going to be very low.
  - giantg2 5y ago
    The fact that you remember the one from a videogame, makes it seem like that would be a good candidate password for this purpose. If it's used to wipe the data (which is backed up), then it shouldn't need to be as secure as a regular password. In fact, it might be preferable to be less secure so that someone trying to brute force would hit the duress password first.
    - djur 5y ago
      If we're talking about the specific case of duress passwords, sure. Although in that case the better defense against brute forcing is to wipe the data after too many failures. And at some point you might as well just put a "self destruct" button on there and skip the need for a password.
      - Brian_K_White 5y ago
        Wiping is the simplest and dumbest use of the ability to use passwords, or indeed the whole name + password pair, as essentially a command prompt. Have some imagination.
jrm4 5y ago
This just reminds me of all the very cool and clever things we could be doing, but arent. I imagine a world in which your phone is actually a general purpose computer, that can be meaningfully backed up by you, solely under your control. So when you're travelling somewhere heavy, you backup your whole phone to a trusted server (I hate even saying 'cloud' here) and wipe it (or better yet, "duressify" it, e.g. you put in grandma's number and a little porn and thats it) and be on your merry way. Restore your backup at your destination.
- nullwarp 5y ago
  A security company I contracted for has a policy when people are traveling to certain countries that they can't bring a company laptop or phone with them. They have to purchase a laptop while in the country to use and log onto the systems from there.
  - ohyoutravel 5y ago
    I’m curious because this seems worse in many ways than purchasing in your home country and carrying across. I understand you go through the airport with a fresh laptop and that gives the opportunity for the airport security agents to mess with it, but in all recent travels when I’ve done this the only time I haven’t seen the laptop directly is when it’s in the X-ray machine for 30 secs. Seems like purchasing in visiting country would be less secure. Can you elaborate?
    - londons_explore 5y ago
      I assume the "and log in from there" consists of a very limited login that only allows access to videocalls and a few other basics to allow work to get done... Not the whole document repository of the whole company.
    - Nextgrid 5y ago
      Purchasing within the country is more secure unless you assume all devices sold within the country are compromised and monitored in real-time which seems unfeasible. Of course for this to be effective you should just purchase it in-person in a mall or something, and ideally don't provide any identifying information so they can't "customize" the device just for you, otherwise all bets are off and at that point it indeed becomes more secure to just bring your own and not let it out of your sight.
deleted 5y ago
[deleted]
melony 5y ago
How practical is this against an adversary with hardware access? If they can put a vampire tap on the motherboard or CPU pins, won't the alternate code paths pursued by the CPU alert them? Most computers have standardized bootloaders. This would only work if the decryption key selection computation is encrypted and homomorphic.
- Nextgrid 5y ago
  > If they can put a vampire tap on the motherboard or CPU pins, won't the alternate code paths pursued by the CPU alert them? I doubt this is possible in modern hardware given the bandwidth & switching speeds they operate at.
  - jrockway 5y ago
    Probably possible. You're not going to connect up like 32 eBay oscilloscope probes to someone's computer and get their data, but you could build a custom RAM module that saves interesting data. Obviously there are computing devices that operate at the speed of modern day CPUs and memory -- modern day CPUs and memory! I think that these aren't widely available because if you want someone's data you can email them and say "hey I'm the CEO and I need your password right now, I'm locked out of my account!" Much easier than engineering a 4GHz logic analyzer into a DDR4 form factor.
- NavinF 5y ago
  That threat model is so insane that I’ll just link this instead of responding to the question: https://scholar.harvard.edu/files/mickens/files/thisworldofours.pdf https://scholar.harvard.edu/files/mickens/files/thisworldofo...
- kingcharles 5y ago
  In my case, after putting a loaded gun to my head I still wouldn't give the police my access codes, but after they changed strategy and threatened my wife I broke immediately. The interrogator told the judge that if he suppressed the codes they would simply move to desoldering the chips off the board and move them to another device. The judge accepted that, despite objections. (and the fact that only works if the data is not encrypted on the chips you are transplanting)
farhaven 5y ago
I have a feeling that "Is pam_duress.so configured in any file in /etc/pam.d, and if so turn on a big red light" is a pretty trivial thing to add to those "plug the person's computer in here and have them log in to their machine to decrypt everything, otherwise they won't go through customs/leave our dingy bunker" solutions. These duress passwords seem to be for kind of contrived scenarios, to me. Either your threat model is "someone breaks into my hotel room and steals my laptop", in which case it's useless, or "The $OpposingSideSecretService got me and hits me until I give them my password" in which case it seems to be equally useless.
- nyolfen 5y ago
  > You could even spawn a process to remove the pam_duress module so the threat actor won't be able to see if the duress module was available.
  - ptd 5y ago
    I think this falls squarely into daydreaming about how to stop a home invasion territory.
    - nyolfen 5y ago
      that's pretty fun too
    - jethro_tell 5y ago
      Lol, the ven diagram of people who can move your computer while the os is running and and people who can figure out of you also have a duress password is basically a circle. No home theif is going to take the time to move your machine while it's running so having all the drives locked should be good. If you're using pam, some section of the drive is unlocked. The question is does it matter if they know you have a duress module running? You're not really obligated to give your password in the US. (Not a lawyer but that's how I understand it) And in situations where they know are they going to beat you after youve erased your data? If you're worried about a machine being moved while on, you're probably best to check a canary that tells it about it's environment. ARP for a specific MAC, or DNS entry that only resolves on your LAN, SSID scan, maybe just lock all drives if the LAN interface flaps. I suppose this would be good for airport travel and more mobile situations.
clement12 5y ago
lillesvin 5y ago
This kind of reminds me of the Travel Mode of 1Password: https://support.1password.com/travel-mode/ https://support.1password.com/travel-mode/ and I imagine it'd be most useful in similar situations. Obviously the usefulness of measures like this is likely pretty low if your dealing with tech-savvy adversaries, but if some random border guard or police officer forces you to log into your computer and — I don't know, I'm not very well-versed in these scenarios — show your Facebook messages or your password vault, you could use your duress password to clear cookies and other stuff to show that you don't have a Facebook account or a password manager ... or whatever, you get the general idea. Or you could use it to not change anything but simply log in and additionally alert your work place that you're under duress and they can cut off your access to critical systems. Provided that you have some sort of internet access of course...
- movedx 5y ago
  I married into an American family recently. We plan on doing a road trip through America to visit said family. I will not be taking my phone or my laptop. I will just buy something cheap over there and then donate it to charity before I leave.
mdavis6890 5y ago
The fundamental problem is that often the people who are trying to get your data are legally entitled to it, and to use physical force against you to get it. And god help you if there is any appearance that you might have deleted the data they want. Plausible deniability may help, but only if you really can convince them that you do not have and cannot somehow access the data they want.
kats 5y ago
What could be more "Hacker News" than a bunch of people thinking they need a secret password in case they are held "under duress"? Because obviously you are James Bond and to avoid being sawed in half by the villian's laser beam you will give away this secret password at the last moment. Nothing could be worse than if Dr. Evil steals your hard drive, oh god, not that!
- dhzhzjsbevs 5y ago
  Or maybe you just don't like the idea of the government rifling through your shit. Recent example: https://www.reddit.com/r/australia/comments/s1pvs3/customs_confiscated_and_scanned_our_mobile_phones/ https://www.reddit.com/r/australia/comments/s1pvs3/customs_c... After reading this I'll never travel with out a pre trip factory wipe and throw away accounts for the trip. To be clear, there isn't anything to hide but I don't trust this government one bit and the cost of them scanning my password vault is way too high - it would take weeks to reset and clear old passwords.
- jart 5y ago
  Well pretty much everyone who works for a corporation has a responsibility to protect confidential information. However it's not really all that James Bond because the problem of international travel is normally solved by having code among other things not stored on laptops.
  - PeterisP 5y ago
    The responsibility to protect corporate information does not generally include any resistance to duress, almost every company has to simply accept that the health or life or imprisonment of the responsible employee is more valuable (really, on a whole different scale) than the protection of that information, and they have to instruct their employees to comply with any duress - just as bank tellers are instructed to just hand over cash when threatened, or as happened when duress was applied to employee family members in the https://en.wikipedia.org/wiki/2009_Bank_of_Ireland_robbery https://en.wikipedia.org/wiki/2009_Bank_of_Ireland_robbery - if you're not working in the military or intelligence services where literally lives are at stake, it's exceedingly likely that your threat model should simply not include trying to resist duress, and if you do, you're immorally putting your employees at risk to protect something that's relatively not that important like corporate profits.
throw7 5y ago
If you are genuinely in a position where you fear for your life... might I interest you into carrying around a false tooth filled with poison gas.
- throwawaylinux 5y ago
  What would step 2 be?
  - black-tusk 5y ago
  - movedx 5y ago
    Kill the duke.
DarkmSparks 5y ago
This is a great idea, but, one probably most people will wish they had set up after they need it.
PeterWhittaker 5y ago
Original discussion, actually quoted in TFA: https://news.ycombinator.com/item?id=28267975 https://news.ycombinator.com/item?id=28267975
trutannus 5y ago
> but in the background runs scripts to clean up sensitive data, close connections to other networks to limit lateral movement Oh boy. Don't do this. No matter how much trouble you're in, erasing the proof will make it worse. If you're innocent too, then you're really in a bad situation.
- tsujp 5y ago
  Could you elaborate? This sounds like an “if you’re innocent you have nothing to hide” argument which I categorically disagree with.
  - TameAntelope 5y ago
    More like, “Deleting data can be used against you.”
    - tsujp 5y ago
      Gotcha, so nothing to do with the actual data (you didn't specify which kind just "data") but the mere act. So it's a problem with the legislation as we already knew. Invasive and surveillance-based legislation.
      - TameAntelope 5y ago
        What? No; if you delete data, there’s no way to know what was on it, so if you’re reasonably suspected of committing a crime, there’s no way to know if you also hid the evidence of that crime.
  - trutannus 5y ago
    Even blowing away relevant data like file structures, cookies that would prove your innocence would typically be considered spoliation or destruction of evidence. Even if the evidence is "Joe is innocent". So you could end up creating a felony out of a situation where you would have ended with nothing. If you did nothing, don't touch anything. If you wipe your already clean device, you've now engaged in real criminality, and will end up creating charged out of thin air for yourself.
eyelidlessness 5y ago
Before and now after reading the article, I was immediately struck by the title that it’s astonishing this isn’t a more widely used concept. An “I’m complying” Dead Man’s Switch is a generally good idea for a lot of people for a lot of reasons. Maybe not just at a point of authentication but that’s a reasonably good place to start.
- mike_d 5y ago
  There is a legal concept called adverse inference. It is based on the premise that you wouldn't destroy evidence that would be beneficial to you. In addition to any punishment the court may decide, they introduce the spirt of the destroyed evidence and treat is as materially detrimental to your side.
  - eyelidlessness 5y ago
    There are many actors one might comply with who aren’t law enforcement and to whom you may prefer granting access to garbage rather than the thing they’re seeking. I think the vast majority of people with debit cards would be comforted with the idea of being able to give a thief a PIN which doesn’t empty their bank account… even if they never get around to setting one up. No one would think people who do are up to something nefarious. The same goes for protecting oneself from abusers in one’s home. The set of reasons one might want this are so commonplace that the most widely used devices are set up to lock or wipe on failed login attempts either by default or by easy configuration.
FounderBurr 5y ago
Useful for amateur duress maybe? Any professional organization will be examining your data in a forensic environment that doesn’t allow data self destruction. Deniable encryption is the better solution here.
bolster 5y ago
I've always been on the fence with technical solutions to the 'Pipe wrench' problem but one thing that I don't see mentioned that often is that there are usually many secondary keyrings unlocked by the login password (ssh auth, saved passwords, session cookies maybe, etc); I could see a solid usecase for a duress script that clears all these and requires 'standard' reauth, so that at least you're back to a 'defence in depth' style. Also, in the 'Pushover' example, I can't imagine many attackers waiting to plug the thing in before starting the ~pipe wrench~ credentials discussion.

252 points by marcodiego 5y ago

Something like this would be great for online voting. If a voter is under duress (i.e. being watched while they vote, etc), they can enter a specific ballot unique to them that discards the ballot and allows them to re-vote in a safer environment.

HideousKojima 5y ago
Or just completely get rid of anything internet connected or electronic for voting and go back to pen and paper. Any claims that online voting can be secure should be kept far away an buried as though they were radioactive waste.
- teddyh 5y ago
  “Wear gloves.” — https://xkcd.com/2030/ https://xkcd.com/2030/ Longer explanation: https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI and https://www.youtube.com/watch?v=LkH2r-sNjQs https://www.youtube.com/watch?v=LkH2r-sNjQs
- sfifs 5y ago
  I find it hilarious that people think pen and paper voting is more secure. The introduction of electronic voting (plus security through out of state paramilitary forces) was a major factor in reducing electoral fraud in India, the world's largest democracy. https://en.m.wikipedia.org/wiki/Booth_capturing https://en.m.wikipedia.org/wiki/Booth_capturing
  - f1refly 5y ago
    Your link doesn't suggest that paper voting doesn't work, it suggests that india is a corrupt nation that couldn't manage to enforce its monopoly on violence during that time. You could in principle also just beat up everyone in the vicinity of the booth, steal their digital voting access and vote for them. You can't hack a container filled with pieces of paper.
  - HideousKojima 5y ago
    Pen and paper isn't "more secure." As a voting system it's "significantly harder to commit voter fraud against at scale" and "significantly harder to commit fraud against from halfway around the world" and "significantly harder to commit fraud against without one of your conspirators ratting you out." With electronic voting, changing one vote is as easy as changing a million.

deknos 5y ago

i wish the luks guys would also do this, but they denied the request back then.

bombcar 5y ago

As mentioned in the article itself these cutesy things are inadequate for their intended use case. Could still be made useful in some cases perhaps as part of a larger “defense in depth” scenario, but if you’re actually afraid of rubber hose cryptography you should utilize methods that directly work against that (which may result in your death).

marcodiego 5y ago
Hmmm... Can't pam_duress be used to fix https://xkcd.com/538/ https://xkcd.com/538/ ?
- mholt 5y ago
  No, because if the adversary is convinced you used a duress password, they'll just keep hitting you with a hammer.
  - deleted 5y ago
    [deleted]
  - emptyparadise 5y ago
    That won't help them if the duress password is used to erase secrets in a way that would prevent even you from unlocking the drive again.
    - 41b696ef1113 5y ago
      Step one for any kind of serious data extraction project would be to make a bit-for-bit duplicate of the origin.
      - emptyparadise 5y ago
        Thankfully a lot of data extraction projects serious enough to beat somebody with a hammer are not serious enough to tamper with TPM.
    - 5y ago

Brian_K_White 5y ago

I think I first encountered the idea of essentially using passwords as commands for a variety of custom actions in a Larry Niven book from the 60s? Earlier? It must be as old as passwords, meaning as old as language, relatively straightforward to implement in any kind of software, yet I've never seen it actually implemented in all this time. Closest has been the single triggered action to wipe everything after n failures.

djur 5y ago
It's been implemented in video games, at least! The "NARPAS SWORD" password in Metroid comes to mind. The practical issue here is that a secret password to release the hounds or whatever is only useful if someone is able to use it at the appropriate time. It's hard to memorize a password you don't use. The number of cases where a "release the hounds" password is going to be usable and useful where a "log into admin account which has a 'release the hounds' button" wouldn't be is going to be very low.
- giantg2 5y ago
  The fact that you remember the one from a videogame, makes it seem like that would be a good candidate password for this purpose. If it's used to wipe the data (which is backed up), then it shouldn't need to be as secure as a regular password. In fact, it might be preferable to be less secure so that someone trying to brute force would hit the duress password first.
  - djur 5y ago
    If we're talking about the specific case of duress passwords, sure. Although in that case the better defense against brute forcing is to wipe the data after too many failures. And at some point you might as well just put a "self destruct" button on there and skip the need for a password.
    - Brian_K_White 5y ago
      Wiping is the simplest and dumbest use of the ability to use passwords, or indeed the whole name + password pair, as essentially a command prompt. Have some imagination.

jrm4 5y ago

This just reminds me of all the very cool and clever things we could be doing, but arent. I imagine a world in which your phone is actually a general purpose computer, that can be meaningfully backed up by you, solely under your control. So when you're travelling somewhere heavy, you backup your whole phone to a trusted server (I hate even saying 'cloud' here) and wipe it (or better yet, "duressify" it, e.g. you put in grandma's number and a little porn and thats it) and be on your merry way. Restore your backup at your destination.

nullwarp 5y ago
A security company I contracted for has a policy when people are traveling to certain countries that they can't bring a company laptop or phone with them. They have to purchase a laptop while in the country to use and log onto the systems from there.
- ohyoutravel 5y ago
  I’m curious because this seems worse in many ways than purchasing in your home country and carrying across. I understand you go through the airport with a fresh laptop and that gives the opportunity for the airport security agents to mess with it, but in all recent travels when I’ve done this the only time I haven’t seen the laptop directly is when it’s in the X-ray machine for 30 secs. Seems like purchasing in visiting country would be less secure. Can you elaborate?
  - londons_explore 5y ago
    I assume the "and log in from there" consists of a very limited login that only allows access to videocalls and a few other basics to allow work to get done... Not the whole document repository of the whole company.
  - Nextgrid 5y ago
    Purchasing within the country is more secure unless you assume all devices sold within the country are compromised and monitored in real-time which seems unfeasible. Of course for this to be effective you should just purchase it in-person in a mall or something, and ideally don't provide any identifying information so they can't "customize" the device just for you, otherwise all bets are off and at that point it indeed becomes more secure to just bring your own and not let it out of your sight.

deleted 5y ago

[deleted]

melony 5y ago

How practical is this against an adversary with hardware access? If they can put a vampire tap on the motherboard or CPU pins, won't the alternate code paths pursued by the CPU alert them? Most computers have standardized bootloaders. This would only work if the decryption key selection computation is encrypted and homomorphic.

Nextgrid 5y ago
> If they can put a vampire tap on the motherboard or CPU pins, won't the alternate code paths pursued by the CPU alert them? I doubt this is possible in modern hardware given the bandwidth & switching speeds they operate at.
- jrockway 5y ago
  Probably possible. You're not going to connect up like 32 eBay oscilloscope probes to someone's computer and get their data, but you could build a custom RAM module that saves interesting data. Obviously there are computing devices that operate at the speed of modern day CPUs and memory -- modern day CPUs and memory! I think that these aren't widely available because if you want someone's data you can email them and say "hey I'm the CEO and I need your password right now, I'm locked out of my account!" Much easier than engineering a 4GHz logic analyzer into a DDR4 form factor.
NavinF 5y ago
That threat model is so insane that I’ll just link this instead of responding to the question: https://scholar.harvard.edu/files/mickens/files/thisworldofours.pdf https://scholar.harvard.edu/files/mickens/files/thisworldofo...
kingcharles 5y ago
In my case, after putting a loaded gun to my head I still wouldn't give the police my access codes, but after they changed strategy and threatened my wife I broke immediately. The interrogator told the judge that if he suppressed the codes they would simply move to desoldering the chips off the board and move them to another device. The judge accepted that, despite objections. (and the fact that only works if the data is not encrypted on the chips you are transplanting)

farhaven 5y ago

I have a feeling that "Is pam_duress.so configured in any file in /etc/pam.d, and if so turn on a big red light" is a pretty trivial thing to add to those "plug the person's computer in here and have them log in to their machine to decrypt everything, otherwise they won't go through customs/leave our dingy bunker" solutions. These duress passwords seem to be for kind of contrived scenarios, to me. Either your threat model is "someone breaks into my hotel room and steals my laptop", in which case it's useless, or "The $OpposingSideSecretService got me and hits me until I give them my password" in which case it seems to be equally useless.

nyolfen 5y ago
> You could even spawn a process to remove the pam_duress module so the threat actor won't be able to see if the duress module was available.
- ptd 5y ago
  I think this falls squarely into daydreaming about how to stop a home invasion territory.
  - nyolfen 5y ago
    that's pretty fun too
  - jethro_tell 5y ago
    Lol, the ven diagram of people who can move your computer while the os is running and and people who can figure out of you also have a duress password is basically a circle. No home theif is going to take the time to move your machine while it's running so having all the drives locked should be good. If you're using pam, some section of the drive is unlocked. The question is does it matter if they know you have a duress module running? You're not really obligated to give your password in the US. (Not a lawyer but that's how I understand it) And in situations where they know are they going to beat you after youve erased your data? If you're worried about a machine being moved while on, you're probably best to check a canary that tells it about it's environment. ARP for a specific MAC, or DNS entry that only resolves on your LAN, SSID scan, maybe just lock all drives if the LAN interface flaps. I suppose this would be good for airport travel and more mobile situations.

clement12 5y ago

lillesvin 5y ago

This kind of reminds me of the Travel Mode of 1Password: https://support.1password.com/travel-mode/ https://support.1password.com/travel-mode/ and I imagine it'd be most useful in similar situations. Obviously the usefulness of measures like this is likely pretty low if your dealing with tech-savvy adversaries, but if some random border guard or police officer forces you to log into your computer and — I don't know, I'm not very well-versed in these scenarios — show your Facebook messages or your password vault, you could use your duress password to clear cookies and other stuff to show that you don't have a Facebook account or a password manager ... or whatever, you get the general idea. Or you could use it to not change anything but simply log in and additionally alert your work place that you're under duress and they can cut off your access to critical systems. Provided that you have some sort of internet access of course...

movedx 5y ago
I married into an American family recently. We plan on doing a road trip through America to visit said family. I will not be taking my phone or my laptop. I will just buy something cheap over there and then donate it to charity before I leave.

mdavis6890 5y ago

The fundamental problem is that often the people who are trying to get your data are legally entitled to it, and to use physical force against you to get it. And god help you if there is any appearance that you might have deleted the data they want. Plausible deniability may help, but only if you really can convince them that you do not have and cannot somehow access the data they want.

kats 5y ago

What could be more "Hacker News" than a bunch of people thinking they need a secret password in case they are held "under duress"? Because obviously you are James Bond and to avoid being sawed in half by the villian's laser beam you will give away this secret password at the last moment. Nothing could be worse than if Dr. Evil steals your hard drive, oh god, not that!

dhzhzjsbevs 5y ago
Or maybe you just don't like the idea of the government rifling through your shit. Recent example: https://www.reddit.com/r/australia/comments/s1pvs3/customs_confiscated_and_scanned_our_mobile_phones/ https://www.reddit.com/r/australia/comments/s1pvs3/customs_c... After reading this I'll never travel with out a pre trip factory wipe and throw away accounts for the trip. To be clear, there isn't anything to hide but I don't trust this government one bit and the cost of them scanning my password vault is way too high - it would take weeks to reset and clear old passwords.
jart 5y ago
Well pretty much everyone who works for a corporation has a responsibility to protect confidential information. However it's not really all that James Bond because the problem of international travel is normally solved by having code among other things not stored on laptops.
- PeterisP 5y ago
  The responsibility to protect corporate information does not generally include any resistance to duress, almost every company has to simply accept that the health or life or imprisonment of the responsible employee is more valuable (really, on a whole different scale) than the protection of that information, and they have to instruct their employees to comply with any duress - just as bank tellers are instructed to just hand over cash when threatened, or as happened when duress was applied to employee family members in the https://en.wikipedia.org/wiki/2009_Bank_of_Ireland_robbery https://en.wikipedia.org/wiki/2009_Bank_of_Ireland_robbery - if you're not working in the military or intelligence services where literally lives are at stake, it's exceedingly likely that your threat model should simply not include trying to resist duress, and if you do, you're immorally putting your employees at risk to protect something that's relatively not that important like corporate profits.

throw7 5y ago

If you are genuinely in a position where you fear for your life... might I interest you into carrying around a false tooth filled with poison gas.

throwawaylinux 5y ago
What would step 2 be?
- black-tusk 5y ago
- movedx 5y ago
  Kill the duke.

DarkmSparks 5y ago

This is a great idea, but, one probably most people will wish they had set up after they need it.

PeterWhittaker 5y ago

Original discussion, actually quoted in TFA: https://news.ycombinator.com/item?id=28267975 https://news.ycombinator.com/item?id=28267975

trutannus 5y ago

> but in the background runs scripts to clean up sensitive data, close connections to other networks to limit lateral movement Oh boy. Don't do this. No matter how much trouble you're in, erasing the proof will make it worse. If you're innocent too, then you're really in a bad situation.

tsujp 5y ago
Could you elaborate? This sounds like an “if you’re innocent you have nothing to hide” argument which I categorically disagree with.
- TameAntelope 5y ago
  More like, “Deleting data can be used against you.”
  - tsujp 5y ago
    Gotcha, so nothing to do with the actual data (you didn't specify which kind just "data") but the mere act. So it's a problem with the legislation as we already knew. Invasive and surveillance-based legislation.
    - TameAntelope 5y ago
      What? No; if you delete data, there’s no way to know what was on it, so if you’re reasonably suspected of committing a crime, there’s no way to know if you also hid the evidence of that crime.
- trutannus 5y ago
  Even blowing away relevant data like file structures, cookies that would prove your innocence would typically be considered spoliation or destruction of evidence. Even if the evidence is "Joe is innocent". So you could end up creating a felony out of a situation where you would have ended with nothing. If you did nothing, don't touch anything. If you wipe your already clean device, you've now engaged in real criminality, and will end up creating charged out of thin air for yourself.

eyelidlessness 5y ago

Before and now after reading the article, I was immediately struck by the title that it’s astonishing this isn’t a more widely used concept. An “I’m complying” Dead Man’s Switch is a generally good idea for a lot of people for a lot of reasons. Maybe not just at a point of authentication but that’s a reasonably good place to start.

mike_d 5y ago
There is a legal concept called adverse inference. It is based on the premise that you wouldn't destroy evidence that would be beneficial to you. In addition to any punishment the court may decide, they introduce the spirt of the destroyed evidence and treat is as materially detrimental to your side.
- eyelidlessness 5y ago
  There are many actors one might comply with who aren’t law enforcement and to whom you may prefer granting access to garbage rather than the thing they’re seeking. I think the vast majority of people with debit cards would be comforted with the idea of being able to give a thief a PIN which doesn’t empty their bank account… even if they never get around to setting one up. No one would think people who do are up to something nefarious. The same goes for protecting oneself from abusers in one’s home. The set of reasons one might want this are so commonplace that the most widely used devices are set up to lock or wipe on failed login attempts either by default or by easy configuration.

FounderBurr 5y ago

Useful for amateur duress maybe? Any professional organization will be examining your data in a forensic environment that doesn’t allow data self destruction. Deniable encryption is the better solution here.

bolster 5y ago

I've always been on the fence with technical solutions to the 'Pipe wrench' problem but one thing that I don't see mentioned that often is that there are usually many secondary keyrings unlocked by the login password (ssh auth, saved passwords, session cookies maybe, etc); I could see a solid usecase for a duress script that clears all these and requires 'standard' reauth, so that at least you're back to a 'defence in depth' style. Also, in the 'Pushover' example, I can't imagine many attackers waiting to plug the thing in before starting the ~pipe wrench~ credentials discussion.