7 ms·

I think this has been posted in response to this news story [1] to clarify that GrapheneOS has strong protection against data being extracted even without a dur

by rzk 3mo ago

I think this has been posted in response to this news story [1] to clarify that GrapheneOS has strong protection against data being extracted even without a duress PIN/password. On a related note, a recent article [2] also describes how GrapheneOS helped a journalist protect his work and his confidential sources citing the 18-hour auto-reboot feature that returns the device to Before First Unlock (BFU) mode, where keys cannot be extracted. [1] A US man is being prosecuted after allegedly using a GrapheneOS duress PIN to wipe his Pixel during a border search – https://www.theguardian.com/us-news/2026/jul/23/cop-city-protester-phone https://www.theguardian.com/us-news/2026/jul/23/cop-city-pro... [2] A Journalist had his mobile phone seized. Did using GrapheneOS protect his data? – https://www.computerweekly.com/feature/Journalist-Richard-Medhurst-had-his-mobile-phone-seized-Did-using-a-secure-phone-protect-his-data https://www.computerweekly.com/feature/Journalist-Richard-Me...

microtonal 3mo ago
citing the 18-hour auto-reboot feature that returns the device to Before First Unlock (BFU) mode, where keys cannot be extracted. Also worth mentioning that you can set auto-reboot to a shorter period (down to 10 minutes). So if you anticipate situations where your phone can be seized (border crossings, demonstrations), it's worth temporarily setting this to a short time period (or rebooting your phone yourself to get to BFU).
- msh 3mo ago
  I dont understand why people like a journalist working on things they dont want seized would carry this kind of data on their device at a situation like this (border crossing), I see it as more useful to remove that kind of data from the device first.
  - choo-t 3mo ago
    Because you may need the data in the data during/after your travel and lack clean way to access safely, securely and anonymously remotely.
    - kotaKat 3mo ago
      This is where we need "cloud phones as a service" / "selfhosting a cellphone at home with some kind of remote access system". Not even kidding here, it's time to bring out thin client computing to cellphones. Let the spicy stuff sit somewhere else. I could bootstrap a Tailscale or Netbird signin remotely, install the access client, and remote back into the 'normal phone'. Would be then funny to map that to lockscreen PINs - enter a PIN to unlock the device, be remoted into "phone A", enter another pin and be remoted into "phone B", enter another PIN and you're on the 'local device' session. (Or duress-PIN kill "phone A" if someone attempts to bruteforce PINs, etc, etc...)
      - mystifyingpoi 3mo ago
        > "selfhosting a cellphone at home with some kind of remote access system You can use TeamViewer for that. Or maybe scrcpy could be coerced into working in a similar way.
        prmoustache 3mo ago
        Good luck making it work again remotely after a long power outage.
        mystifyingpoi 3mo ago
        Not sure what do you mean? If that is a concern, there are solutions for this. Like UPSes and backup cellular connections.
        prmoustache 3mo ago
        That may not even be a power outage, a simple bug or anything that may hang or reset the smartphone and the scrcpy session can't be started again. Unless you have a trustable person who has keys to your home and is available to power on and make sure a kvm setup is on you can't self host and just assume that what is running at home will be up all the time when you are abroad compared to a managed datacenter with redundancy, remote access and personel available.
  - dugite-code 3mo ago
    Probably because everything seems to be an "app" these days. Even when it has no business being one.
    - inigyou 3mo ago
      Exactly. Everything must be switched to Service as a Software Substitute. It's for your own safety, you see.
    - deleted 3mo ago
      [deleted]
  - xnickb 3mo ago
    So delete messengers, email apps and other comms? Delete the contact book? Clear calendars? Where exactly should one stop?
    - daneel_w 3mo ago
      You're misinterpreting. They mean that there are additional options next to only keeping these things on your phone.
      - xnickb 3mo ago
        What am I misinterpreting? OP literally said they don't understand why a journalist would carry these data with them. As if the data is a file on your phone. Data can be a contact book on your phone, or a messenger with E2E encrypted messages. What would the alternative to that be? Sending pigeons?
        iamnothere 3mo ago
        Restoring from remote backup when you reach your destination, then wiping again before you cross borders. Or shipping the (encrypted) data separately and picking it up after safe arrival.
        inigyou 3mo ago
        The government can easily get your remote backup, of course. It's just that border control won't know you have one.
        iamnothere 3mo ago
        Not if it’s encrypted and self-hosted. Your doomerism is silly. “The government” is not all-powerful, or they wouldn’t need to pester people for PINs at the border.
        xnickb 3mo ago
  - like_any_other 3mo ago
    Remove and securely overwrite, otherwise the data can still be recovered from the disk image. We have not made privacy easy.
- podocarp 3mo ago
  What about using decoy profiles? Say before the border crossing you switch to another user. Does that expose keys or anything for other users?
  - 0-_-0 3mo ago
    You would need to hide the existence of the original profile while in the decoy profile for this to work, which GrapheneOS considers too complex to implement
    - Cider9986 3mo ago
      I mean, so does everyone. https://veracrypt.io/en/Wear-Leveling.html https://veracrypt.io/en/Wear-Leveling.html
    - inigyou 3mo ago
      The only really plausibly deniable way to do it is for every graphene phone to come pre-partitioned for this. E.g. 128GB main + 128GB duress, random selection of whether partition 0 or 1 is the duress partition. But that means giving up half your storage. You can't even make them different sizes because that gives away which one is duress. You could have more partitions with a static split like 32+32+32+32+32+32+32+32 but then you have to manage so many independent partitions it isn't practical.
      - kmeisthax 3mo ago
        Deniable encryption has gotten way more advanced than this, though - the state-of-the-art is to have a bunch of independently unlockable data stores along with a mechanism to add chaff data that doesn't decrypt with any key. That's how bunnie's Betrusted project works, and it's the same idea as PhonebookFS from yesterdecade. The main problem with any deniable encryption system is that while your adversary might not be able to prove if you gave them the decoy or real data, they can at least force you to wipe anything you fail to decrypt. In your partitioning scheme, that would mean wiping any partition that doesn't decrypt with the set of PINs you gave them. In the more advanced granular scheme that Betrusted devices use, that would mean border control unlocking all the basis keys you dared to give them, and then them running the storage reclaim tool that wipes all other keys. In either case, it would probably be easier (and less suspicious!) to pre-wipe your device and then redownload a backup after you pass through border control... assuming you can get access to an untampered Internet connection after the fact, AND assuming your backup is actually complete. Like, I'm pretty sure most apps exclude their login tokens from backup, because every time I do wind up restoring a backup, I have to log into everything again, which makes me wonder what the point of the backup even is?
Tanoc 3mo ago
In regards to your first link, the quote "'It’s concerning – and sends the message that [GrapheneOS] is criminal by default,' said Christophe Boutry, a cybersecurity and surveillance expert." really is leading language. It's stating that protection is criminal and that vulnerability is law-abiding.
- microtonal 3mo ago
  This is why it is important to continue iterating everywhere that device security is important for everyone. iPhone has nearly the same level of protection and we also do not see it as 'criminal by default'. Secondly, it is important to get as many people to use GrapheneOS as possible, including non-tech people. The more widespread it becomes, the harder it will become to paint this picture.
  - kungito 3mo ago
    sounds to me like iphone isnt actually that safe otherwise it wouldnt make sense. maybe we are missing some critical information
    - Cider9986 3mo ago
      GrapheneOS seems to be consistently the hardest to exploit AFU based on various Cellubrite leaks. iPhones have better protection than all other Androids except Pixels.
      - microtonal 3mo ago
        I might be wrong, but I get the impression that the GrapheneOS folks generally recommend GrapheneOS > iOS > Pixel >> everything else. It might have to do with e.g. Apple having rolled out MIE at a broader scale than Google rolling out MTE on PixelOS, where AFAIK it is still largely opt-in (not 100% sure, I always wipe a Pixel immediately).
        Cider9986 3mo ago
deleted 3mo ago
[deleted]
dredmorbius 3mo ago
The Guardian story discussed on HN: <https://news.ycombinator.com/item?id=49024436 https://news.ycombinator.com/item?id=49024436>. (The Computer Weekly item was submitted but saw no significant discussion.)
therealpygon 3mo ago
I’m still curious if they “weren’t inside the U.S.”, how they are being charged with a law that is only applicable to…the U.S.
- rationalist 3mo ago
  Some U.S. laws are extraterrestrial, such as murder, crimes against children, tax laws, etc.
  - hedora 3mo ago
    Also the US CLOUD act: If you do business in the US, you have to give American authorities access to warrantlessly search any device not in the US that you have access to. (I heard Europe and China passed the same laws. The EU has intelligence sharing agreements with the US, so I guess American authorities can just have the EU pull the data for US citizens in the US and forward it back home. I'm not a lawyer. It'd be nice if I'm wrong.)

by rzk 3mo ago

microtonal 3mo ago

citing the 18-hour auto-reboot feature that returns the device to Before First Unlock (BFU) mode, where keys cannot be extracted. Also worth mentioning that you can set auto-reboot to a shorter period (down to 10 minutes). So if you anticipate situations where your phone can be seized (border crossings, demonstrations), it's worth temporarily setting this to a short time period (or rebooting your phone yourself to get to BFU).

msh 3mo ago
I dont understand why people like a journalist working on things they dont want seized would carry this kind of data on their device at a situation like this (border crossing), I see it as more useful to remove that kind of data from the device first.
- choo-t 3mo ago
  Because you may need the data in the data during/after your travel and lack clean way to access safely, securely and anonymously remotely.
  - kotaKat 3mo ago
    This is where we need "cloud phones as a service" / "selfhosting a cellphone at home with some kind of remote access system". Not even kidding here, it's time to bring out thin client computing to cellphones. Let the spicy stuff sit somewhere else. I could bootstrap a Tailscale or Netbird signin remotely, install the access client, and remote back into the 'normal phone'. Would be then funny to map that to lockscreen PINs - enter a PIN to unlock the device, be remoted into "phone A", enter another pin and be remoted into "phone B", enter another PIN and you're on the 'local device' session. (Or duress-PIN kill "phone A" if someone attempts to bruteforce PINs, etc, etc...)
    - mystifyingpoi 3mo ago
      > "selfhosting a cellphone at home with some kind of remote access system You can use TeamViewer for that. Or maybe scrcpy could be coerced into working in a similar way.
      - prmoustache 3mo ago
        Good luck making it work again remotely after a long power outage.
        mystifyingpoi 3mo ago
        Not sure what do you mean? If that is a concern, there are solutions for this. Like UPSes and backup cellular connections.
        prmoustache 3mo ago
        That may not even be a power outage, a simple bug or anything that may hang or reset the smartphone and the scrcpy session can't be started again. Unless you have a trustable person who has keys to your home and is available to power on and make sure a kvm setup is on you can't self host and just assume that what is running at home will be up all the time when you are abroad compared to a managed datacenter with redundancy, remote access and personel available.
- dugite-code 3mo ago
  Probably because everything seems to be an "app" these days. Even when it has no business being one.
  - inigyou 3mo ago
    Exactly. Everything must be switched to Service as a Software Substitute. It's for your own safety, you see.
  - deleted 3mo ago
    [deleted]
- xnickb 3mo ago
  So delete messengers, email apps and other comms? Delete the contact book? Clear calendars? Where exactly should one stop?
  - daneel_w 3mo ago
    You're misinterpreting. They mean that there are additional options next to only keeping these things on your phone.
    - xnickb 3mo ago
      What am I misinterpreting? OP literally said they don't understand why a journalist would carry these data with them. As if the data is a file on your phone. Data can be a contact book on your phone, or a messenger with E2E encrypted messages. What would the alternative to that be? Sending pigeons?
      - iamnothere 3mo ago
        Restoring from remote backup when you reach your destination, then wiping again before you cross borders. Or shipping the (encrypted) data separately and picking it up after safe arrival.
        inigyou 3mo ago
        The government can easily get your remote backup, of course. It's just that border control won't know you have one.
        iamnothere 3mo ago
        Not if it’s encrypted and self-hosted. Your doomerism is silly. “The government” is not all-powerful, or they wouldn’t need to pester people for PINs at the border.
        xnickb 3mo ago
- like_any_other 3mo ago
  Remove and securely overwrite, otherwise the data can still be recovered from the disk image. We have not made privacy easy.
podocarp 3mo ago
What about using decoy profiles? Say before the border crossing you switch to another user. Does that expose keys or anything for other users?
- 0-_-0 3mo ago
  You would need to hide the existence of the original profile while in the decoy profile for this to work, which GrapheneOS considers too complex to implement
  - Cider9986 3mo ago
    I mean, so does everyone. https://veracrypt.io/en/Wear-Leveling.html https://veracrypt.io/en/Wear-Leveling.html
  - inigyou 3mo ago
    The only really plausibly deniable way to do it is for every graphene phone to come pre-partitioned for this. E.g. 128GB main + 128GB duress, random selection of whether partition 0 or 1 is the duress partition. But that means giving up half your storage. You can't even make them different sizes because that gives away which one is duress. You could have more partitions with a static split like 32+32+32+32+32+32+32+32 but then you have to manage so many independent partitions it isn't practical.
    - kmeisthax 3mo ago
      Deniable encryption has gotten way more advanced than this, though - the state-of-the-art is to have a bunch of independently unlockable data stores along with a mechanism to add chaff data that doesn't decrypt with any key. That's how bunnie's Betrusted project works, and it's the same idea as PhonebookFS from yesterdecade. The main problem with any deniable encryption system is that while your adversary might not be able to prove if you gave them the decoy or real data, they can at least force you to wipe anything you fail to decrypt. In your partitioning scheme, that would mean wiping any partition that doesn't decrypt with the set of PINs you gave them. In the more advanced granular scheme that Betrusted devices use, that would mean border control unlocking all the basis keys you dared to give them, and then them running the storage reclaim tool that wipes all other keys. In either case, it would probably be easier (and less suspicious!) to pre-wipe your device and then redownload a backup after you pass through border control... assuming you can get access to an untampered Internet connection after the fact, AND assuming your backup is actually complete. Like, I'm pretty sure most apps exclude their login tokens from backup, because every time I do wind up restoring a backup, I have to log into everything again, which makes me wonder what the point of the backup even is?

Tanoc 3mo ago

In regards to your first link, the quote "'It’s concerning – and sends the message that [GrapheneOS] is criminal by default,' said Christophe Boutry, a cybersecurity and surveillance expert." really is leading language. It's stating that protection is criminal and that vulnerability is law-abiding.

microtonal 3mo ago
This is why it is important to continue iterating everywhere that device security is important for everyone. iPhone has nearly the same level of protection and we also do not see it as 'criminal by default'. Secondly, it is important to get as many people to use GrapheneOS as possible, including non-tech people. The more widespread it becomes, the harder it will become to paint this picture.
- kungito 3mo ago
  sounds to me like iphone isnt actually that safe otherwise it wouldnt make sense. maybe we are missing some critical information
  - Cider9986 3mo ago
    GrapheneOS seems to be consistently the hardest to exploit AFU based on various Cellubrite leaks. iPhones have better protection than all other Androids except Pixels.
    - microtonal 3mo ago
      I might be wrong, but I get the impression that the GrapheneOS folks generally recommend GrapheneOS > iOS > Pixel >> everything else. It might have to do with e.g. Apple having rolled out MIE at a broader scale than Google rolling out MTE on PixelOS, where AFAIK it is still largely opt-in (not 100% sure, I always wipe a Pixel immediately).
      - Cider9986 3mo ago

deleted 3mo ago

[deleted]

dredmorbius 3mo ago

The Guardian story discussed on HN: <https://news.ycombinator.com/item?id=49024436 https://news.ycombinator.com/item?id=49024436>. (The Computer Weekly item was submitted but saw no significant discussion.)

therealpygon 3mo ago

I’m still curious if they “weren’t inside the U.S.”, how they are being charged with a law that is only applicable to…the U.S.

rationalist 3mo ago
Some U.S. laws are extraterrestrial, such as murder, crimes against children, tax laws, etc.
- hedora 3mo ago
  Also the US CLOUD act: If you do business in the US, you have to give American authorities access to warrantlessly search any device not in the US that you have access to. (I heard Europe and China passed the same laws. The EU has intelligence sharing agreements with the US, so I guess American authorities can just have the EU pull the data for US citizens in the US and forward it back home. I'm not a lawyer. It'd be nice if I'm wrong.)