5 ms·

So I guess what you really want is a duress PIN that loads into a fake innocent profile.

Sammi 3mo ago
Or that just selectively wipes only stuff you have marked for deletion. That way the profile stays up to date and believable.
- ozim 3mo ago
  Problem is „are you sure you marked for deletion all the correct things” because you could have already deleted it before traveling or moved to other device you don’t travel with. Selection on border control might be arbitrary, they can hold you or send you back over a photo or something you wouldn’t think should be a problem. Ideally you would like to have all wiped just in case but then you really stand out…
  - eru 3mo ago
    That's why you do it the other way round: you mark things that you don't want deleted.
    - ozim 3mo ago
      That is not really making any difference if you can prepare beforehand and you can’t be sure which things can get you in trouble.
      - eru 3mo ago
        It does make a difference: you only mark enough to be kept to make your phone looks like it's in use, as opposed to obviously wiped. By default, new material will be deleted. So you don't have to prepare again and again. > you can’t be sure which things can get you in trouble. When in doubt, don't mark it as keep.
- b112 3mo ago
  Yes, this also has the advantage of speed perhaps. I can see, deleting specific apps (and their data) as thing #1, and thing #2 would be certain directories. Of course, the problem is, are icons going to be vanishing off the home screen, when the agent is looking at it? Or will the unlock -> screen coming on, be super slow? Of course the problem there is, many people have an app store installed, and app stores have histories. And logs. And "what you used to have installed" is so easily found under Google Play, for example. As someone else said in this thread, the law isn't code. It's not if-then statement based. It's also predicated upon intent in many cases. What actions did a person take, and why, when told to (for example) unlock their phone. The problem here is that if you are asked to unlock your phone, any action you take to thwart that request by "trickery" to get data deleted, could be construed as 'deleting evidence'. So while some methods might make it more difficult for the border agent to realise "something happened", if they're suspicious still, then you're still in hot water. In the eyes of the law, the court, and likely the jury, you've done a sneaky thing to thwart evidence collection. The only safe method is a full wipe prior to travel. In this manner, you're not deleting evidence when told to hand it over. It's an entirely different bar. They can be cruel about it, and take your phone for a few months, but you're not going to be in legal hot water. In as no one will see the phone is wiped until you are compelled to unlock it, there's no greater change of the phone being seized. You're already being investigated. Just be blunt, say "Whenever I travel, I just wipe it", and that's that. This is why it's a shame that GrapheneOS has no viable backup solution. Its build in method is unreliable, and doesn't work very well, and is gitchy, it's a very well known problem. And Android and ADB sometimes have issues with large backups of directories, and so you have to manage that with tar + stream and other business, but at least working around that is easy. But if you could backup individual apps and all their data, you could uninstall all your privacy laden stuff, cross the border, and reinstall in minutes. That's the true, legal way to travel safely. Especially if the app removal resulted in a 'shred' of the data files instead of delete. If anyone has ever struggled with large data backup/restore, here's the only real method I've found for copying large swaths of files from/to via adb: adb exec-out 'tar --dereference --create /storage/emulated/0/dir/ 2>/sdcard/backup-errors.txt' |dd of=/tmp/backup-$(date +%Y%m%d).tar && adb shell cat /sdcard/backup-errors.txt and to restore dd if=backup-20250309.tar | \ adb exec-in 'cd /storage/emulated/0/tempdir; tar xpvf - 2>/sdcard/restore-errors.txt' && \ adb shell cat /sdcard/restore-errors.txt Or something similar.
- jbstack 3mo ago
  That's a more risky strategy. What if you added new files since the last time you updated the deletion profile? It's also technically more challenging. You have to think about what might be in RAM, caches, backups, etc. The good thing about a total wipe is that it's very easy to implement, and it's hard for it to go wrong. You just encrypt the whole drive and, when you want to wipe it, erase the key.
  - eru 3mo ago
    Obviously, you'd go the other way round and marks things that you don't want deleted.
- unparagoned 3mo ago
  Deleted stuff can easily be recovered. I think the full clean will remove the encryption keys hence making it unrecoverable.
ifwinterco 3mo ago
Yes I thought this was the standard solution? People have been doing this since way back in the TrueCrypt days - IIRC you could configure it to run a whole fake version of Windows if you wanted without easily revealing your actual main volume. Most hardware crypto wallets also have a "duress wallet" feature where you keep a low balance for the same reason. Wiping is obviously extremely suspicious and asking for trouble
- jjbinx007 3mo ago
  "Wiping is obviously extremely suspicious and asking for trouble" It's sad this is the default view. It's his device, his data, his life on that phone. If he had wiped the phone before the interrogation it wouldn't be a problem. How long before? A second before? A week before? But wiping the data a minute later is suddenly asking for trouble.
  - schoen 3mo ago
    I don't know that there is case law on this but I imagine that "prior to the admissibility inspection" is likely to be treated differently from "during the admissibility inspection" or "during administrative detention or secondary inspection" (or "in response to a request or question by a border agent"!). Edit: a bigger picture question is the difference between things that may be legally punishable and things that may cause suspicion from CBP agents, which aren't the same thing at all.
  - ifwinterco 3mo ago
    I don't like it and I wish we had more privacy, but realistically there is no such "right". If you're going to be in a situation where you're in a room with some goons backed by the full power of the state, it is what it is. Maybe because I'm not American I don't have any hangups about seeing the US government this way, but my own government is no different - you can (and people have) get stopped at Heathrow, taken to a dimly lit backroom and given a going over for hours
  - deleted 3mo ago
    [deleted]
LouisSayers 3mo ago
Or travel with a diary containing a post-it note labelled "p4sswd"
Blue40 3mo ago
My solution to this on GrapheneOS is having the primary user as the dummy. I have some random apps, photos, a copy of my password manager and 2fa app on there. Enough to look valid if not boring. I do all my day to day on another profile that can easily be deleted, with my password and 2fa I can easily setup the apps I use again later.
- Cider9986 3mo ago
  If you give an adversary access to one profile they can see any others exist or traces of it if it's been deleted.
  - deleted 3mo ago
    [deleted]
Anonyneko 3mo ago
Not enough, e.g. when crossing the Russian border (even as a citizen) your phone can be connected via USB to a device that uses exploits and whatnot to download all of the data. Surely US border guard can do something similar. And using encryption will only make you more suspicious, and may be a reason to get jail time until the situation is "cleared up" one way or another (e.g. by getting even more jail time). Only a second phone works, if you can make it seem like a device you're actually using (though also not a silver bullet as e.g. a lot of messenger metadata is available to governments and border control can physically coerce you to log in to your real accounts)
Cider9986 3mo ago
They would like to but it's not possible to make a robust feature like that because of low-level architecture of SSDs. Implementing a detectable solution would give people a false sense of security. Also they can plant evidence if you unlock the phone. https://nitter.net/GrapheneOS/status/2081471477174456340#m https://nitter.net/GrapheneOS/status/2081471477174456340#m

Sammi 3mo ago

Or that just selectively wipes only stuff you have marked for deletion. That way the profile stays up to date and believable.

ozim 3mo ago
Problem is „are you sure you marked for deletion all the correct things” because you could have already deleted it before traveling or moved to other device you don’t travel with. Selection on border control might be arbitrary, they can hold you or send you back over a photo or something you wouldn’t think should be a problem. Ideally you would like to have all wiped just in case but then you really stand out…
- eru 3mo ago
  That's why you do it the other way round: you mark things that you don't want deleted.
  - ozim 3mo ago
    That is not really making any difference if you can prepare beforehand and you can’t be sure which things can get you in trouble.
    - eru 3mo ago
      It does make a difference: you only mark enough to be kept to make your phone looks like it's in use, as opposed to obviously wiped. By default, new material will be deleted. So you don't have to prepare again and again. > you can’t be sure which things can get you in trouble. When in doubt, don't mark it as keep.
b112 3mo ago
Yes, this also has the advantage of speed perhaps. I can see, deleting specific apps (and their data) as thing #1, and thing #2 would be certain directories. Of course, the problem is, are icons going to be vanishing off the home screen, when the agent is looking at it? Or will the unlock -> screen coming on, be super slow? Of course the problem there is, many people have an app store installed, and app stores have histories. And logs. And "what you used to have installed" is so easily found under Google Play, for example. As someone else said in this thread, the law isn't code. It's not if-then statement based. It's also predicated upon intent in many cases. What actions did a person take, and why, when told to (for example) unlock their phone. The problem here is that if you are asked to unlock your phone, any action you take to thwart that request by "trickery" to get data deleted, could be construed as 'deleting evidence'. So while some methods might make it more difficult for the border agent to realise "something happened", if they're suspicious still, then you're still in hot water. In the eyes of the law, the court, and likely the jury, you've done a sneaky thing to thwart evidence collection. The only safe method is a full wipe prior to travel. In this manner, you're not deleting evidence when told to hand it over. It's an entirely different bar. They can be cruel about it, and take your phone for a few months, but you're not going to be in legal hot water. In as no one will see the phone is wiped until you are compelled to unlock it, there's no greater change of the phone being seized. You're already being investigated. Just be blunt, say "Whenever I travel, I just wipe it", and that's that. This is why it's a shame that GrapheneOS has no viable backup solution. Its build in method is unreliable, and doesn't work very well, and is gitchy, it's a very well known problem. And Android and ADB sometimes have issues with large backups of directories, and so you have to manage that with tar + stream and other business, but at least working around that is easy. But if you could backup individual apps and all their data, you could uninstall all your privacy laden stuff, cross the border, and reinstall in minutes. That's the true, legal way to travel safely. Especially if the app removal resulted in a 'shred' of the data files instead of delete. If anyone has ever struggled with large data backup/restore, here's the only real method I've found for copying large swaths of files from/to via adb: adb exec-out 'tar --dereference --create /storage/emulated/0/dir/ 2>/sdcard/backup-errors.txt' |dd of=/tmp/backup-$(date +%Y%m%d).tar && adb shell cat /sdcard/backup-errors.txt and to restore dd if=backup-20250309.tar | \ adb exec-in 'cd /storage/emulated/0/tempdir; tar xpvf - 2>/sdcard/restore-errors.txt' && \ adb shell cat /sdcard/restore-errors.txt Or something similar.
jbstack 3mo ago
That's a more risky strategy. What if you added new files since the last time you updated the deletion profile? It's also technically more challenging. You have to think about what might be in RAM, caches, backups, etc. The good thing about a total wipe is that it's very easy to implement, and it's hard for it to go wrong. You just encrypt the whole drive and, when you want to wipe it, erase the key.
- eru 3mo ago
  Obviously, you'd go the other way round and marks things that you don't want deleted.
unparagoned 3mo ago
Deleted stuff can easily be recovered. I think the full clean will remove the encryption keys hence making it unrecoverable.

ifwinterco 3mo ago

Yes I thought this was the standard solution? People have been doing this since way back in the TrueCrypt days - IIRC you could configure it to run a whole fake version of Windows if you wanted without easily revealing your actual main volume. Most hardware crypto wallets also have a "duress wallet" feature where you keep a low balance for the same reason. Wiping is obviously extremely suspicious and asking for trouble

jjbinx007 3mo ago
"Wiping is obviously extremely suspicious and asking for trouble" It's sad this is the default view. It's his device, his data, his life on that phone. If he had wiped the phone before the interrogation it wouldn't be a problem. How long before? A second before? A week before? But wiping the data a minute later is suddenly asking for trouble.
- schoen 3mo ago
  I don't know that there is case law on this but I imagine that "prior to the admissibility inspection" is likely to be treated differently from "during the admissibility inspection" or "during administrative detention or secondary inspection" (or "in response to a request or question by a border agent"!). Edit: a bigger picture question is the difference between things that may be legally punishable and things that may cause suspicion from CBP agents, which aren't the same thing at all.
- ifwinterco 3mo ago
  I don't like it and I wish we had more privacy, but realistically there is no such "right". If you're going to be in a situation where you're in a room with some goons backed by the full power of the state, it is what it is. Maybe because I'm not American I don't have any hangups about seeing the US government this way, but my own government is no different - you can (and people have) get stopped at Heathrow, taken to a dimly lit backroom and given a going over for hours
- deleted 3mo ago
  [deleted]

LouisSayers 3mo ago

Or travel with a diary containing a post-it note labelled "p4sswd"

Blue40 3mo ago

My solution to this on GrapheneOS is having the primary user as the dummy. I have some random apps, photos, a copy of my password manager and 2fa app on there. Enough to look valid if not boring. I do all my day to day on another profile that can easily be deleted, with my password and 2fa I can easily setup the apps I use again later.

Cider9986 3mo ago
If you give an adversary access to one profile they can see any others exist or traces of it if it's been deleted.
- deleted 3mo ago
  [deleted]

Anonyneko 3mo ago

Not enough, e.g. when crossing the Russian border (even as a citizen) your phone can be connected via USB to a device that uses exploits and whatnot to download all of the data. Surely US border guard can do something similar. And using encryption will only make you more suspicious, and may be a reason to get jail time until the situation is "cleared up" one way or another (e.g. by getting even more jail time). Only a second phone works, if you can make it seem like a device you're actually using (though also not a silver bullet as e.g. a lot of messenger metadata is available to governments and border control can physically coerce you to log in to your real accounts)

Cider9986 3mo ago

They would like to but it's not possible to make a robust feature like that because of low-level architecture of SSDs. Implementing a detectable solution would give people a false sense of security. Also they can plant evidence if you unlock the phone. https://nitter.net/GrapheneOS/status/2081471477174456340#m https://nitter.net/GrapheneOS/status/2081471477174456340#m