223
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 08 Nov 2024
223 points (93.7% liked)
Technology
59298 readers
1825 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Android has an app that you can install that auto wipes a phone after X amount of time if the phone hasnt been unlocked:
https://f-droid.org/en/packages/me.lucky.wasted/
Also theres an app that allows you to set a fake password that wipes the phone:
https://f-droid.org/en/packages/me.lucky.duress/
All open source, I have tested these apps on my phones, they work great. The second app about the duress password is a bit glitchy and didnt work on some of my phones.
Disclaimer: I am not a lawyer and setting your phone to automatically wipe itself may be considered destruction of evidence in a court of law.
Thanks but I literally cannot figure out how to use these apps after installing
For the "Wasted" app:
Check the box saying "Wipe Data" (you can optionally check wipe eSim if yiu also want that to happen)
Tap the bottom button saying [Off] which would ask you to give permission to the app as a Device Administrator, giving it the power to wipe your device.
Tap the gear button on top right
Scroll down to the "Lock" and check that
Tap the upper left button with the 3 horizontal lines
Tap the "Lock" menu option
Enter a value. I personally would use something like 24 or 48 hours. Note that 24H automatically becomes 1D in the app, idk why but thats just some weird quirks with the app.
For the Duress app, it doesn't really work anymore on the phone I'm using, so you might have to do your own testing.
Edit: Make sure you dont get drunk and passed out for 24 hours because then your phone gets wiped lol. Good luck, I didn't make the app so be careful with it, don't blame me if your accidentally get your device wiped when you didnt want it to.
Edit 2: Also you cant really know if these apps works on your particular phone unless you test it yourself, that means wiping it. So you might wanna back up your phone then trigger the wipe to see if it works. Dont wanna get caught at a protest only to find out the app failed.
Nice, I think making your phone go into Before First Unlock mode cannot be considered destruction of evidence
Well they might charge you with "Obstruction of Justice" instead. Then plug it in some cellebrite device and boom, unlocked.
Best way to not have to deal with stuff like this is just to not have the incriminating evidence in the first place. If you are, for example, doing a protest, only chat with contacts in a safe place, then wipe chat logs every time, any data you wish to keep should be encrypted then uploaded anonymously via VPN/Tor and wiped from local storage. Hide the fact that such data exists so you wouldn't have a scenario where the government is trying to get you to give them the data, since they dont even know what data exists. Plausable deniability.
Edit: Those apps I've linked is still a good idea since "Destruction of Evidence" is probably a lesser charge than something like "Rioting".
Cellebrite? I don't think that's how encryption works
There are attacks where rather than trying to crank the password you just capture the hash which is stored in memory somewhere and then using a tool that lets you bypass the standard login inject that hash into the app, totally bypassing the UI interface and the password hashing algorithm.
The app sees the hash is correct and isn't aware that the information has been input via nonstandard methods, and so allows access.
The attacker still doesn't have a clue what your password was, but they don't need to. Interestingly enough this means that every time they want access to your data they have to do this because they don't have a way of actually changing the password or finding out what it was.
It might work that way, actually .
Just because the phone is encrypted doesn't mean there's not an exploit that makes it easier to bypass or extract the passphrase. Celebrite is unfortunately pretty good at attacking out of support phone and breaking into them.
Use a modern, supported OS on a device put out by a trusted vendor and you're probably ok. But old software/hardware makes it much easier to bypass.
Apparently some phones have a totally isolated electrically separated microcomputer which is in charge of encryption and decryption. Your phone doesn't actually know how the encryption decryption is done because it's separated from the microcontroller.
Any attempts to modify the microcontroller or replace any of its components with more cooperative components, will result in all of the data being wiped. This is implemented at the firmware level with the instructions being in ROM.