News for hackers. Stuff that matters.
Re:Your heart rate at gunpoint by ghshephard on Tuesday April 05, 2016 @02:25AM (#11428279)
" They instructed me to unlock my phone and other personal accounts. " - That would suck. As one who has also been robbed at gunpoint (Redwood City, CA), I remember clearly thinking - "Thankfully, all you're getting is a locked phone."

With touch ID, my password is a 24 character ridiculous combination of special characters, numbers, and letters (only typed on power up) - so If I ever get mugged again (highly unlikely now that I'm living in Singapore) - at the very least, they'll get the iPhone unlocked with my touch ID, and if they ask me to enter my password - zero chance of them memorizing it without taking a lot of detailed notes - which, honestly, muggers usually aren't into.

Re:Your heart rate at gunpoint by pdkl95 on Tuesday April 05, 2016 @02:43AM (#11428346)
> instructed me to unlock my phone and other personal accounts.

Given that use this tactic will probably increase over time, phones and other portable computers should really support duress passwords.

The device should look like it unlocked properly, but really put everything in a type of read-only mode where writes and certain network transactions return success but don't actually do anything. Obviously, if network access (any type) is available, some sort of silent alarm can be raised at the same time.

Re:Your heart rate at gunpoint by tempestn on Tuesday April 05, 2016 @02:52AM (#11428375)
I was thinking the same thing, but it would be very tricky to do right. If there's any tip-off, it could literally get someone killed. Plus, what if they just have you open your phone's browser to log into online banking? Not much the OS can do about that without making it obvious that the browser is locked down. You could claim to not use online banking, but would you be willing to risk your life? Or what about the email app? Making it read-only doesn't help much; giving a criminal read-only access to all your email would be a disaster. But again, it would be obvious something was up if the account was empty.

I'm not saying it couldn't be done, but it would be very difficult to do in a way that wouldn't be noticed, especially once it became common knowledge.

Re:Your heart rate at gunpoint by Bluestrike2 on Tuesday April 05, 2016 @03:04AM (#11428427)
You just need to fool them for a few minutes until the mugger runs off. Everything could kick in after that or you could determine when the device has moved a significant distance after the duress password has been entered. In that short a time, your exposure is relatively limited. They can't get everything, and you could always record activity and use the network (that's still secretly active) to record what apps were opened during the exposure period, take periodic low-res screenshots that would show exactly what they were viewing, or even take a few mugger selfies. Upload it all in the background and send an email with everything the police might need to catch the little perp.

No mugger is going to stick around longer than they have to. The need to get away quickly would dictate the design choices for such functionality. Maybe we'll get lucky and a few security developers at Apple/Google/etc. will read this discussion and get some good ideas to think about :).

Re:Your heart rate at gunpoint by ghshephard on Tuesday April 05, 2016 @03:18AM (#11428492)
Thankfully, my OCBC online banking only allows you to interact with existing accounts. If you want to do anything interesting, you need to have a separate (Physical, completely offline) token to add new accounts, and you need the same token to "sign" transactions over a certain $$$ figure.
Re:Your heart rate at gunpoint by chris_overseas on Tuesday April 05, 2016 @04:46AM (#11428835)
Take a look at Cerberus [1], it has a lot of very helpful features that I haven't seen on other similar apps. Eg take silent photos on incorrect login attempts and email them to you, disable power-off, survive factory reset. I used it once successfully to recover my lost phone. It automatically sent photos to me of the person who found it, and I made my phone speak out a voice message asking them to please stay there while I came to collect it. The guy who found it was looking stunned when I arrived there a few minutes later.

I'm not affiliated with Cerberus in any way, just a happy customer.

[1] https://play.google.com/store/apps/details?id=com.lsdroid.ce...

Re:Your heart rate at gunpoint by MertsA on Tuesday April 05, 2016 @06:38AM (#11429322)
>disable power-off

If the thieves are somewhat savvy they will just hold down the power button until it turns off. Can't disable that in software.

Re:Your heart rate at gunpoint by melvinmt on Tuesday April 05, 2016 @04:04AM (#11428666)
Simple: You enter the duress password and suddenly, you have "bad connectivity".
Re:Your heart rate at gunpoint by function_seven on Tuesday April 05, 2016 @04:21AM (#11428735)
Yeah, that's the thing I want to do when someone has me at gunpoint! Make sure I suddenly have "bad connectivity".

You know what would be the better thing to do in that situation? Make damn sure shit works and they get what they're looking for. I'll worry about cancelling credit cards, etc. later.

Re:Your heart rate at gunpoint by rdl on Tuesday April 05, 2016 @03:21AM (#11428511)
It probably makes more sense to just support remote-unlock and remote-password-change quickly/easily, after the fact. I wouldn't want to depend on duress passwords except if they worked exactly identically and ALSO sent a silent alarm.

For post-contact response, maybe even an IVR system you can call (from a public phone or something) and give an audio or DTMF password.

(I'd also like to get my phone droned after I move out of danger close radius, or the civilized city equivalent (police/bike gang/etc. show up at geolocation))

Re:Your heart rate at gunpoint by Bluestrike2 on Tuesday April 05, 2016 @02:57AM (#11428392)
That's... brilliant. You could do all sorts of things to protect the user's data while preserving the fiction that the device is unlocked and functioning as all you need to do is fake it for a few minutes to fool the mugger. After all, they don't stick around.

You could force the device to self-wipe data storage after X minutes or force specific apps to 'crash' on open (email, 2FA apps, banking, etc.) where even offline access could be detrimental.

Re:Your heart rate at gunpoint by kristiandupont on Tuesday April 05, 2016 @03:18AM (#11428497)
..and it could call for help.
Re:Your heart rate at gunpoint by Bluestrike2 on Tuesday April 05, 2016 @03:22AM (#11428513)
Oops. Kind of blew right past that rather useful feature. Dial 911 and leave the microphone on, though it could lead to problems for the system in tracking down false alarms.
Re:Your heart rate at gunpoint by ashitlerferad on Tuesday April 05, 2016 @05:23AM (#11429048)
Don't forget turning on both of the cameras and streaming the video to 911.
Re:Your heart rate at gunpoint by lentil_soup on Tuesday April 05, 2016 @05:33AM (#11429087)
Having been robbed many times, including a kidnapping I can say that your logical thinking will go out of the window because of the nerves. I would find it difficult to remember a duress password and wouldn't trust myself with evaluating the situation properly to make the call whether to use it or not. I'd rather have an after-robbery mechanism to lock my phone once I am safe.

When assaulted, just cooperate.

Re:Your heart rate at gunpoint by PepeGomez on Tuesday April 05, 2016 @04:05AM (#11428669)
I think there is no way you would recall the password when you need it.
Re:Your heart rate at gunpoint by Bluestrike2 on Tuesday April 05, 2016 @02:45AM (#11428352)
I guess the hope would be that you have a smart mugger. A dumb one might shoot you on principle for forcing them to remember what they'd see as a ridiculous password. "Forget it man, keep the damn phone" is probably pretty unlikely. Unfortunately.
Re:Your heart rate at gunpoint by dmoy on Tuesday April 05, 2016 @03:08AM (#11428445)
Most muggers don't actually want to kill people. Murder brings the cops a lot faster.

Murder rate is like 25x less, and even less common for strangers. (Though like half of stranger murders are during robbery, so yea, just do what you're told)

Re:Your heart rate at gunpoint by Bluestrike2 on Tuesday April 05, 2016 @03:12AM (#11428468)
Definitely. An intelligent mugger likely isn't going to pull the trigger unless they think they have to or that have no choice. Of course, you have almost zero control over that so that probably sounds rather trite.

I was just joking about the dumb one shooting you, though I think any mugger would be pretty pissed if you rattle off a long gibberish password rather than "password1."

Re:Your heart rate at gunpoint by venomsnake on Tuesday April 05, 2016 @04:07AM (#11428679)
They could ask you to change it. Anyway - do as you are told. Devices are consumables. I would politely ask for my sim card and to make factory wipe though.
Re:Your heart rate at gunpoint by hrrsn on Tuesday April 05, 2016 @04:35AM (#11428792)
This would be my only concern. "Uhh, do you mind if I just switch off Find my iPhone and reset the phone for you first?"
Re:Your heart rate at gunpoint by dclowd9901 on Tuesday April 05, 2016 @02:44AM (#11428350)
Isn't there an infiltration vector glibly called rubber hose cryptanalysis to describe this very thing? Nothing is ever 100% secure for this reason alone.
Re:Your heart rate at gunpoint by Houshalter on Tuesday April 05, 2016 @08:30AM (#11429821)
That reminds me of a thought I had recently. Often in movies and TV shows, someone will be torturing another for their secret information. And for some reason they always tell the truth. I've always wondered why movie characters don't lie more often in those situations. Because usually the torturer isn't in a position to confirm it's truth instantly, or sometimes at all.

Passwords are the one exception to this. You can always confirm a password instantly from anywhere. But it doesn't need to be that way, you can have duress passwords. Truecrypt supports hidden archives, where entering the fake password unlocks a different encrypted folder with different files. The same thing thing is true on some "secure photo" apps for phones. For a phone, you would have a password that bricks the phone after a certain time limit, like 24 hours. But appears to work fine for the moment.

Re:Your heart rate at gunpoint by noja on Tuesday April 05, 2016 @02:59AM (#11428399)
> without taking a lot of detailed notes - which, honestly, muggers usually aren't into.

They could take a video.

Re:Your heart rate at gunpoint by PepeGomez on Tuesday April 05, 2016 @04:32AM (#11428779)
They could tell you to change it to 1234.
Re:Your heart rate at gunpoint by tunichtgut on Tuesday April 05, 2016 @03:48AM (#11428624)
...this shows what kind of hellhole the usa has become. even in a city near or in silicon valley, well armed criminals roam the streets...pp are "measuring" their heart with sensors while being robbed and tell the internet about this. a "sane" society?
Re:Your heart rate at gunpoint by hga on Tuesday April 05, 2016 @07:09AM (#11429446)
even in a city near or in silicon valley, well armed criminals roam the streets

Well, in most of the US, 43 out of 50 states, 5-10% of the civilian population could also be "well armed", and outside of (still) high crime areas like Chicago I think this sort of crime is much less common, and as noted by dvirsky the crime rates in general have been dropping for decades, although that's almost certainly more due to demographics than anything else (i.e. the population of young men).

My vision of a "sane society" is one where I don't necessarily bother with a sensor, although the data from one would certainly be neat, but one in which during a moment's inattention from the one with the gun, or when they stupidly ask me to empty my pockets, I draw my 1911 and give them some .45 ACP love instead of my can't lock in the first place feature phone etc. Assuming my situational awareness was so poor I hadn't started avoiding letting them get so close in the first place, a skill honed in the dozen years I lived as an unarmed pedestrian in the Boston area, yuck.

Before anyone goes off on an "oh, you're so deliciously macho" tangent, while you have to judge each incident by itself, statistically, resisting a criminal assault results in much better outcomes. If you live in Silicon Valley, well, it sucks to be you (even if this isn't your sort of thing, as it is nationwide for the 90-95% of the population who don't legally carry concealed, you don't benefit from herd immunity).

Re:Your heart rate at gunpoint by travisby on Tuesday April 05, 2016 @08:54AM (#11429949)
I don't have much to contribute, but it's always great to hear a fellow carrier on Hacker News. Especially one who carries a 1911. Glad there's a couple of us here.
Re:Your heart rate at gunpoint by hga on Tuesday April 05, 2016 @10:11AM (#11430486)
For me, it's not entirely a "choice", they've fit my hand like a glove since I was a teen and I can shoot them very well whatever the quality of trigger or sights.

But I'm quite happy to carry one of the greatest legacies of John Moses Browning, and I marvel at how mature this technology is, where century old designs like the the Mauser 1898 rifle and the 1911 handgun are entirely competitive with the shiny new stuff, albeit maybe not quite as easy and inexpensive to manufacture or maintain.

Re:Your heart rate at gunpoint by ghshephard on Tuesday April 05, 2016 @09:16AM (#11430079)
statistically, resisting a criminal assault results in much better outcomes

I'd be willing to wager that simply passively handing over your wallet and phone, by a wide margin, results in better outcomes than trying to draw a weapon on a guy jacked up on adrenalin with his finger on the trigger pointed at you.

Anybody so stupid to risk a felony conviction on something so low-value as mugging someone, is probably stupid enough to pull the trigger if startled.

Re:Your heart rate at gunpoint by hga on Tuesday April 05, 2016 @10:03AM (#11430421)
I'm personally not "willing to wager" about this, all I'm doing is reporting what the statisticians have discovered in their studies of the actual outcomes of crimes. I hope it goes without saying that for any particular crime, I wouldn't go by raw statistics but would judge the situation.

But I've read of accounts where citizens did things that struck us serious self-defense types as really stupid, but prevailed, and I don't judge them because I wasn't there and they were right, even if the risk struck us as too great.

Here, I'm imagining a scenario where my gun, which just happens to rest over my right back pocket where my wallet might be, wouldn't even visible to the criminals until they've got about 2-3 tenths of a second to respond, ideally where I'd also start moving laterally. And if it's night, I'd be wearing body armor (yeah, I'm paranoid :-), so even his being "stupid enough to pull the trigger" if he can manage to do so might not be the end of the world.

But it all comes down to your judgement of the situation, your luck, etc. ... and as many people have told me, you make your own luck as it were. Which circles back to what the statisticians discovered.

Re:Your heart rate at gunpoint by ghshephard on Tuesday April 05, 2016 @11:05AM (#11430893)
Fair enough - I can't disagree with anything you are saying here.

Honestly, one of the more astute things you mentioned was not getting into this situation in the first place, "Assuming my situational awareness was so poor I hadn't started avoiding letting them get so close in the first place," - I take full responsibility for getting mugged - it was after dark, on a deserted sidewalk - and my lack of situational awareness, directly led to the miscreants getting close enough to draw down on me and relieve me of my possessions.

I lived in a much rougher part of Oakland (17th and the lake, in 98-99) for 2 1/2 years, and never once came close to being on the receiving end of a crime, because I was always hyper aware of my environment. But, you get sloppy on the peninsula, and look what happens...

Re:Your heart rate at gunpoint by dvirsky on Tuesday April 05, 2016 @04:13AM (#11428707)
Actually crime rates in the US have been dropping steadily for decades.

Thought personally, not living in the US, just the thought of being robbed is like science fiction to me. And it's not like I live in a great country, but things like this just almost never happen here. Gas stations and convenience stores get robbed sometimes, your apartment might be broken into, but someone on the street robbing you? I don't know a single person this had happened to.

Re:Your heart rate at gunpoint by pythia__ on Tuesday April 05, 2016 @05:32AM (#11429085)
It's not as simple as that. Advances in trauma medicine played a major role in lowering murder rates.

http://www.ncbi.nlm.nih.gov/pmc/articles/PMC1124155/

Re:Your heart rate at gunpoint by hga on Tuesday April 05, 2016 @07:15AM (#11429478)
I've seen disputes about how much (can look them up), but as the abstract notes, this was largely a mid-1970s thing, as advanced trauma treatment from the Vietnam War filtered into the US, although the process started in the last '50s: https://en.wikipedia.org/wiki/R_Adams_Cowley
Re:Your heart rate at gunpoint by ceejayoz on Tuesday April 05, 2016 @10:02AM (#11430418)
Murder rates aren't the only form of crime going down. Rape, robbery, property crimes are all down massively since the peak in the 1970s. One speculated reason is the removal of lead.
Re:Your heart rate at gunpoint by morgante on Tuesday April 05, 2016 @04:24AM (#11428750)
It's not like it happens very often in the US either. I don't know anyone who's gotten mugged.
Re:Your heart rate at gunpoint by dvirsky on Tuesday April 05, 2016 @08:48AM (#11429906)
I looked up some international stats on robbery, but they don't differentiate between mugging of people on the street and robberies at businesses, banks, etc. The US has a rate about x3 higher than my country (Israel), but again, it doesn't tell you much.
Re:Your heart rate at gunpoint by morgante on Tuesday April 05, 2016 @08:56AM (#11429967)
Sure, but 3x a very low number is still a very low number. It's not like I think or worry about being robbed.
Re:Your heart rate at gunpoint by dvirsky on Tuesday April 05, 2016 @01:47PM (#11432631)
For what it's worth, I don't either when I'm in the US.
Re:Your heart rate at gunpoint by jacalata on Tuesday April 05, 2016 @04:24AM (#11428751)
Yea, used to be people could get robbed without having a heart rate monitor on them and never think to let the internet know!