I was thinking the same thing, but it would be very tricky to do right. If there's any tip-off, it could literally get someone killed. Plus, what if they just have you open your phone's browser to log into online banking? Not much the OS can do about that without making it obvious that the browser is locked down. You could claim to not use online banking, but would you be willing to risk your life? Or what about the email app? Making it read-only doesn't help much; giving a criminal read-only access to all your email would be a disaster. But again, it would be obvious something was up if the account was empty.

I'm not saying it couldn't be done, but it would be very difficult to do in a way that wouldn't be noticed, especially once it became common knowledge.

You just need to fool them for a few minutes until the mugger runs off. Everything could kick in after that or you could determine when the device has moved a significant distance after the duress password has been entered. In that short a time, your exposure is relatively limited. They can't get everything, and you could always record activity and use the network (that's still secretly active) to record what apps were opened during the exposure period, take periodic low-res screenshots that would show exactly what they were viewing, or even take a few mugger selfies. Upload it all in the background and send an email with everything the police might need to catch the little perp.

No mugger is going to stick around longer than they have to. The need to get away quickly would dictate the design choices for such functionality. Maybe we'll get lucky and a few security developers at Apple/Google/etc. will read this discussion and get some good ideas to think about :).

Thankfully, my OCBC online banking only allows you to interact with existing accounts. If you want to do anything interesting, you need to have a separate (Physical, completely offline) token to add new accounts, and you need the same token to "sign" transactions over a certain $$$ figure.

Take a look at Cerberus [1], it has a lot of very helpful features that I haven't seen on other similar apps. Eg take silent photos on incorrect login attempts and email them to you, disable power-off, survive factory reset. I used it once successfully to recover my lost phone. It automatically sent photos to me of the person who found it, and I made my phone speak out a voice message asking them to please stay there while I came to collect it. The guy who found it was looking stunned when I arrived there a few minutes later.

I'm not affiliated with Cerberus in any way, just a happy customer.

[1] https://play.google.com/store/apps/details?id=com.lsdroid.ce...

>disable power-off

If the thieves are somewhat savvy they will just hold down the power button until it turns off. Can't disable that in software.

Simple: You enter the duress password and suddenly, you have "bad connectivity".

Yeah, that's the thing I want to do when someone has me at gunpoint! Make sure I suddenly have "bad connectivity".

You know what would be the better thing to do in that situation? Make damn sure shit works and they get what they're looking for. I'll worry about cancelling credit cards, etc. later.

It probably makes more sense to just support remote-unlock and remote-password-change quickly/easily, after the fact. I wouldn't want to depend on duress passwords except if they worked exactly identically and ALSO sent a silent alarm.

For post-contact response, maybe even an IVR system you can call (from a public phone or something) and give an audio or DTMF password.

(I'd also like to get my phone droned after I move out of danger close radius, or the civilized city equivalent (police/bike gang/etc. show up at geolocation))

That's... brilliant. You could do all sorts of things to protect the user's data while preserving the fiction that the device is unlocked and functioning as all you need to do is fake it for a few minutes to fool the mugger. After all, they don't stick around.

You could force the device to self-wipe data storage after X minutes or force specific apps to 'crash' on open (email, 2FA apps, banking, etc.) where even offline access could be detrimental.

..and it could call for help.

Oops. Kind of blew right past that rather useful feature. Dial 911 and leave the microphone on, though it could lead to problems for the system in tracking down false alarms.

Don't forget turning on both of the cameras and streaming the video to 911.

Having been robbed many times, including a kidnapping I can say that your logical thinking will go out of the window because of the nerves. I would find it difficult to remember a duress password and wouldn't trust myself with evaluating the situation properly to make the call whether to use it or not. I'd rather have an after-robbery mechanism to lock my phone once I am safe.

When assaulted, just cooperate.

I think there is no way you would recall the password when you need it.