The foundation behind the ultra-secure Android-based OS is speaking out after an activist was indicted for using a ‘duress password’ to prevent federal agents from searching his phone.
The foundation behind the ultra-secure Android-based OS is speaking out after an activist was indicted for using a ‘duress password’ to prevent federal agents from searching his phone.
Sure, but IIRC that does not help if the attacker can retain the device or clone it, yes? Once they have a copy of the raw data they can just throw a datacenter at it, for any future amount of time.
Let’s assume they successfully extract all the remaining data after you enter the duress pin. Which, while not impossible, extracting the data on most GrapheneOS devices would require physically desoldering the SSD from the phone and dumping the data.
With the data extracted, assuming they attempt brute force, they’re not brute forcing your password, they’re brute forcing the entire decryption key, which is a mix of your password and a key generated when you first set up the OS (the latter of which was destroyed when the duress pin was entered). At that point, the phone owner, their entire lineage, and realistically the entirety of the universe itself will be long dead unless some breakthrough in cryptanalysis weakens AES256 such that it can be brute forced before all of humanity dies. That is to say, after the duress pin is entered, no one on Earth, even the device owner, can decrypt the data on the device.