16 ms·

Since the courts decided you have to use your fingerprint to unlock your phone (because they decided that's not giving up your password and they can't compel yo

by Alive-in-2025 1mo ago

Since the courts decided you have to use your fingerprint to unlock your phone (because they decided that's not giving up your password and they can't compel you to give up your password), what if you use your fingerprint to wipe your phone? But you don't tell anyone ahead of time when they force you to use it. I'm sure you'd be arrested at the least. I can't be the only person who has thought of this.

amelius 1mo ago
Best approach is to shadow-ban the user when they do a secret gesture before logging in. No wiping necessary. Easiest implementation is to just log them into a shadow account.
- inigyou 1mo ago
  GrapheneOS rejected the shadow account idea because it would be very obvious to everyone that it was a shadow account.
  - amelius 1mo ago
    But it wouldn't be illegal, I suppose. That's what counts, in the end.
    - inigyou 1mo ago
      The threat model of GrapheneOS is that the law is irrelevant and the attacker will do anything to get your data.
BoppreH 1mo ago
IANAL, but I would bet that's still destruction of evidence. Judges are human, for better or worse, and can see the intention behind cute tricks like this. It might work if your fingerprint was used while you were unconscious, but any solution that starts with "setup a trigger that wipes a device" is already on shaky grounds.
- inigyou 1mo ago
  AFAIK it's legal to set up a trigger that wipes a device. It isn't legal to choose to wipe your device after you know the government wants the data. Tricking the government into wiping it is still allowed, especially if you tell them not to do that.
  - BoppreH 1mo ago
    That matches my understanding too. Unfortunately it sounds like the poster was suggesting to wipe the device after the government requests access, and was probably not planning on telling the officers about the trigger.
    - inigyou 1mo ago
      With fingerprint unlock it's not your choice. That's what makes it clever. The cop can grab your finger and hold it to the scanner while you tell him not to do that.
      - Nextgrid 1mo ago
        Presumably you must disclose that "doing that" would wipe the device... and you better hope this is caught on some neutral party's camera so there is a record of you saying that.
        pamcake 1mo ago
        False presumption. You are just making that up, right?
        Nextgrid 1mo ago
        I am not a lawyer, I am just "making up" what exculpatory evidence I would prefer to have on my side when potentially confronted with a charge of destruction of evidence after pulling a stunt like this.
    - 1mo ago
lukan 1mo ago
Well, guess what happens: https://www.nytimes.com/2026/07/28/us/duress-password-phone-wipe-charge.html https://www.nytimes.com/2026/07/28/us/duress-password-phone-...
- inigyou 1mo ago
  That happened because he chose to give the duress PIN. Cops are allowed to just grab your finger and scan it against your protest. You can say "don't do that, it'll wipe my phone" and they'll do it anyway and it'll wipe your phone, and now it certainly isn't your fault.
  - nisegami 1mo ago
    What does it matter? The state certainly isn't going to throw up its hands and say "you got us". They're still going to try to make it out to be your fault and even if you do successfully argue it wasn't of your volition, they've still robbed you of years of your life and hundreds of thousands of dollars in lawyer fees.
    - close04 1mo ago
      > they've still robbed you of years of your life and hundreds of thousands of dollars in lawyer fees. Intentionally giving a duress PIN which you know will wipe evidence - information you were just asked for by some law enforcement - just robs you of more of years and money. The law is lopsided and gives some more power than others. There's no point debating why it's like that, try to change the law before you break it or find ways to not need to break it at all.
    - inigyou 1mo ago
      Well that applies to anything you do that the state doesn't like, so may as well just give up and kill yourself? Or what's your plan?
      - nisegami 1mo ago
        My plan is to live a reasonable life and treat the state like I treat violent weather. If I happen to have the misfortune of drawing the attention of the state, then yes, your suggestion may be relevant.
inigyou 1mo ago
Fingerprint and PIN unlock, but only PIN unlocks it and fingerprint is always duress? That's a good idea.
- stronglikedan 1mo ago
  At that point, just don't have biometrics configured at all. It would be waaay to easy to accidentally wipe your phone. Just have an unlock PIN and a duress PIN. You're going to be charged with destroying evidence either way if you use the duress method, so you may as well use the method that won't accidentally wipe your phone with a single misplaced finger.
  - inigyou 1mo ago
    The point is that you don't wipe your finger. The police wipes your finger against your will.
reedf1 1mo ago
This would still be destruction of evidence - virtually your only defense against that would be if it was not triggered by you.
- bloak 1mo ago
  Since you seem to know about this, what are the actual rules about "destruction of evidence" in your jurisdiction? What does the accused need to have known for a crime to have been committed? (Common sense tells me that the accusation might make sense both in cases in which the accused knows about a crime and in cases in which the accused knows about a police investigation, even in the absence of a crime, but deleting nude photographs to stop a customs officer from seeing them, for a random example, would that be a crime?)
  - reedf1 1mo ago
    Generally any material you intentionally delete after you are told to hand over evidence is considered to be the most incriminating version of that material in a court of law.
    - bloak 1mo ago
      That rule wouldn't work very well if the person who destroyed the evidence isn't the person suspected of the crime and it is unclear whether the person who destroyed the evidence is a friend or an enemy of the suspect. So I think a sane legal system would want to punish the person who destroyed the evidence rather than jeopardise the fair trial of the suspect.
- shevy-java 1mo ago
  How can they reason that evidence was destroyed when they can not prove it ever existed in the first place?
  - inigyou 1mo ago
    How can they in the GrapheneOS duress pin case?
Tangurena2 1mo ago
A password is considered (by courts) to be testimony. Face, gesture or fingerprints are considered things like keys which you can be forced/compelled to turn over when commanded by law enforcement. Therefore, only passwords, which will require a court order to unlock, are secure enough for now.
- petesergeant 1mo ago
  > A password is considered (by courts) to be testimony For now. It doesn't seem like an especially natural fit. Regardless of the merits of being able to compelled to turn over your password, relying on labored interpretation of laws is not a good idea: 14th amendment was always a very shaky basis for abortion rights, as the 2nd is a very shaky one for personal gun rights.
graceful6800 1mo ago
Using a duress PIN or other duress feature is now considered destroying evidence so YMMV
- ern_ave 1mo ago
  Write your duress PIN on the back of the phone. I guarantee you the first cop that sees it will go, "LOLOL!!!! HIS PASSWORD IS RIGHT THERE!!! LOLOL" and immediately enter it.
  - inigyou 1mo ago
    I heard for this reason police are now trained not to try any code that you can't go to jail for if it turns out to be a duress code. That means anything you didn't tell them was the unlock code.
stronglikedan 1mo ago
> you have to use your fingerprint to unlock your phone Nitpick, but that's only if you have biometric authentication configured in the first place, which you aren't compelled to do.
- Alive-in-2025 1mo ago
  Yes. But I apparently didn't make the point I wanted to. If you set your phone to delete everything when you scan your fingerprint, is that a crime? No password need be provided. You cannot avoid giving them your fingerprint to unlock a phone, already established in the US as a legal rule. I'm sure they will claim its a crime if you set it up that way, but is it? They can already legally compel you to provide your fingerprint. You can't avoid that, you'll get put in jail. Do you have to tell them "don't do that with my phone, it will reset everything if you do that".

amelius 1mo ago

Best approach is to shadow-ban the user when they do a secret gesture before logging in. No wiping necessary. Easiest implementation is to just log them into a shadow account.

inigyou 1mo ago
GrapheneOS rejected the shadow account idea because it would be very obvious to everyone that it was a shadow account.
- amelius 1mo ago
  But it wouldn't be illegal, I suppose. That's what counts, in the end.
  - inigyou 1mo ago
    The threat model of GrapheneOS is that the law is irrelevant and the attacker will do anything to get your data.

BoppreH 1mo ago

IANAL, but I would bet that's still destruction of evidence. Judges are human, for better or worse, and can see the intention behind cute tricks like this. It might work if your fingerprint was used while you were unconscious, but any solution that starts with "setup a trigger that wipes a device" is already on shaky grounds.

inigyou 1mo ago
AFAIK it's legal to set up a trigger that wipes a device. It isn't legal to choose to wipe your device after you know the government wants the data. Tricking the government into wiping it is still allowed, especially if you tell them not to do that.
- BoppreH 1mo ago
  That matches my understanding too. Unfortunately it sounds like the poster was suggesting to wipe the device after the government requests access, and was probably not planning on telling the officers about the trigger.
  - inigyou 1mo ago
    With fingerprint unlock it's not your choice. That's what makes it clever. The cop can grab your finger and hold it to the scanner while you tell him not to do that.
    - Nextgrid 1mo ago
      Presumably you must disclose that "doing that" would wipe the device... and you better hope this is caught on some neutral party's camera so there is a record of you saying that.
      - pamcake 1mo ago
        False presumption. You are just making that up, right?
        Nextgrid 1mo ago
        I am not a lawyer, I am just "making up" what exculpatory evidence I would prefer to have on my side when potentially confronted with a charge of destruction of evidence after pulling a stunt like this.
  - 1mo ago

lukan 1mo ago

Well, guess what happens: https://www.nytimes.com/2026/07/28/us/duress-password-phone-wipe-charge.html https://www.nytimes.com/2026/07/28/us/duress-password-phone-...

inigyou 1mo ago
That happened because he chose to give the duress PIN. Cops are allowed to just grab your finger and scan it against your protest. You can say "don't do that, it'll wipe my phone" and they'll do it anyway and it'll wipe your phone, and now it certainly isn't your fault.
- nisegami 1mo ago
  What does it matter? The state certainly isn't going to throw up its hands and say "you got us". They're still going to try to make it out to be your fault and even if you do successfully argue it wasn't of your volition, they've still robbed you of years of your life and hundreds of thousands of dollars in lawyer fees.
  - close04 1mo ago
    > they've still robbed you of years of your life and hundreds of thousands of dollars in lawyer fees. Intentionally giving a duress PIN which you know will wipe evidence - information you were just asked for by some law enforcement - just robs you of more of years and money. The law is lopsided and gives some more power than others. There's no point debating why it's like that, try to change the law before you break it or find ways to not need to break it at all.
  - inigyou 1mo ago
    Well that applies to anything you do that the state doesn't like, so may as well just give up and kill yourself? Or what's your plan?
    - nisegami 1mo ago
      My plan is to live a reasonable life and treat the state like I treat violent weather. If I happen to have the misfortune of drawing the attention of the state, then yes, your suggestion may be relevant.

inigyou 1mo ago

Fingerprint and PIN unlock, but only PIN unlocks it and fingerprint is always duress? That's a good idea.

stronglikedan 1mo ago
At that point, just don't have biometrics configured at all. It would be waaay to easy to accidentally wipe your phone. Just have an unlock PIN and a duress PIN. You're going to be charged with destroying evidence either way if you use the duress method, so you may as well use the method that won't accidentally wipe your phone with a single misplaced finger.
- inigyou 1mo ago
  The point is that you don't wipe your finger. The police wipes your finger against your will.

reedf1 1mo ago

This would still be destruction of evidence - virtually your only defense against that would be if it was not triggered by you.

bloak 1mo ago
Since you seem to know about this, what are the actual rules about "destruction of evidence" in your jurisdiction? What does the accused need to have known for a crime to have been committed? (Common sense tells me that the accusation might make sense both in cases in which the accused knows about a crime and in cases in which the accused knows about a police investigation, even in the absence of a crime, but deleting nude photographs to stop a customs officer from seeing them, for a random example, would that be a crime?)
- reedf1 1mo ago
  Generally any material you intentionally delete after you are told to hand over evidence is considered to be the most incriminating version of that material in a court of law.
  - bloak 1mo ago
    That rule wouldn't work very well if the person who destroyed the evidence isn't the person suspected of the crime and it is unclear whether the person who destroyed the evidence is a friend or an enemy of the suspect. So I think a sane legal system would want to punish the person who destroyed the evidence rather than jeopardise the fair trial of the suspect.
shevy-java 1mo ago
How can they reason that evidence was destroyed when they can not prove it ever existed in the first place?
- inigyou 1mo ago
  How can they in the GrapheneOS duress pin case?

Tangurena2 1mo ago

A password is considered (by courts) to be testimony. Face, gesture or fingerprints are considered things like keys which you can be forced/compelled to turn over when commanded by law enforcement. Therefore, only passwords, which will require a court order to unlock, are secure enough for now.

petesergeant 1mo ago
> A password is considered (by courts) to be testimony For now. It doesn't seem like an especially natural fit. Regardless of the merits of being able to compelled to turn over your password, relying on labored interpretation of laws is not a good idea: 14th amendment was always a very shaky basis for abortion rights, as the 2nd is a very shaky one for personal gun rights.

graceful6800 1mo ago

Using a duress PIN or other duress feature is now considered destroying evidence so YMMV

ern_ave 1mo ago
Write your duress PIN on the back of the phone. I guarantee you the first cop that sees it will go, "LOLOL!!!! HIS PASSWORD IS RIGHT THERE!!! LOLOL" and immediately enter it.
- inigyou 1mo ago
  I heard for this reason police are now trained not to try any code that you can't go to jail for if it turns out to be a duress code. That means anything you didn't tell them was the unlock code.

stronglikedan 1mo ago

> you have to use your fingerprint to unlock your phone Nitpick, but that's only if you have biometric authentication configured in the first place, which you aren't compelled to do.

Alive-in-2025 1mo ago
Yes. But I apparently didn't make the point I wanted to. If you set your phone to delete everything when you scan your fingerprint, is that a crime? No password need be provided. You cannot avoid giving them your fingerprint to unlock a phone, already established in the US as a legal rule. I'm sure they will claim its a crime if you set it up that way, but is it? They can already legally compel you to provide your fingerprint. You can't avoid that, you'll get put in jail. Do you have to tell them "don't do that with my phone, it will reset everything if you do that".