GrapheneOS's default is 18 hours and it can be set to between 10 minutes and 72 hours. iPhones and Stock pixels have it non customizable at 72 hours.
On GrapheneOS, for privacy and convenience, it's best to use a long random passphrase [1] for your primary unlock and then a fingerprint with a second factor pin as the secondary unlock. You enter the passphrase every time the device restarts.
If you're encountering someone that's going to seize your phone, try to restart/shut it down yourself so you don't have to trust the AFU protections.
[1] https://strongphrase.net give memorable ones which is cool.
Or on the CLI:
Is that actually better (in practice, not in terms of entropy) than /dev/urandom? I have a lot less trust in my ability to successfully scrub a picture from my phone that deterministically created my passphrase.
It offers protection in the event that your /dev/urandom is compromised. Otherwise no.
(Of course, if your /dev/urandom is compromised then whatever process you use to compute a hash of a photo is likely compromised as well.)
Extra points if you hold you face really close and count in a dead language. You can also make ordered hand gestures in stead of counting on your fingers. Be a wizard about it!
It'd work like this: Unlock phone, plug in USB widget; it works.
Or: Plug in USB widget without first unlocking phone; phone shuts down.
Why do you call out just one OS? It's a good idea for any OS.
https://threecats.au/two-factor-pin-fingerprint-unlock-graph...
GrapheneOS allows using a passphrase with more convenience because of the fingerprint plus second factor pin (I don't think you can just have a pin as a secondary unlock). You don't need to enter the passphrase every time you unlock with this setup, only when first starting up.
The official opinion: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
Unless you have a 4 or 4XL which are pretty popular with graphene os users. The weird thing is the 4 and 4XL are the only models without fingerprint because Google was pushing its #D Face Unlock System at the time.
The funny part is Graphene by default now disables face unlock on newer Pixel models.
Shut down the phone in areas with a high snatch risk. That means during landing for example, because the aircraft can be boarded covertly if on the ground.
Yes this is of course safer. What evidence do you have that it doesn't work on GrapheneOS, though?
https://www.computerweekly.com/feature/Journalist-Richard-Me...
Perhaps the reflexive genius downvoters can explain what happened to Richard Medhurst? After his phone was snatched and the authorities pretended not to be able to decrypt it, he went on a GrapheneOS promotion spree on X and wanted to write a book about computer security.
Now he has disappeared for nearly 6 weeks. How many more people do you want to get in trouble with your false promises?
“The Great Firewall operates by checking transmission control protocol (TCP) packets for keywords or sensitive words. If the keywords or sensitive words appear in the TCP packets, access will be closed. If one link is closed, more links from the same machine will be blocked by the Great Firewall. The effect includes: limiting access to foreign information sources, blocking popular foreign websites and mobile apps, and requiring foreign companies to adapt to domestic regulations. Due to the Great Firewall, China has one of the lowest cross-border internet traffic rates in the world. Usage of foreign apps in China is minuscule; Asia Society estimated in 2026 that foreign apps blocked by the Great Firewall have extremely low traffic, particularly compared to domestic apps; the top five domestic apps saw traffic that was 1,000 times more than the top five foreign apps.”
When I was there last year, it took some doing to get a VPN working. Mullvad was pretty good but it would take a few tries to find an endpoint I could connect to. The simplest escape hatch is to have a cellular connection from another country, but that's either expensive or slow.
Edit: Just to be perfectly clear - Border Force in the UK can do the exact same thing to you once you return, British citizen or not. Leaving your device at home is still the safest choice.
> Despite all the nonsense that's posted about UK on the internet
How is it nonsense? I'm not debating the warrant thing, but it's very reasonable to assume the UK has terrible protections for these sorts of things.
https://en.wikipedia.org/wiki/Key_disclosure_law#:~:text=Uni...
And yes, UK has some awful laws around this. Yes it has put people in jail just for planning a protest before. Yes you can go to jail for not disclosing your passwords. But what you read on the internet is almost laughably out of proportion - no, you won't get arrested for posting a meme about the king.
6 people got arrested for trying to say "Not my king!" BEFORE his coronation: https://londondaily.com/not-my-king-anti-monarchy-protesters...
Before they had a chance of protest. After months of discussing the planned protest in details and getting a green light from the Met Police: https://www.bbc.co.uk/news/uk-65542558
It's not like Republicans in the UK are a violent group, unlike far right coddled by the same Met police.
52 people were arrested DURING the coronation, for example for holding a placard "not my king": https://londondaily.com/over-52-anti-monarchy-protestors-arr...
Police arrested despite KNOWING it's baseless and frankly illegal: https://novaramedia.com/2025/03/11/police-officer-who-arrest...
Tell me some more how it isn't arresting for criticising the king. Oh, well, technically he wasn't a king yet.... but that's even worse to be fair.
Might it "seem" that way because it is that way?
https://www.forbes.com/sites/steveforbes/2025/09/09/people-a...
https://www.telegraph.co.uk/news/2026/08/22/britain-has-beco...
https://freespeechunion.org/news/more-than-62-000-people-hav...
Oh, and your government itself openly states it on record, too: https://hansard.parliament.uk/lords/2025-07-17/debates/F807C...
Not that this is some kind of great bar to clear, but if you're going to argue with what I said, argue with what I actually wrote.
Clearly the point is clear. Why nitpick pointlessly?
Someone above asked me how it was nonsense. I responded that people parotting the point about getting arrested for criticising the king is nonsense - like for instance, my American coworkers asking if that's true, because they read it somewhere on the internet. That is nonsense.
If you want to argue with this point please do, but also please observe the rest of my comment and especially the parts that I haven't actually said.
6 people got arrested for trying to say "Not my king!" BEFORE his coronation: https://londondaily.com/not-my-king-anti-monarchy-protesters...
Before they had a chance of protest. After months of discussing the planned protest in details and getting a green light from the Met Police: https://www.bbc.co.uk/news/uk-65542558
52 people were arrested DURING the coronation, for example for holding a placard "not my king": https://londondaily.com/over-52-anti-monarchy-protestors-arr...
Police arrested despite KNOWING it's the member of public doesn't commit any offence: https://novaramedia.com/2025/03/11/police-officer-who-arrest...
I'm afraid you unwittingly misled your coworkers.
>> Someone above asked me how it was nonsense. I responded that people parotting the point about getting arrested for criticising the king is nonsense
Protesting against the king is criticising the king IMO. I didn't see his quantifier, since I would agree that online critique of the king in particular is not yet penalised.
Not surprising you're implying bad faith though, if we're splitting the hair this thin.
(and this specific planning of the protest was so heavy handed, because it belong to one of the two naughty protests, environmental. The second naughty one is protesting against the genocide. The rest is okay)
You can use other European countries like The Netherlands, which is a lawless police state with a liberal cover, as well.
Based on this, it seems more likely that this involves exploiting the device to retrieve the underlying keybags present in AFU mode and store them, rather than manipulating the actual feature of automatic reboots. Then the device can be exploited again in BFU mode but with the prior keybag to decrypt everything.
It sounds like this feature is being used to exploit and extract keys from devices without a warrant (or in advance of getting one), which seems dubious to me.
As I understand it this encryption is a significant additional barrier to technical or legal access to those files. If someone knows otherwise, please let me know. Being wrong could cost me my home and life savings.
Which covers divulging encryption keys because it is treated the same as compelling you to give up the combination to a wall safe which is testimonial and protected.
https://nccriminallaw.sog.unc.edu/2026/08/03/giving-police-a...
We'll have to see how that case goes but ultimately the reason he's getting in trouble is only tangentially related to his phone being encrypted. It's more correct to think of it like he smashed the phone to pieces (and imagine this definitively destroys the data for the sake of the metaphor) instead of it being about the encryption itself.
Though I would expect courts to consider that he knew LE planned to enter the provided PIN, and that the duress PIN would then result in the phone being wiped, and therefore accuse him of doing the wiping anyway.
But I don't think it's this guy's fault at all. LE is the one who asked him under duress, he easily could've feared for his life, and he did no direct harm. It was self-defense at worst.
Setting a booby trap to destroy evidence that then gets destroyed when that trap is triggered is the same as destroying evidence. This is common sense, but also see https://en.wikipedia.org/wiki/Principal_(criminal_law)
You can still be held in custody for obstruction of justice:
https://www.findlaw.com/legalblogs/third-circuit/man-held-in...
It took four years before he could secure his release:
https://www.sophos.com/en-us/blog/suspect-who-refused-to-dec...
keep in mind that the "obstruction" charge can be and is abused as a catchall charge.
But that's all beyond the point, anyways. If they did hand you your phone and said, "enter your passphrase," you can just say, "I don't remember it." They can throw a fit and put more heat on you in various ways, but until they resort to torturing you or they develop mind-reading technology, there's not much they can do at that point until the case reaches a judge.
That's not to say "I don't remember" is a sound, blanket defense. But it's sufficient for demonstrating that these dynamics all depend on willing participants which is partially why these laws are designed the way they are.
> But it's sufficient for demonstrating that these dynamics all depend on willing participants which is partially why these laws are designed the way they are.
What happens if during serving a search warrant the door is impossible to open or they find a super reinforced safe. Owner can even say "I don't remember the combination"?
SCOTUS: Hold my beer…
:)
Note that the recent high-profile case of a man being jailed involved him refusing to decrypt, rather than claiming he didn't know. He was deliberately trying to test the law regarding the permissible scope of inspection of digital data, to force the matter into the courts so the issues could be litigated in a controlled context untainted by other potential crimes; being arrested and charged was part of his plan.
>As I understand it this encryption is a significant additional barrier to technical or legal access to those files. If someone knows otherwise, please let me know. Being wrong could cost me my home and life savings.
Yes, it seems that way in the US: https://news.ycombinator.com/item?id=49922513
If your threat model includes someone using violence to coerce you, an option could be to use a cloud storage account entirely over Tor from the browser (preferably download the app because of web cryptography risks) with the login memorized. That way you can access it on any computer even if yours is lost and you can remove traces of it from your phone.
If you really want to keep this stuff on a phone at least stretch to a second phone and keep it somewhere safe.
Why...?
If I had anything I didn't want the authorities to get, I'd remove it from my phone before travel (e.g. put in cloud, etc).
https://www.aclu.org/news/privacy-technology/can-border-agen...
>CBP only searched the electronic devices of 55,318 international travelers,” the agency wrote, or 0.0013%.
would suck to be one of those 55 thousand people. I've never been bitten by a shark but I sure care about people that have?
It seems more like they're trying to determine that it is in fact a laptop and not something resembling one.
Edit: now I am gleefully thinking about how I would craft my decoy desktop persona. What gives me the most effective non interesting profile.
Yes it's bad that the government overreaches, but it is also bad for your mental health to worry about it.
The majority of people walking in the worse neighborhoods of LA or Chicago never have a single crime happen to them. But that doesn't mean that it's safe to go in a bad neighborhood - and it really doesn't mean it's safe to go there wearing designer clothing, gold watches, diamond rings and wearing your Apple VR device.
The same is true for travel. It's perfectly safe for the vast majority - but it's very important to be aware what may make you a target and what can happen to you if you are. Tens of millions of people visit the UK or China every year with no incident. But if you're a public active supporter of Palestine Action, or an active demonstrator against the CCCP respectively, be aware that you personally face a real risk from this travel, and your devices are actually very likely to be searched at those borders. Vice versa though (anti-CCCP activist traveling to UK, PA activist traveling to China) is perfectly safe, though.
> Cryptomator
Much security is poorly implemented; you can't count on it being effective. Even Apple, which takes security very seriously and has world-class talent and enormous resources, fails to implement security effectively sometimes (as in the OP). Can Cryptomator do better? Find the most respected - by professionals - security solution you can.
And on a device with many other functions - all the things you use your phone for - you risk all sorts of security holes in every function of app you use. And what happens to the data when your phone is backed up? Store the data on a single-purpose device.
Also, on an Internet-connected device, you make the data potentially accessible to the entire Internet. Use offline storage.
Bringing the storage device with you everywhere is asking for a mistake on your part - losing it, etc. Hide it someplace.
> or legal access
Ask a lawyer.
This is weird framing. The feature makes it harder for anyone to break into the device.
I wouldn't call it scheming though. The approach of choice to (scare quotes) ensuring continued access has traditionally been one where there is no overt coordination or communication. The ideal case is one where every engineer, pm, qa, leadership earnestly believe that they have done a good job/the correct thing... and then there is some deficiency that handily bypasses all of that, exposed publicly, without any authentication and a convenient lack of logging, or some oversight in the specification/standard everything operates against. Real world examples of this include backends to vehicle telemetry/connectivity apps that hand over complete driving histories with the right ip, json and a vin, or flock somehow deploying ~nationwide with a static password and no append only logging in each device. They're flagrant violations of best practices, without conseqeuences or liability.
That's one of the more incredible things about LLMs, the rate at which they are finding these needles in haystacks is only going to accelerate. It's the end of an era. These things were never used for what they should have been, I struggle to imagine a legitimate argument in favor for them that isn't carrying water for the wrong team.
That aside, it doesn't change their extensive history of ensnaring and enabling mentally deficient young men to incriminate themselves.
You could attempt to argue that anyone they can do that to is inherently a risk or threat because any other group could have done the same, but at the same time this approach broke containment and is being directed at a markedly more pale demographic, ie https://en.wikipedia.org/wiki/The_Base_(neo-Nazi_group), with seemingly no counterplay
This goes to show for all the people that want GrapheneOS to implement a feature like hidden profiles–flawed features give people a false sense of security and should not be implemented (that's not to mention deniability may not even be a good feature if it was technically possible to implement it well).
Me:
>What about a duress timer working as the reboot timer but it wipes if you don't unlock within the time period. Would that have any advantages for destruction of evidence or deniability?
HybridStatAnim8:
>That would not be viable because the hardware does not support it. It cannot be implemented in the OS because the OS can be turned off or exploited endlessly. For GOS to consider it, it would likely need to be backed by the secure element.
>Duress PIN is deemed acceptable to implement in the OS because it is expected that the user is the one to enter it, so it has not fallen into the hands of attackers who may bypass it. Once attackers have it, you are effectively gambling. Account for that in your threat model and do not let it get to that point.
>Even if that device doesn't have the ability to turn on Airplane Mode or to turn off the transmitters through the Control Center of iOS.
IIRC, the default on iOS is that anyone with your locked device can enable airplane mode which is concerning simply for thieves. But I suppose they have to use faraday bags anyway because of the Find My network.
edit: having personally gone through this kind of mess, the correct solution is to use strict typing to make sure you keep track of the difference between times and durations and the difference between different clock types. Don’t use plain integers and also don’t try to fudge it the way that Go’s standard library solution does. The modern C++ library is actually pretty good, although you need to use very recent versions of the standard for full functionality.
https://naehrdine.blogspot.com/2024/11/reverse-engineering-i...
Tl,dr: it's likely baked into the sep, no ntp
I'm wondering if you put the phone into a mode where it thinks it's dialing emergency services or contacting them via crash detection etc that it won't reboot. I could picture a scenario where the code is written to never disrupt an emergency services call.
Full disclosure I don't own an iPhone so this may not even be a thing. Just guessing based on liability risk from Apple of "what's more important than protecting the phone"
Even then, who enforces the court order? :/
Here's a renewal of one, presumably basic, license:
https://bidbanana.thebidlab.com/contract/4jKIvKMvZdoWo3d6K6q...
The product is not publicly available, and is sold only B2G: https://www.magnetforensics.com/products/magnet-graykey/#par...
This entire lawsuit was bizarre, and weirdly mishandled by Apple. It suggests to me that Apple was threatened, either by US spying agencies, NSO Group or NSO's local jurisdiction.
It is not possible to actually own an Apple device.
It will do whatever Apple wants it to do, or whatever anyone that pays them enough wants it to do.
> given that oftentimes they can’t immediately try to break into iPhones that have been seized. That could be because police are still waiting for a court authorization to do so
> GrayKey Preserve and Evidence Preservation Mode are also designed to combat another iPhone feature that automatically deletes certain data — such as cached locations, and recently deleted photos and iMessages — after a certain number of days. “We're gonna be able to preserve that data for an infinite amount of time.”
> “That AFU state is captured,” by GrayKey Preserve and Evidence Preservation Mode, the employee says. “Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost. This is the true magic behind the GrayKey Preserve and the Evidence Preservation Mode function.”
The power loss tolerance in particular looks iffy. The photo and iMessage bits are a bit more problematic in that light. I get that they claim the police aren't seeing the data but if they are extracting before a warrant that is effectivly the same as pre searching everyone and promising not to read it.
Oh, like how bulk internet monitoring works. Ugh.
Also, as someone who was the victim of a pretty awful violent crime I'm here to tell you that police are not the enemy. There are some really bad people out there, trust me.. if you ever met one you would probably be okay with cops violating their privacy.
It becomes "well we need to scan websites to make sure there's no X, Y, or Z, and prosecute the site operators who don't cooperate" real fast.
You are on the wrong website buddy. The group think here doesn't like statements like these.
The only difference is that a random asshole on the street can't really do anything to me, I can just walk away.
A random asshole cop has a crazy amount of discretionary power over me, even without him stepping outside departmental procedures or the law.
https://www.prisonpolicy.org/blog/2026/01/26/police_miscondu...
https://www.prisonpolicy.org/blog/2020/06/05/policekillings/
https://www.policedatainitiative.org/datasets/
https://policecrime.bgsu.edu/Home/Crimes
https://ij.org/the-ij-database-of-alpr-abuse/
https://ndi.iadlest.org/home
"And some, I assume, are good people."