You can just take a picture of a pile of dice, a pile of rice, or a tree, patch of grass, etc, and compute a secure hash/whatever and base six it to get the rolls.

This seems specific to GrapheneOS (unique as far as I know though I'd be happy to learn otherwise) where you could set a very long first unlock passphrase and have a shorter less cumbersome fingerprint plus pin option for subsequent unlocks. I wouldn't want to have to enter a long passphrase every time I unlock but once a day isn't so bad.

Yes, in fact on GrapheneOS it's less necessary and it's only necessary if you don't want to rely on the secure element rate limiting.

GrapheneOS allows using a passphrase with more convenience because of the fingerprint plus second factor pin (I don't think you can just have a pin as a secondary unlock). You don't need to enter the passphrase every time you unlock with this setup, only when first starting up.

The official opinion: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

So like you connect it to your computer for the first time and it shuts off?

> Shut down the phone in areas with a high snatch risk.

Yes this is of course safer. What evidence do you have that it doesn't work on GrapheneOS, though?

https://www.computerweekly.com/feature/Journalist-Richard-Me...

To add an extra layer of safety. Bring a secondary phone when travelling by airplanes, especially to other countries. You should also use it frequently, maybe with some side apps to make it look like it's your daily phone.

The internet exists and can transfer your data with no customs and borders, so if you are at risk of being snatched, the correct choice is to not carry a phone (or laptop, or..) at all.

Maybe in a country like the UK, but not in the US. The Fifth Amendment protects against self-incrimination.

Which covers divulging encryption keys because it is treated the same as compelling you to give up the combination to a wall safe which is testimonial and protected.

Classic $5 wrench.

Having thugs on speed dial opens a lot of doors.

So if an app installs an encrypted volume for which you don't have the password to, you go to jail? That doesn't make sense. How can they know if I have the password or not

Yeah, getting all your sensitive stuff off your phone onto a secure cloud service seems like the obvious approach here right? They can still escalate what they try to coerce you to do, but they don't have physical access to your data just by taking your phone, and you can also leave the phone with them and only lose the device if needed. In my likely scenario - innocent traveler, they aren't looking for anything specific, but I still don't want them to look through my files and photos just because I happen to travel internationally - that seems like it puts it out of reach (and out of obvious view) for now.

Exactly. Don't keep your life on your phone. We shouldn't have to take these precautions but unfortunately we do.

or a separate hard drive in a fireproof safe or something.

That’s not the full story and not really correct.

https://www.aclu.org/news/privacy-technology/can-border-agen...

You can decline but then they can seize is that right?

This is mostly FUD. I've never been asked to unlock my phone when travelling abroad.

You can buy the mandatory TSA key for your suitcase lock from eBay for a few bucks. Tools have a way of falling off the truck at the loading dock

That's not how exploits work, though. This is also the reason why backdoors in encryption and the like are never a good idea. Sure, "police" are the ones _most likely_ to use this tool (developed by a private company...) to use this exploit to break into iPhones. However, anyone who is motivated enough and/or has the resources _could_ also do it.

The past few weeks of people ripping into it have demonstrated that SE is mostly reality distortion and does not offer any unique or meaningful protection. I have no doubt the old modems had deficiencies, the new ones assuredly do too. Just a changing of the guard for however long it lasts.

I wouldn't call it scheming though. The approach of choice to (scare quotes) ensuring continued access has traditionally been one where there is no overt coordination or communication. The ideal case is one where every engineer, pm, qa, leadership earnestly believe that they have done a good job/the correct thing... and then there is some deficiency that handily bypasses all of that, exposed publicly, without any authentication and a convenient lack of logging, or some oversight in the specification/standard everything operates against. Real world examples of this include backends to vehicle telemetry/connectivity apps that hand over complete driving histories with the right ip, json and a vin, or flock somehow deploying ~nationwide with a static password and no append only logging in each device. They're flagrant violations of best practices, without conseqeuences or liability.

That's one of the more incredible things about LLMs, the rate at which they are finding these needles in haystacks is only going to accelerate. It's the end of an era. These things were never used for what they should have been, I struggle to imagine a legitimate argument in favor for them that isn't carrying water for the wrong team.

So the FBI publicly fueding with Apple over encryption is all just misdirection? I dunno about that