Thread

Cops Can Bypass iPhone's Automatic Reboot to Get into Locked Phones

287 points · 226 comments · speckx

Cider9986 · 1790869574 · focus · HN ↗
For those who don't know, automatic reboot restarts your device if you haven't unlocked it in a set amount of time. Cellebrite and other digital forensics companies are able to get into AFU devices much more often. The automatic reboot feature was first introduced by GrapheneOS and was later added to iOS and stock Pixels.
GrapheneOS's default is 18 hours and it can be set to between 10 minutes and 72 hours. iPhones and Stock pixels have it non customizable at 72 hours.
On GrapheneOS, for privacy and convenience, it's best to use a long random passphrase [1] for your primary unlock and then a fingerprint with a second factor pin as the secondary unlock. You enter the passphrase every time the device restarts.
If you're encountering someone that's going to seize your phone, try to restart/shut it down yourself so you don't have to trust the AFU protections.
[1] <a href="https://strongphrase.net" rel="nofollow">https://strongphrase.net give memorable ones which is cool.
1. 23ahGa17 · 1790870652 · focus · HN ↗
  People believed the reboot feature last time GrapheneOS was mentioned. It is of course nonsense.
  Shut down the phone in areas with a high snatch risk. That means during landing for example, because the aircraft can be boarded covertly if on the ground.
  1. stefan_ · 1790871523 · focus · HN ↗
    The internet exists and can transfer your data with no customs and borders, so if you are at risk of being snatched, the correct choice is to not carry a phone (or laptop, or..) at all.
    alkh-qrt · 1790874652 · focus · HN ↗
    If you live in the UK and travel to the US and are afraid of state actors, leaving your hardware at home seems like a bad idea, too.
    gambiting · 1790875098 · focus · HN ↗
    Despite all the nonsense that's posted about UK on the internet, British agencies do require a warrant to enter your home. TSA on the other hand does not require a court order to confiscate and mirror your device before giving it back to you.
    Edit: Just to be perfectly clear - Border Force in the UK can do the exact same thing to you once you return, British citizen or not. Leaving your device at home is still the safest choice.
    Cider9986 · 1790875230 · focus · HN ↗
    I believe it's CBP that does this, not TSA. Therefore Americans don't have to worry about it during domestic flights.
    > Despite all the nonsense that's posted about UK on the internet
    How is it nonsense? I'm not debating the warrant thing, but it's very reasonable to assume the UK has terrible protections for these sorts of things.
    <a href="https://en.wikipedia.org/wiki/Key_disclosure_law#:~:text=United%20Kingdom,edit" rel="nofollow">https://en.wikipedia.org/wiki/Key_disclosure_law#:~:text=Uni...
    <a href="https://eylenburg.github.io/countries.htm" rel="nofollow">https://eylenburg.github.io/countries.htm
    gambiting · 1790876663 · focus · HN ↗
    I mean in a broad sense if you read any news about the UK it might looks like a dystopian surveillance state where you get arrested for criticising the king(I kid you not - I've had multiple American coworkers ask me if this is true).
    And yes, UK has some awful laws around this. Yes it has put people in jail just for planning a protest before. Yes you can go to jail for not disclosing your passwords. But what you read on the internet is almost laughably out of proportion - no, you won't get arrested for posting a meme about the king.
    nostrademons · 1790880844 · focus · HN ↗
    FWIW the same applies to flying in the U.S. as long as you're not a person that the government cares about. I haven't had any issues with either TSA or CBP since 2011 (when, apparently, being multiracial with facial hair made me look Middle-Eastern and looking Middle-Eastern is a cardinal sin at U.S. ports of entry). Neither has anyone I've observed at the airport, and that's thousands of people per flight, and I fly about 3-4 times per year. There's plenty of stories on the Internet, and I don't doubt the stories are true, but the Internet can easily make a 1-in-a-million occurrence happen every day (indeed, given the sheer numbers, a 1 in a million occurrence does happen every day, it's just that it's unlikely to happen to you).

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.