27
Emergency PIN with a full decoy environment - ONYX v1.5-beta (lemmy.world)
submitted 5 months ago by to c/privacy@lemmy.world
11 comments fedilink hide all child comments
 

ONYX v1.5-beta: Emergency PIN with a full decoy environment

Released v1.5-beta of ONYX, and one of the things we added is Emergency PIN support.

A secondary PIN opens a completely separate decoy environment instead of your real account. You configure what's in it — chats, avatars, display names — so it looks like a normal, lived-in account. There's no visual indicator that it's a decoy.

The use case is straightforward: situations where you're pressured into unlocking your messenger. The Emergency PIN is kept entirely separate from your main PIN and can be changed at any time.

Happy to answer questions.

all 11 comments

sorted by: hot top controversial new old
[–] 16 points 5 months ago

Decoy environments only work if a) there’s plausible deniability for having the feature enabled, b) the contents of the decoy are realistic and c) the decoy environment has a consistent timeline of activity up to the present.

If any of those isn’t true, it just provides probable cause to dig deeper.

  • permalink
  • fedilink
  • source
    •
    [–] 7 points 5 months ago (1 child)

    Definitely a cool feature but I'm happy that my threat model doesn't require having an answer to someone beating the shit out of me if I don't give them a pin 😅.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 5 points 5 months ago (7 children)

    What does the decoy env look like on disk? Is it two separate file systems/DBs that are decrypted by different pins?

    If so, a smart attacker is just going to insist you give them both pins, and keep coercing you to give up both.

    I had a decoy env for a period app I wrote, and to solve that problem I just randomly generated a new in memory DB for any failed pins. On disk, it looked like just one encrypted DB. But generating random period data is easier than chat messages. And it has its own issues, where no matter what pin you put in, you get a result, so the attacker can just keep coercing you until they get what they think is a valid result.

    Do you have any doco for how you have designed the at rest and e2e encryption?

  • permalink
  • fedilink
  • source
  • hideshow 7 child comments
    •
  • [–] [S] 4 points 5 months ago (6 children)

    Good points, but the architecture is a bit different. It's not two separate encrypted files — from the outside there's no indication there are two PINs at all. The decoy environment looks like a fully functional account: its own chats, groups, contacts, message history. The attacker doesn't know there's a second layer because nothing tells them the first layer is a decoy.

    Your approach of generating a random DB for any wrong PIN is interesting too, but it has a different problem: there's no "correct" result, any PIN "works", and a paranoid attacker can figure that out. Here the decoy environment is convincing precisely because it's a real-looking account, not a placeholder.

    On encryption: AES-256-GCM, keys derived via HKDF-SHA256 with salt. The code is fully open source on GitHub — that is the documentation. Separate security docs don't make sense for me to write right now, but if the project grows — definitely yes.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 5 months ago* (last edited 5 months ago) (5 children)

    So, 1 encrypted file, that can be decrypted with two different keys? How does that work?

    The lack of response is clear. You don't know how it actually works, because you've just been asking the robot to do it. That is unacceptable for something you are pitching as private and secure.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] [S] 1 point 5 months ago (4 children)

    No, it's not one file with two decryption keys — you've got the architecture slightly wrong. There's one storage, encrypted with AES-256-GCM. The PIN doesn't decrypt the file — it's verified at the application level. If the real PIN matches, the real environment loads. If the decoy PIN matches, the decoy environment loads with its own data, stored in the same storage under separate keys. Two layers of data in one container, not two containers with different keys.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 5 months ago (3 children)

    Where does the first decryption key come from? Does the user supply a decryption key first, and then supplies a pin? Verifying the pin at the application level means that once its decrypted, the attacker doesn't need the pin at all, they can just read the decrypted data directly.

    I'm fairly sure you are just sending these comments directly to your LLM.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] [S] 2 points 5 months ago (2 children)

    On mobile the key comes from the platform keychain — tied to device unlock, not the app. On desktop it's machine-derived. The decoy PIN threat model is coercion — someone watching you unlock. If an attacker already has filesystem access, you've got bigger problems than the PIN.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 5 months ago (1 child)

    Machine derived decryption key is basically the same as unencrypted.

    Android story is better, but you effectively hold a backdoor. You can push an update that defeats the decryption without any user interaction.

    Ideally, decryption should involve the user inputting a pin or password.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •