I’d pay for a decoy PIN and profile on my Android phone, and I’m not alone

A few days ago, my colleague Calvin shared an interesting fact about GrapheneOS: The custom ROM allows him to set a duress PIN that completely erases the phone when he enters it, including encryption keys and the eSIM partition. It’s a very drastic privacy measure that lets anyone protect their data if they’re being forced to hand over or unlock their phone when they don’t want to do it.

I love that the feature exists for those who think they might need it, even if it’s through a custom ROM, but as many commenters pointed out on Calvin’s article, this is too drastic for most of us. Instead, what several commenters and I would like is more akin to a decoy PIN that opens a sandboxed version of my profile. And I’m not alone. Several of you want exactly that and would even pay for it.

Another option would be to make multiple users on Android accessible from the same PIN unlock screen, and we’d be golden. I’m surprised this feature isn’t yet a part of Android, especially when it could benefit everyone, not just privacy freaks, including families that share a tablet at home.

Even though I’m fascinated by the idea of setting up a kill switch on my phone, I think it’s an extreme measure that very few, if any, people will ever need or use. It’s an overkill solution that leaves room for potential forgetfulness and misuse. If you choose a strong PIN, you might forget about it the very moment you need it. If you choose a weak PIN, like 0000 or 1234, you’ll risk someone (a kid, most likely) wiping your phone and data by mistake if they pick up your phone and try to guess your code. Someone suggested choosing a decoy PIN that differs by one number from their primary PIN, but I think that’s even worse. One finger slip and my data is poof, gone. Better never use my phone with oily or sweaty fingers!

What also worries me about duress PINs is that they might trigger violence on the side of the person forcing me to unlock my phone. Who knows what they might do when they realize I erased everything?

A decoy PIN would behave a bit differently. Instead of erasing my phone, it would either unlock a sandboxed version of my profile with all crucial apps (banking, files, photos) hidden, or it would unlock under a different user and keep my primary account and data hidden and encrypted. For the former, Google would need to figure out how to privately and effectively sandbox parts of the OS, which may not be the easiest option. For the latter, it would be on the (very invested and tech literate) user to choose whether they want to do the work to create a separate profile and believable account.

Personally, I imagine setting this up with a relatively unused Google account, and keeping a few apps and bits of data there with no real value. If I’m ever forced to unlock my phone, I could enter this decoy PIN, open a decoy profile, and let them explore that. No reason for them to suspect that I’m hiding something or that I’ve erased data and evidence.

Look, I know that, technically, in the case of police investigations or targeted assault from violent criminals, no duress PIN or decoy PIN can guarantee that you’ll come out unscathed or that your data won’t be obtained in some other manner. But most of us are normal people who live boring old lives. There’s no logical reason we should be afraid of these situations. What worries me, personally, is more on the scale of petty modern thieves who might demand access to my financial apps. And in those cases, keeping the banking and money apps away under a main profile while the decoy profile houses nothing of the sort seems like a good level of protection to me, without going too far in the cloak-and-dagger mentality.

I liken it a bit to using a duress code on my alarm system. Instead of triggering the sirens around the house, entering this secondary code disarms the system but sends a silent notification to my emergency contacts saying that I was forced to disarm. It’s an invisible security measure and doesn’t stress out the aggressor, which is what I like about it. Some countries even impose this in their alarm system regulations.

Android already supports multiple users and profiles. You can set them up under Settings > System > Users and have multiple people (or your own multiple accounts) access their apps, files, photos, and data separately.

But the current system is still very basic. If I pick up my phone now, I first need to check which user is selected before I enter the PIN. If I enter my secondary PIN on my main user profile, I get an error. I don’t know why Android can’t be smart enough, like any keypad or biometric entry system in this vast universe, to understand that different PINs, fingerprints, or faces unlock different users with different privileges, without the need to manually switch users beforehand.

That would be the basis of a decoy PIN-profile setup, but it would also make Android more user-friendly for families or couples who share one tablet with multiple users. No need to teach little Lucas that he has to turn on the screen, drop the notification shade, tap the user switcher, pick his name, and then enter his PIN so he can play Minecraft on the family tablet. Just turn on the screen and enter his PIN, and Android would know exactly which profile to unlock.

There are other minor changes that would need to happen on Android to make this more compatible with a decoy PIN-profile situation. For instance, no big user-switching animation (see photo above) that shows exactly what is happening. The whole idea is to hide the subterfuge, not advertise it on the entire display. We’d also need an option to hide the user account picker at least in the most visible parts of the UI, like the drop-down notification shade. That’s, uh, the exact opposite of what Google has done with the very visible, very obvious multi-user widget.

Regardless, most of the work is already done in Android. There is native support for multiple users, and the encryption is strong enough to keep them separate. All we need is a few nips and tucks, and those of us who want to could start using multiple users to create a decoy profile. I hope Google makes those changes soon, or, if it really wants to create a tighter privacy sandbox, I hope it does the work to let us sequester parts of the OS under duress while pretending to unlock the whole system. Either way, there’s too much of our personal data in our phones today, and having to resort to custom ROMs to properly protect it is not a real solution.