We come around a lot of people running Duress / device erasure killswitch apps like Wasted or an MDM solution to try and protect their device from seizure. They don't work.

A duress app can have the erasure process cancelled by holding down the volume button to move to Fastboot mode. This cancels the erasure, and worse, the reboot performed is a warm reboot meaning that sensitive data like device credentials remain in memory.

When we reported vulnerabilities used in forensic companies targeting Pixels, the evidence acquired was a video they used marketing their bypass of erasure apps. This company in particular advertises cold boot attacks, dumping RAM to brute force the credentials. This meant for people relying on those apps outside of GrapheneOS, they weren't just bypassed - their credentials would have been brute forced if not good enough.

Many scammers selling 'secure' mobile devices which are just phones running other operating systems with an MDM app on it for 'remote erasure' or duress features mislead customers. Their methods are not foolproof. They are the same level as EncroChat or ANOM.

GrapheneOS have been developing a duress PIN feature that works without an unsafe reboot, the reason it's took time because it had to be done with a new, unique method and not relying on insecure implementations like other apps or operating systems. It is in testing. We also have been suggesting fixes to these other problems by anti-reset attack mechanisms like zeroing sensitive memory or making MDM reboots safe.