Simple anti-theft app request

[_wb_]

Most theft does not happen by mugging but by taking items left abandoned somewhere. Most lost items don't occur by theft but by simply losing it somewhere. Often these lost and found items end up somewhere (e.g. the police if the finder is friendly) and it stays there because they cannot figure out who it belongs to, and you cannot figure out who found it. Adding a physical name/address label to your Pandora is probably a good idea. If you can make it non-removable it will also help in the case of actual theft.


Hightech solutions to try to prevent theft typically don't work - a typical thief will just take out the battery to be safe (he'll probably assume the device is some kind of blackberry and might be traceable) and try to sell the thing.

 

[Rockthesmurf]

Perhaps leave a note that says "If you return my Pandora, I will buy you the 3DS you probably intended to steal in the first place"


Steve

 

[Grench]

If someone who knows about Pandoras steals your Pandora - it's gone. They'll know how to reset/bypass pretty well on anything you can do.


However, most people will not know details about it.


What I would like to see is a simple 'locked' screen that requires the user to enter their password when opened. If it could also display a user configurable short message - something along the lines of: "If found, please call 123-456-7890"


I would like it to go into this 'locked screen mode' as configured by:


1. lid switch = closed


2. standby activated


3. inactivity timer


4. hot key set


The Pandora is the only computer that requires login that I have ever seen that -can't- lock the desktop with the user still logged in.


On the startbar/actionpannel there is an option to "Add New Items..."


Select, "Action Buttons" - Add.


Select action type, "Lock Screen" - Close.


You now have an icon of a lock in your action bar - that does absolutely nothing.

 

[Binky]

Possibly have the lock screen display a README file?

This device belongs to Joseph Bloggs

If found please call 01234 567890

or eMail j.bloggs@domainname.co.uk

£50 Reward for safe return

 

[Grench]

Possibly have the lock screen display a README file?

This device belongs to Joseph Bloggs

If found please call 01234 567890

or eMail j.bloggs@domainname.co.uk

£50 Reward for safe return

Or even having the opportunity to have a locked screen saver floating that text about.


The big catch is that I've yet to find any way to actually 'lock' the screen on a Pandora short of logging off or powering down.

 

[_wb_]

Sounds like a bug. Who is maintaining those xfce panel applets?

 

[TrashyMG]

Well all security measures can be wiped clean by powering down and re flashing the firmware.. Added security measures would need to happen at the boot manager level.

 

[Grench]

Well all security measures can be wiped clean by powering down and re flashing the firmware.. Added security measures would need to happen at the boot manager level.

Not quite true. It is still possible to use encryption - it just isn't easy. That would at least protect the data. However, if you're carrying sensitive data on a hand held computer, you're already an idiot.


Still, short of encrypting your SD cards and having to deal with a password or USB key or bluetooth proximity token to unlock them, there isn't much to be done about it -IF- the other person is knowledgeable and determined to clear the hardware for their own use.


On physical security: Locks keep the honest people honest. The best you can hope for is that your device is 'found' instead of 'stolen'. If 'found' it's best to have a lock to prevent the 'finder' from 'accidentally using' your device. Having simple instructions to tell the finder how to find you without going through a middle man of unknown motivations (lost and found agent) is even better.


So - we really could use a session locking screen saver that can populate text to the screen and a password/login prompt.


I'm afraid anything beyond that is a bit of a waste of time if you're not transporting information that should never have been on a mobile platform to begin with.


It would be nice, though, if we could get a screensaver/lock&login system working.


If someone wants to go a bit nuts and make a 'pandoraperfect' login application...


We have analog nubs.


Divide each nub into:


1 Up


2 Up-Rt


3 Rt


4 Dn-Rt


5 Dn


6 Dn-Lt


7 Lt


8 Up-Lt


That is 8 easily identifiable 'zones' that the user can push a nub in reliably. However, since these are analog nubs, they don't have to go 'all the way'. They can easily be pushed to a portion of each zone that is something more than not moved and something less than full-on.


So, the possible combinations, using two nubs and partial push and two trigger buttons on/off become:


16 left nub


16 right nub


2 left trigger positions


2 right trigger positions


16*16*2*2 = 1,024 possible combinations per iteration. If you know your own 'combination' you should be able to position the nubs & buttons to your setting fairly close to instantly.


If you require a two combination 'lock' where the first 'right' combination has to be followed by a 2nd 'right' combination within 3 seconds yields 1024 squared = 1,048,576 combinations. The user should be able to do that inside of a half-second - it's just two hand positions.


Do three code combinations (silly on a portable device) and there is a 1:1,073,741,824 chance per try for someone to 'crack' it.


All without needing to use the keyboard.

 

[TrashyMG]

Okay that's good and all, but what's stopping me from shutting it down, power up the Pandora to the boot manager and reflash the firmware to clear the current passwords and such.

 

[Grench]

Okay that's good and all, but what's stopping me from shutting it down, power up the Pandora to the boot manager and reflash the firmware to clear the current passwords and such.

On physical security: Locks keep the honest people honest. The best you can hope for is that your device is 'found' instead of 'stolen'. If 'found' it's best to have a lock to prevent the 'finder' from 'accidentally using' your device. Having simple instructions to tell the finder how to find you without going through a middle man of unknown motivations (lost and found agent) is even better.

 

[TrashyMG]

^ As someone that designs code around security I always think of the worst case scenarios.


Well not entirely sure how hard it would be to implement this, but since the boot loader seems that it can be customized in some manner, it's may be possible to implement a password lockout at the firmware level to prevent unauthorized bootup and re-flashing. Only downside is what if a legit owner forgets their firmware password.

 

[Grench]

^ I don't think that is going to matter in the end.


Protecting the device from being able to be re-sold doesn't get it back to you - it just puts it in a land fill.


If someone steals it - it's gone.


If someone finds it - a simple login password screen with instructions on how to get it back to you could go a very long ways toward a favorable outcome.


Keep your data backed up. The Pandora and physical media are replaceable, albeit expensive. If you don't have your data (games, saves, music, pictures, etc...) backed up - then you're talking about real loss.


Password protecting the boot loader would violate one of the Pandora's principles: A device that can not be bricked.


Although I can not think of anything that would have to be, if someone -must- carry sensitive information on their Pandora, then they need to learn how to encrypt it. Securing the bootloader would only make the device worthless. Pop out the data card and they potentially have open access to what could be the more valuable bit.


A lock/login screen that can present the contents of a simple text file would go a -long- way towards getting a device back if it were to leave the owner's hands.


Being able to set the unit to open up to that would make it function.


Making it so that simple nub gestures 'log in' would encourage the use of stronger passwords.

 

[TrashyMG]

Oh I agree with you on your points. I just was mentioning on a way to really lock up a device. I'm evil like that.


But having a mechanism like this doesn't necessarily mean bricking the device.. I believe if it's like the beagleboard you can directly access firmware via serial connection.. this could be done via the EXT connector and could be used to unlock the device..

 

[Grench]

Doesn't that just raise the tech bar a bit and still base security on obscurity?

 

[TrashyMG]

Indeed it does.