x13a / wasted

Lock and wipe on emergency

Wasted

Lock a device and wipe its data on emergency.

You can use PanicKit, tile, shortcut or send a message with a secret code. On trigger, using Device Administration API, it locks a device and optionally runs wipe (factory reset). Or it can send a broadcast message instead of the wipe.

Also you can:

• fire when a device was not unlocked for X time
• fire when a USB data connection is made while a device is locked
• fire when a fake messenger app is launched
• fire when a duress password is entered (companion app: Duress)

The app works in Work Profile too, but with limitations. Use it to install risky apps and Wasted in it. Then you can wipe this profile data with one click without wiping the whole device.

For base security take a look at: Sentry.
Only encrypted device may guarantee that the data will not be recoverable.

Be aware that the app does not work in safe mode.

Broadcast

• action: me.lucky.wasted.action.TRIGGER
• receiver: me.lucky.wasted/.TriggerReceiver
• also you have to send a secret code from Wasted with the key: code

Permissions

• DEVICE_ADMIN - lock and optionally wipe a device
• FOREGROUND_SERVICE - receive lock and USB state events
• RECEIVE_BOOT_COMPLETED - persist lock job and foreground service across reboots

Localization

License

wasted's Issues

Possible to remove incorrect password wipe warning?

Hi,
I just wanted to know if it were possible to remove the incorrect password wipe feature WARNING on the lock screen?

possibility to copy/paste the auth code

Thanks a lot for your three applications (Sentry / Wasted & Duress) they all work great together.

Could you give us the possibility to copy/paste the auth code or customize it?

Because when we configure it in duress or in a trigger or a notification we have to reread it several times to be sure not to make a mistake.

tile delay in ms

remove sec prefs

Days, delete

How to set count of days to wipe for inactivity?

make app a PanicKit Responder for device-wide panic responses

Sounds like a nice app to have, lots of people have asked for such a thing. It would be nice if it could triggered in conjunction with other apps. PanicKit has the concept of "trigger" and "responder" app, so one panic button trigger can cause many apps to do something. This app sounds like the perfect case for a panic responder. You can find docs, example code, and more here:
https://guardianproject.info/code/panickit/

Authentication

Hi, after installing i start up the app. And it asks for a authentication code. But i don’t have one.
i can’t acces the app unfortunately. What would be the solution for this?

kind regards

fake icon - small buble only when you use lock

When we click on Lock it adds a small bubble in the icons.

Otherwise the icons are perfectly normal.

This trick is diabolical, thank you

sorry for the quality of the pictures the camera is not good

Wipe after not unlocking for N time not working?

I feel dumb posting this as an issue but I don't know where else to ask this, the documentation (incl. closed issues) isn't helping a smoothbrain like me.

This app is exactly what I need (or well, at least the function from my title) but it doesn't seem to work for me. I installed it on my drawer nokia 6.1 w/ android 10 to test it. Ticked the 'wipe data' checkbox, set the time to wipe 10m, tapped the v next to that, turned the app 'on' and enabled it as a system administrator. Put my phone to sleep and waited, but nothing happened after 10 minutes. Using a tile seems to set it off instantly, instead of waiting until it hasn't been unlocked for 10m. I've no idea what I'm doing honestly.

FLAG_SECURE

option to delete selected apps only

if there could be a toggle that instead of wiping the device or profile, only selected apps will be deleted (like messengers or password managers, etc). Kind of like DueProcess

Wasted in Shelter

Pixel 6, GrapheneOS.
Duress installed in main profile, Wasted installed in Work profile via Shelter.
All codes correctly entered, Duress passes it's test at the lockscreen.
Wasted however cannot seem to communicate with Duress. It won't insert a tile either.
I've double checked permissions, all are enabled in 'Device Admin', Duress is enabled under accessibility.
Both broadcast and Tile are selected in wasted.

I'm at a loss on how to get this to work.

ProtonAOSP / Andorid 12 - Notification not working

Hi! I tried this app on ProtonAOSP, based on Android 12 (https://protonaosp.org) with no luck.

Tiles - there are no extra tiles after app installation. I see Podcast Addict tile, Cryptocam, but not Wasted one:

Shortcut - there are no shortcuts in app's context menu either. Once again, Protonmail has one for a some reason, Wasted - no:

Notifications - Wasted should be able to read all notifications, but still nothing happens when I send auth code in Telegram.

Broadcast - not sure, can't really check if it works. I installed Duress app, configured it as decribed here x13a/Duress#1 (comment) ... but I don't want to wipe my device ATM, and there's no extra ways to see if it really works. Like I'm entering duress code on lock screen, and the only action sould be device lock, but I'm already on the lock screen, so it's unclear if Wasted worked in this case.

(And I see no way to copy auth code to clipboard, but It was mentioned in #15. Long press to refresh code, short - to configure triggers, so again I'm not sure if there's a problem with my OS, or it copying was not implemented)

Please tell me if I can help to debug this. Thanks :)

---

Feature request: it would be nice to have some kind of armed/disarmed switch, "dry-run" mode to ensure if Wasted is configured properly and ready to nuke everything, you haven't mistyped the auth code, notifications and all stuff are working properly etc. Wasted in "disarmed" state should still listen for triggers, but instead of wiping everything it should say "I hear you, BOOM!" :)

Wipe if the user remove autorisation Device Administration

Thanks for these changes and especially for Duress with a specific password. This is absolutely great

on the other hand would it be possible to find a solution to prevent a user to remove the right on the application? If you remove the right it will wipe the phone.

I know it's a bit hard, but we're in a situation where the phone is unlocked and the fake icons are activated (signal etc) but the attacker knows the trick, he just goes in the settings and uninstalls the application or removes the rights. To prevent him from uninstalling the application we can force him by making our own rom.

But if we remove the right of device administration it will wipe the phone.

I found an old conversation on the subject:

https://stackoverflow.com/questions/9298364/how-to-wipe-android-device-when-device-admin-is-deactivated

Fake Icons

thanks for all these changes, the interface is much clearer and everything seems to work wonderfully (except for lock I redo a post)

An idea like this, would it be possible to have a fake set of popular app icons for the shortcut tab:

• Whatsapp
• Signal (Signal.org)
• Session (getsession.org)
• Threema (threema.ch)
• Molly (Molly.im)
• Facebook
• Facebook Messenger

Wipe On Inactivity

On grapheneos

When I set up a time in minutes or hours and change my profile.
nb: it also happens to me in random ways on a phone under grapheneos which has no profile. I just disconnect and when I come back it sets the default value 7D

Ex : 30 mn

I switch to a user profile, I disconnect after 35 minutes from the user profile, I reconnect to the Owner Profile.

I reopen Wasted and the default time is back to 7D.

So it didn't Wipe
On grapheneos

When I set up a time in minutes or hours and change my profile.

Ex : 30 mn

I switch to a user profile, I disconnect after 35 minutes from the user profile, I reconnect to the Owner Profile.

I reopen Wasted and the default time is back to 7D.

So it didn't Wipe

Documentation

Hi,

Wasted seems to be a very interesting application, but it is very hard for a newcomer to understand what it is about.
Reading and reading again the "in-app" text which is presented with each option does not suffice (for me) to understand the scope of the action/parameter.

TO start with, I would like to know whether the following is true :
**
If I send the code in red to the device, then the device will be locked.
If I send it again, then the device will be unlocked
**

If that is true, I recommend this to appear in README.md
Obviously, wiping cannot be reversed. But locking ? Frankly, at this stage, I do not even know that.
Of course, many other things are missing in the documentation for me to understand what each option is about. But this would be a good start already for newbies.

Remote wipe

Hi, remote wipe os possible with SMS, but also with messemgers like Signal and Whatsapp. Does this mean the app can read all my signal/whatsapp messages? Device_admin is a powerfull permission. Is there no other way to do this ? Are u as a developer active on some matrix rooms so i can ask questions, i really like the app i just dont like the fact it can snoop on my messengers.

deletion in case of internet cut for X hours

Is it possible to delete the phone if it can not connect to the internet for more than X hours / days?

Ex: you can leave your phone without activity for 2 days.

But if we have no internet connection (ping or other) it is that there is a problem.

The ideal would be to be able to customize a URL where we can hide a small text file and if inside there is no Wasted code, it erases the phone after X hours.

And if you think about working with Profiles. You can work for X days with a profile without ever logging in to the Profile Owner.

So if I work in a guest profile, Wasted will legitimately think that I haven't logged in for X days and will delete my phone.

On the other hand, without internet it can be considered as a real inactivity.

Ins manual for Wasted configuration

Hello Guys,
We are a group of friends interested to use the app, but we are having problems with the functions.
Is there anywhere an instructions manual how to use the app? Some specs are too complicated for the normal user.

1. Can we get some explanations on the following: Tile function and tile time delay. How does the function work? the safe delay is represented as 0.5, 1.0, 1.5 ...- these are minutes or its half hour and hour etc? How can a wipe be canceled in the safe delay time period?

2. Panic Kit- desc reads "collection of tools for creating panic buttons"...- This explains all, but where do we configure the panic buttons and reactions?

3. On the main screen what are the color representations? Sometimes the sec code is yellow sometimes its red?
   Do "wipe data" checkbox has to be checked and toggle button at the bottom ON in order for the settings config to fire or its a function to wipe it momentarily if switched to on?

4. What is the Shortcut option? - desc reads "It is a button you will see when you make a long tap". The button fires or what is the point of it?

Recast is also way too difficult to understand for the normal everyday user.

I think the idea behind the app is amazing, and it's also great that someone bothered to create it, we just might use a little manual so it could be used by widespread public.
Thanks

Key file in usb key prevents accidental phone deletion

My idea is focused on usb port surveillance (which already exists) but with the possibility, by placing a (same) key file in Wasted and in the usb key, to prevent unintentional deletions due to human error.
Key files can be added in Wasted, if it finds them in external devices, it does not "fire."

Wipe a device when it was not unlocked for ???? days

Hi, I could not find an option to see/change how many days to wipe if the device has not been unlocked in "n" days.

So I looked at the source code and apparently it is in 7 days, for me 7 days is great, I just do not want to end up losing my data by not knowing how many days I can stay without unlocking my device :)

Best regards.

samsung wasted trigger by notification

Hello, using samsung device, giving all rights it asks, including notification access, it does not trigger when code is send using threema, signal or session, I check marked all 3, and tested all 3,
is there a particular reason for that ?
It cannot work on samsung ?
USB trigger does work,
I hope someone can help me with this, I tried many things.

controller

I would like Wasted to accept remote commands from SimpleX (simplex.chat) after successfully establishing a previous contact connection with it (see one-time link).

The commands that can be given remotely should be:

• perform a complete wipe after time based events
• perform a complete wipe after X wrong pin attempts
• lock/unlock the device
• do not accept unlock codes locally until I send the unlock code remotely (unless you enter the recovery passphrase)
• change the lock/unlock pin
• wipe esim
• turn on/off 110db siren
• send gps position once
• send gps position every X minutes
• turn on/off flashlight
• turn on/off vibration

https://github.com/simplex-chat/simplex-chat

https://simplex.chat/

simplex-chat/simplex-chat#1065

fix short description

Improvement idea

Improvement idea:

• Have the possibility to know the version number (ex on f-droid the app is in error when we download it because the apk is not available anymore), and i dont know if the version on playstore it's latest.

• Be able to have a finer granularity on the N Days parameter and go down to the hour.

(e.g. have time slots, from 21h to 06h = N Hours & from 06 to 21h = N Hours)

• Have the possibility of N Hours / Days based on a wifi.
  If the smartphone does not connect to a wifi X, then after N Hours, it wipes the phone.
  When a state attacker takes a phone, he puts it in the wifi airplane, and even if he doesn't, we can assume that the phone will be far away from the wifi where people usually work.

• Have the possibility to have a panic password to wipe the phone directly.

• N.B.: Unfortunately, I think that for this idea, you need a screenlocker like datawipe: http://safetyapps.zone/datawipe.html

• N:B: The screenlocker comes after the normal locker or the fingerprint unlocking.

new fist icon

Some strange site having its logo very similar to the Wasted icon. Cause it is public fist from wikipedia, it is the time to look for a new one.

sim trigger

BFU

The tile function doesn't seem to trigger on a reboot, or shutting the phone down and starting it up again. (Might be a limitation that we are okay with after all)
Would like to propose the following features as well:

• Possible to set a custom string for broadcast?
• Possible to copy the broadcast string within the app?

USBKill

Under GrapheneOS

It works perfectly, even on the first boot before unlocking.

On the other hand I have noticed and I do not know if it can be fixed.

If at startup a USB cable is connected, then wasted does nothing because I think it detects a USB connection before wasted. So it doesn't wipe, but anyway we can't attack the phone like that.

So it's not a big deal, it's just for information
you can close it, i just write this for the records

Super app

Hello. The app is getting better and better. But I could not deal with the broadcast message. Sending myself a text message. Send messages via messenger. So it didn't work.
Please tell me how to use broadcast message.

GrapheneOS / Android 12 - Notification

When I use wasted on grapheneos and I send the famous code in an application that displays notifications, nothing happens and the phone does not wipe.

On the other hand, all the other functions, with duress, airplane mode etc. work perfectly.

Is it not necessary to add a request for authorization so that Wasted is the right to read the notifications?

wipe on inactivity custom time

Lock - Wipe for inactivity

I tried 1m / 5m
I activated the tab but it doesn't wipe the phone automatically
nb : before the update it worked perfectly

Sentry Notification

I am getting this notification when I turn on "wipe on inactivity" feature.Any idea why am I getting this and How can I fix this?

Don't work on 9 android

Got a problem, on android 9 app dont show a part where you can choose number off wrong attempts before erase.

fake icon - grapheneos

when I click on the fake icons it launches Wasted. So nothing happens. It's like a shortcut for wasted

Trigger with turbo charger 33W on Xiaomi

Tested on Xiaomi POCO M5s and Redmi Note 10S MIUI 13
when connecting the charger with the screen locked

schedule lock trigger on reboot and power off

Does it work when the phone is dead?

Say I have the app set to wipe after 2 days of not being unlocked and the phone has been dead for over 2 days and I charge the phone and start it, will it still wipe or does it not count the time it was dead?

I know this doesn't really belong here but since there is no discussion section I don't know where else to post it.

Allow fake app customization

A few ideas on improving the fake app feature.

1. Allow customization of name and icon . I live in China and we do not use Telegram or the other three apps. And I know they use other messengers in Korea or Japan or India. So it would be great to allow users to set the icon and name.
2. If its possible to add a fake notification bubble on the fake app icon. Wouldn't it be far more convincing?

Trigger with Tasker

How do you trigger wasted with a Tasker intent?

Improve Readme

First things, love the app and have tested it on Lineage OS (Android 11) on Samsung A5, works perfectly, at least coupled with PanicKit and Tiles.

But a couple of things I feel should be added to the ReadeMe.
What each option "Tiles, Notification,PanicKit" does and what else the user needs to do to enable it.
For example I had no idea what "Tiles" was until I read another Issue on this github where someone asked and you very helpfully answered.
I've yet to understand what Broadcast does, though I managed to muddle my way through the rest on my own.

I think the improvement should be easy and increase the user experience by a lot.

Thanks again

[Feature Request] Add option to hard brick device

Would it be possible to hard brick a device so that thieves cannot longer profit economically from selling it ?

I was stolen and the idea of some petty thieves selling my cellphone made me wonder if it would be possible a hard brick or at least a soft brick. In such a way, the value of the stolen cellphone would be zero.

Thanks for your great work !

Question: How does the app handle Android Profiles?

On Android there can be multiple user profiles. Does the app wipe everything, or is it restricted to the user profile it is running in? I guess it can only wipe that profile, due to sandboxing.

USB port trigger delayed wiping

I tried to figure out which protection scheme would work best for me and realized that I need a wipe delay for those cases where I accidentally insert a usb key into my smartphone myself by forgetfulness, initiating wiping.

Therefore, I request that a delay time be inserted, expressible in seconds or minutes, in which Wasted is told how soon it must take action, allowing the wipe to be canceled by entering the correct password during the time frame in which the wipe delay is active.

There is no other way to avoid wiping the memory by mistake.

I would be fine with that. I would feel more comfortable if I had 20/seconds of time to repair a distraction error.

The app keeps crashing on trigger

I'm not sure if the just I have this problem but I'm using Wasted on a rooted 2021 Samsung Device w/ Android 11 One UI 4.0 and triggering the app multiple times using the created fake messenger apps causes a message from the android or samsung device administration app or something simillar (In german its called "Geräteverwaltung") to appear suggesting to send wasted in a deep standby because it keeps crashing. Triggering the app using ripple or smth. simillar doesnt do anything.
I might also just be stupid...

[Request] USB trigger

Thank you for all your work & dedication. Is it possible to implement:

• Duress Password Wipe
• USB extraction wipe

Not sure if these are something that might be in the works moving forward but thanks again either way.

nfc trigger?

How does it work to erase data if the device has not been unlocked for a certain number of days

Please explain how it works? How does the app count days of inactivity? A smartphone cannot work constantly, for example, 7 days with screen off. And how will the application keep and count the days after turning off and on the smartphone?