Security and codes
After a protest, you check in with a code to say you are fine, from your account or from the field phone. If someone forces you to do so, a second code does the same thing on screen, and warns your contacts.
The two codes
The normal code turns off the session's automatic sharing, nothing else. The duress code is the one to enter if someone forces you to check in: the screen reacts exactly as it does with the normal code, and protections trigger silently.
Choose two different 6-digit codes, with no obvious sequence (not 123456, not a date of birth). Learn them by heart, and do not write them down in the phone. They are set together, in Security and codes, then Save codes. The server only keeps a fingerprint of each code and accepts 5 attempts per quarter of an hour.
What the duress code triggers
- Immediate sending to contacts. Sessions from the last 48 hours are shared right away with your read-and-modify contacts.
- Lock raised to the maximum. All your sessions move to a 30-day lock, counted from the receipt of each segment. A lock that is already longer is not reduced.
- "Under duress" alert. Your read-and-modify contacts receive a red alert, with the time of the last images received.
- Display of a decoy account, only if you have enabled it (see below).
Nothing is erased. The duress code only adds protections.
Indistinguishable on screen
The server handles both codes through the same path. The response has the same form and arrives after the same delay (about one second), whether the code is normal, duress or wrong. The screen shows "Check-in recorded. Automatic sharing is disabled." in both cases.
What can give the duress code away is what happens next: your contacts are notified, and if the decoy is off, the person sees your real dashboard.
From the field phone, the duress code has the same effects, with two nuances: only the contacts ticked when the session was created receive the sharing, and the decoy does not apply. See Check-in.
The decoy account
Off by default.
When enabled, it displays, after the duress code, a plausible, almost empty dashboard with one or two innocuous sessions. Your real account remains intact, and the other protections trigger silently. From a decoy view, nothing can be changed or deleted: actions appear to succeed but have no effect.
When disabled, the duress code displays your real dashboard; the other three protections remain active.
Legal risk of active deception
Showing a decoy account to an authority is active deception. Depending on the country, it may be classed as obstruction or concealment.
In France, Article 434-15-2 of the French Criminal Code penalizes refusing to hand over to the judicial authorities the secret decryption convention of a means of cryptology that may have been used to commit a crime or an offense. Case law has accepted that a phone's unlock code can fall under this provision.
Talk to a lawyer or your legal team before enabling the decoy. This guide describes how the tool works; it is not legal advice.
The first protection remains the lock: "it's locked, I can't delete it" is a true and verifiable statement. The duress code is a second line of defense.
Automatic sharing if you do not check in
If you do not check in, it may be because you cannot. For sessions set to Reminders, then sharing, the reminders go up step by step from the end of the recording window:
| Step | What happens |
|---|---|
| End of the recording window | You check in with your code. The reminders stop there. |
| 6 h after the end | Reminder: a notification in this browser, if you have allowed it. |
| 12 h after the end | Second reminder, to your contacts: your read-and-modify contacts are asked to check on you. They see nothing more than before. |
| 24 h after the end | Sharing with contacts: sessions with no check-in are shared with your read-and-modify contacts. |
| Never | Publication. ripoux.fr publishes nothing: only your contacts receive, and they decide. |
Setting the first reminder
First reminder: how long after the recording window ends: a slider from 1 h to 24 h, in 30-minute steps, on the Security and codes page or in My account. The "?" button next to the setting sums up the steps. The following steps are derived from it (double, then quadruple). With 2 h: reminder 2 h after the end, your contacts 4 h after, sharing 8 h after.
A short delay protects you better if you are arrested, but triggers sharing more easily through simple forgetfulness. Sharing only goes to your contacts, never beyond: a false positive stays within a circle you chose.
Checking in at any step stops the reminders and sharing for all pending sessions.