Learn · drills
These drills reproduce real situations and walk you, choice by choice, through a real onsecret procedure. Each branch states honestly what it protects — and what it does not. No JavaScript required.
Drill · field
A border checkpoint is where your phone’s "at rest" protection matters most. Walk the branches: each choice states honestly what it protects — and what it does not.
Procedure taughtPrepare an onsecret device before a checkpoint: short auto-reboot, at-rest encryption, duress PIN, a Tails key for the laptop.
Open the drillDrill · coercion
The duress PIN is powerful and irreversible. This drill reproduces pitfall #1 from the hardening sheet, then asks the hard question honestly: should you really use it?
Procedure taughtSet the duress PIN correctly (Settings → Security → Device unlock → Duress password) — and understand when it helps and when it hurts.
Open the drillDrill · loss
Your phone is gone. The first move is not panic: it is to understand which protections already act on their own, and what Find My Device can — and cannot — do.
Procedure taughtWalk the real "Loss or theft" flow from the client sheet: at-rest encryption, auto-reboot, then self-hosted Find My Device (locate / wipe "best-effort").
Open the drillDrill · delivery
How do you know the phone you received is exactly the one described? Trust is verified, not bought. Walk the checks — each is reproducible by you.
Procedure taughtVerify a received device is the one onsecret prepared: re-locked bootloader, GrapheneOS attestation, expected apps, matching client sheet.
Open the drillThese drills are educational and do not constitute legal advice. They are grounded in the real onsecret provisioning procedures and in GrapheneOS upstream documentation.