7 ms·

Even if touch id, it would be of no use. TouchID requires a password after 48 hours. or after the device resets. Which is interesting. If you happen to use Tou

Even if touch id, it would be of no use. TouchID requires a password after 48 hours. or after the device resets. Which is interesting. If you happen to use TouchID, is your best bet to hope a court will not be able to compel you to unlock it within 48 hours of arrest? That sounds very probable.

ggreer 11y ago
After five failed fingerprint attempts, your password is required to unlock the phone. That seems pretty safe to me. If you're ever ordered to unlock the phone, just touch an unregistered finger to it. Fingerprint sensors aren't foolproof. It'd be hard to prove you deliberately sabotaged the effort. Though, one feature I'd like would be to register a distress fingerprint. Then I could touch say... my left index finger to require a password unlock.
- EGreg 11y ago
  As Apple says, it's not feasible to try 50,000 fingerprints since you only get 5 tries. But you can try a lot of passwords. Anyway, how does any of this prevent rubber hose cryptography?
  - superuser2 11y ago
    In this case, the part where the phone's owner is dead.
    - ethbro 11y ago
      Do dead guys not have functional fingerprints? (Yes, I really asked that. Yes, I'm really curious.)
      - superuser2 11y ago
        He had a 5C, so wouldn't help here.
      - ethbro 11y ago
        Because I was interested and no one else chirped in, the answer is "Yes, but require some additional effort to obtain due to post-mortem stiffening." For those curious, here's a Northwestern scan of an article in The Journal of Criminal Law from the 70s (thanks, internet!): http://scholarlycommons.law.northwestern.edu/cgi/viewcontent.cgi?article=5809&context=jclc http://scholarlycommons.law.northwestern.edu/cgi/viewcontent...
- gst 11y ago
  If you do this on purpose after asked to unlock your phone you will probably be charged with destruction of evidence or something like that. However, while a court is (afaik) able to ask you to put your finger on the fingerprint reader, you do not need to tell them which of the fingers the correct one is. So instead of purposely using a wrong finger, I'd ask the court to explicitly tell me which of my fingers I should use to unlock the phone.
  - savoytruffle 11y ago
    It would be a very long and involved case, anyway.
  - azernik 11y ago
    I think the court would similarly consider that obstruction and contempt. If they tell you to unlock your phone and you try to play some "first you have to guess which finger's the right one!" game, the judge will slap you with either contempt of court or refusal to comply with a subpoena.
    - gst 11y ago
      IANAL, but I don't think there's much of a difference between asking someone to reveal the correct password and asking someone to reveal the correct finger. In both cases you would be asked to incriminate yourself. If it would be lawful for a court to ask you to "unlock the phone with the correct finger" then they might as well also ask you to "unlock this harddisk with the correct keyboard keys pushed in the correct order (as a password)".
      - rhizome 11y ago
        I don't think there's much of a difference between asking someone to reveal the correct password and asking someone to reveal the correct finger. There's a huge difference. Authorities can force you to give up your fingerprint, but not your password[1]. 1. http://jolt.law.harvard.edu/digest/telecommunications/court-rules-police-may-compel-suspects-to-unlock-fingerprint-protected-smartphones http://jolt.law.harvard.edu/digest/telecommunications/court-...
- BurningFrog 11y ago
  The countermeasure is for the authorities to push your finger of their choice by force. Thumb and index finger should cover 98% of people.
  - phn 11y ago
    What if I bite the skin off my fingers? God this conversation is turning into an horror movie.
    - zimpenfish 11y ago
      Pineapple juice might be easier. https://en.wikipedia.org/wiki/Bromelain https://en.wikipedia.org/wiki/Bromelain
- savoytruffle 11y ago
  I only recently got a touchID iPhone so I'm still having fun with it. But I did my right thumb, index, and middle finger, and left thumb and index. If under police duress I keep trying to unlock a phone with my pinkie finger I think that would be suspicious. If I have that much access to the device I should just force-reboot it by holding the lock and home buttons for about 2 seconds. Or maybe have done that before being arrested. Upon a reboot the iPhone will always require its passcode.
- sandworm101 11y ago
  They would fingerprint the reader, and you, to get a rough idea of which finger is a likely candidate. Even an extremely partial print should be enough to narrow it down to 4 or 5. The reality is that all right-handed people hold phones in their left and so use fingers on their right hand. Lefties do the reverse. So it is already down to five candidates ... which might have something to do with why apple picked that number in the first place.
  - Armisael16 11y ago
    ...where on earth did you get that idea from? I'm right-handed and both hold and unlock my phone with the fingers on my right hand.
    - sandworm101 11y ago
      It depends on the size of the phone. My too open/unlock my phone with the same hand that holds it (pattern unlock). But my phone is tiny. As a phone gets larger so does the likelihood that it is manipulated with two hands. Having the scanner below the screen also requires some dexterity when used single-handed, increasing the likelihood that the thumb is the print finger.
- Natsu 11y ago
  Going through a few thought experiments, one might think they could adapt by dusting it for prints and requiring you to use the one they found there. On the other hand, one might habitually touch, but not register, random fingers to it, while registering some fairly unusual finger as the real one, while using the dominant hand's index finger to "unlock" it. Finally, someone might decide that if you fail the unlock, they'll just inspect the fingerprint module in isolation and if it works, they'll assume you did that deliberately.
- im3w1l 11y ago
  >After five failed fingerprint attempts, your password is required to unlock the phone. How is that actually enforced? Is there an if statement and a counter somewhere? Couldn't that just be disabled by a sufficiently advanced attacker?
  - leonatan 11y ago
    If they could do that, they could also read the memory for the encryption key stored in the enclave. No such attack exists that we know of.
- kriro 11y ago
  Sidenote: Fingerprints should most certainly not be used as passwords at all and only serve as usernames (imo). Mostly because it's pretty hard to change your fingerprint which is a desirable feature for passwords ;)
  - froo 11y ago
    If one is really paranoid, register only a toe print. I've currently got my right big toe registered to my phone as an experiment and it works as often as finger scanning
    - hueving 11y ago
      A penis works as well. It makes checking email on the bus awkward though
    - hueving 11y ago
      A penis works as well. It makes checking email on the bus awkward though
- Shivetya 11y ago
  having made the request for both an erase password as well as an erase finger print I would not mind going one further, a setting which wipes the phone if neither are entered in a set amount of time. The would protect you when the phone is stolen or confiscated.
- briankwest 11y ago
  They first have to guess which body part needs to be placed on the TouchID sensor! :)
stephentmcm 11y ago
I don't know about that but I'd be fairly certain a court would just order you to unlock the phone regardless of whether it's your finger locking it or a password.
- garrettgrimsley 11y ago
  In the USA the courts treat passwords as testimony, and in most cases you can invoke your 5th amendment right and refuse to provide passwords or encryption keys, given the state does not already know the contents of the device. This same protection does not extend to physical keys, which I think fingerprints would fall under. http://www.uclalawreview.org/the-fifth-amendment-encryption-and-the-forgotten-state-interest/ http://www.uclalawreview.org/the-fifth-amendment-encryption-...
  - avs733 11y ago
    That seems to be representative of the only actual ruling on this topic that I can find >The Fifth Amendment to the U.S. Constitution gives people the right to avoid self-incrimination. That includes divulging secret passwords, Judge Steven C. Frucci ruled. But providing fingerprints and other biometric information is considered outside the protection of the Fifth Amendment, the judge said. [1] http://blogs.wsj.com/digits/2014/10/31/judge-rules-suspect-can-be-required-to-unlock-phone-with-fingerprint/ http://blogs.wsj.com/digits/2014/10/31/judge-rules-suspect-c...
  - spdustin 11y ago
    It would seem to me that the "fingerprint = key" analogy is flawed. Physical keys can be trivially copied, and even reverse engineered from the locking mechanism. A key is a physical object that is required to disengage a lock. A fingerprint, when used on an electronic lock of this kind, is not a key. It's attributable to one person only, not trivially duplicated, and not able to be reverse engineered from a locking mechanism. It requires an action by a single person who cannot be forcibly relieved of their possession of their fingerprint. Additionally, a key is specified during the manufacturing or assembly of a lock, and comes with the lock, since they are "paired" when the lock is made. However, a fingerprint or password are specified by the user at will after they've assumed ownership of the device. They "testified" their identity to their phone with a fingerprint, just like they did with their password. If compelled to imprint a finger, it is the same sort of personal interaction that a password entails: the credential holder utters/presents their personal information - not a physical object, but a repeated testimony of the same content they previously and uniquely presented to their device. It should be protected as other self-incriminating testimony under the fifth amendment.
deleted 11y ago
[deleted]

ggreer 11y ago

After five failed fingerprint attempts, your password is required to unlock the phone. That seems pretty safe to me. If you're ever ordered to unlock the phone, just touch an unregistered finger to it. Fingerprint sensors aren't foolproof. It'd be hard to prove you deliberately sabotaged the effort. Though, one feature I'd like would be to register a distress fingerprint. Then I could touch say... my left index finger to require a password unlock.

EGreg 11y ago
As Apple says, it's not feasible to try 50,000 fingerprints since you only get 5 tries. But you can try a lot of passwords. Anyway, how does any of this prevent rubber hose cryptography?
- superuser2 11y ago
  In this case, the part where the phone's owner is dead.
  - ethbro 11y ago
    Do dead guys not have functional fingerprints? (Yes, I really asked that. Yes, I'm really curious.)
    - superuser2 11y ago
      He had a 5C, so wouldn't help here.
    - ethbro 11y ago
      Because I was interested and no one else chirped in, the answer is "Yes, but require some additional effort to obtain due to post-mortem stiffening." For those curious, here's a Northwestern scan of an article in The Journal of Criminal Law from the 70s (thanks, internet!): http://scholarlycommons.law.northwestern.edu/cgi/viewcontent.cgi?article=5809&context=jclc http://scholarlycommons.law.northwestern.edu/cgi/viewcontent...
gst 11y ago
If you do this on purpose after asked to unlock your phone you will probably be charged with destruction of evidence or something like that. However, while a court is (afaik) able to ask you to put your finger on the fingerprint reader, you do not need to tell them which of the fingers the correct one is. So instead of purposely using a wrong finger, I'd ask the court to explicitly tell me which of my fingers I should use to unlock the phone.
- savoytruffle 11y ago
  It would be a very long and involved case, anyway.
- azernik 11y ago
  I think the court would similarly consider that obstruction and contempt. If they tell you to unlock your phone and you try to play some "first you have to guess which finger's the right one!" game, the judge will slap you with either contempt of court or refusal to comply with a subpoena.
  - gst 11y ago
    IANAL, but I don't think there's much of a difference between asking someone to reveal the correct password and asking someone to reveal the correct finger. In both cases you would be asked to incriminate yourself. If it would be lawful for a court to ask you to "unlock the phone with the correct finger" then they might as well also ask you to "unlock this harddisk with the correct keyboard keys pushed in the correct order (as a password)".
    - rhizome 11y ago
      I don't think there's much of a difference between asking someone to reveal the correct password and asking someone to reveal the correct finger. There's a huge difference. Authorities can force you to give up your fingerprint, but not your password[1]. 1. http://jolt.law.harvard.edu/digest/telecommunications/court-rules-police-may-compel-suspects-to-unlock-fingerprint-protected-smartphones http://jolt.law.harvard.edu/digest/telecommunications/court-...
BurningFrog 11y ago
The countermeasure is for the authorities to push your finger of their choice by force. Thumb and index finger should cover 98% of people.
- phn 11y ago
  What if I bite the skin off my fingers? God this conversation is turning into an horror movie.
  - zimpenfish 11y ago
    Pineapple juice might be easier. https://en.wikipedia.org/wiki/Bromelain https://en.wikipedia.org/wiki/Bromelain
savoytruffle 11y ago
I only recently got a touchID iPhone so I'm still having fun with it. But I did my right thumb, index, and middle finger, and left thumb and index. If under police duress I keep trying to unlock a phone with my pinkie finger I think that would be suspicious. If I have that much access to the device I should just force-reboot it by holding the lock and home buttons for about 2 seconds. Or maybe have done that before being arrested. Upon a reboot the iPhone will always require its passcode.
sandworm101 11y ago
They would fingerprint the reader, and you, to get a rough idea of which finger is a likely candidate. Even an extremely partial print should be enough to narrow it down to 4 or 5. The reality is that all right-handed people hold phones in their left and so use fingers on their right hand. Lefties do the reverse. So it is already down to five candidates ... which might have something to do with why apple picked that number in the first place.
- Armisael16 11y ago
  ...where on earth did you get that idea from? I'm right-handed and both hold and unlock my phone with the fingers on my right hand.
  - sandworm101 11y ago
    It depends on the size of the phone. My too open/unlock my phone with the same hand that holds it (pattern unlock). But my phone is tiny. As a phone gets larger so does the likelihood that it is manipulated with two hands. Having the scanner below the screen also requires some dexterity when used single-handed, increasing the likelihood that the thumb is the print finger.
Natsu 11y ago
Going through a few thought experiments, one might think they could adapt by dusting it for prints and requiring you to use the one they found there. On the other hand, one might habitually touch, but not register, random fingers to it, while registering some fairly unusual finger as the real one, while using the dominant hand's index finger to "unlock" it. Finally, someone might decide that if you fail the unlock, they'll just inspect the fingerprint module in isolation and if it works, they'll assume you did that deliberately.
im3w1l 11y ago
>After five failed fingerprint attempts, your password is required to unlock the phone. How is that actually enforced? Is there an if statement and a counter somewhere? Couldn't that just be disabled by a sufficiently advanced attacker?
- leonatan 11y ago
  If they could do that, they could also read the memory for the encryption key stored in the enclave. No such attack exists that we know of.
kriro 11y ago
Sidenote: Fingerprints should most certainly not be used as passwords at all and only serve as usernames (imo). Mostly because it's pretty hard to change your fingerprint which is a desirable feature for passwords ;)
- froo 11y ago
  If one is really paranoid, register only a toe print. I've currently got my right big toe registered to my phone as an experiment and it works as often as finger scanning
  - hueving 11y ago
    A penis works as well. It makes checking email on the bus awkward though
  - hueving 11y ago
    A penis works as well. It makes checking email on the bus awkward though
Shivetya 11y ago
having made the request for both an erase password as well as an erase finger print I would not mind going one further, a setting which wipes the phone if neither are entered in a set amount of time. The would protect you when the phone is stolen or confiscated.
briankwest 11y ago
They first have to guess which body part needs to be placed on the TouchID sensor! :)

stephentmcm 11y ago

I don't know about that but I'd be fairly certain a court would just order you to unlock the phone regardless of whether it's your finger locking it or a password.

garrettgrimsley 11y ago
In the USA the courts treat passwords as testimony, and in most cases you can invoke your 5th amendment right and refuse to provide passwords or encryption keys, given the state does not already know the contents of the device. This same protection does not extend to physical keys, which I think fingerprints would fall under. http://www.uclalawreview.org/the-fifth-amendment-encryption-and-the-forgotten-state-interest/ http://www.uclalawreview.org/the-fifth-amendment-encryption-...
- avs733 11y ago
  That seems to be representative of the only actual ruling on this topic that I can find >The Fifth Amendment to the U.S. Constitution gives people the right to avoid self-incrimination. That includes divulging secret passwords, Judge Steven C. Frucci ruled. But providing fingerprints and other biometric information is considered outside the protection of the Fifth Amendment, the judge said. [1] http://blogs.wsj.com/digits/2014/10/31/judge-rules-suspect-can-be-required-to-unlock-phone-with-fingerprint/ http://blogs.wsj.com/digits/2014/10/31/judge-rules-suspect-c...
- spdustin 11y ago
  It would seem to me that the "fingerprint = key" analogy is flawed. Physical keys can be trivially copied, and even reverse engineered from the locking mechanism. A key is a physical object that is required to disengage a lock. A fingerprint, when used on an electronic lock of this kind, is not a key. It's attributable to one person only, not trivially duplicated, and not able to be reverse engineered from a locking mechanism. It requires an action by a single person who cannot be forcibly relieved of their possession of their fingerprint. Additionally, a key is specified during the manufacturing or assembly of a lock, and comes with the lock, since they are "paired" when the lock is made. However, a fingerprint or password are specified by the user at will after they've assumed ownership of the device. They "testified" their identity to their phone with a fingerprint, just like they did with their password. If compelled to imprint a finger, it is the same sort of personal interaction that a password entails: the credential holder utters/presents their personal information - not a physical object, but a repeated testimony of the same content they previously and uniquely presented to their device. It should be protected as other self-incriminating testimony under the fifth amendment.

deleted 11y ago

[deleted]