5 ms·

"The weak link in all of this has been Farook and his poor choice of security." It's only a poor choice if there's anything worth securing on the phone, and mo

"The weak link in all of this has been Farook and his poor choice of security." It's only a poor choice if there's anything worth securing on the phone, and most people think that there's not, he destroyed his personal phone while leaving this phone intact. In any case, most people unlock their phone dozens of times a day, perhaps hundreds of times a day (for some). So expecting users to use a secure passphrase as an unlock code is unreasonable. It seems that it would be better to have a 2 stage system -- if the phone hasn't been unlocked with the passcode in X hours (user configurable), then it has to be unlocked with the secure passphrase -- even if someone knows the passcode the phone can't be unlocked with it after that timer expires. And on reboot, only the passphrase should be accepted. So someone that unlocks their phone frequently can use a simple passcode, but once the phone has been out of their possession for a few hours, only the passphrase can unlock it.

mikeash 11y ago
This could actually be a way to cause some havoc. Leave nothing useful on the phone, but dangle it in front of authorities, making them go crazy trying to get into it. I'm sure this guy was not that clever, though. What you describe is essentially how Touch ID works on newer iPhones, just with your fingerprint as the simple passcode. On a fresh boot, you have to put in your full passphrase, and every 48 hours after that. After you put in your passphrase, fingerprint unlock is available until either you turn the phone off, 48 hours passes, or fingerprint authentication fails five times in a row. Unfortunately, the 48 hours thing isn't configurable, so it's not quite perfect, but it's pretty decent. Certainly for me, it has immensely improved the security of my phone. In situations where I don't trust the fingerprint authentication (e.g. crossing an international border), I can just shut the phone off. Otherwise, it provides "good enough" security. Yes, there are potential attacks on the system, by copying my fingerprints and replicating it, but the five-attempt limit and the 48-hour timeout are good enough. For me, it's a vast improvement over what came before, when I had a passcode of 0000 just to satisfy some apps that wouldn't offer certain features unless a passcode was set. There are some improvements I'd like to see. The timeout should be customizable. I'd like to be able to set up a "duress fingerprint" which immediately disables fingerprint authentication, as an easier alternative to turning off the phone. But overall it seems like a good blend of security and usability.
- rietta 11y ago
  Dump a few hundred megabytes from /dev/random into an encrypted file with a provocative name. The thing every Cypherpunk dreams about.
- Johnny555 11y ago
  Ahh interesting, I didn't realize that TouchID would also require a password periodically, I don't have much faith in fingerprint ID, but the required password helps. I like your idea of the duress fingerprint since the police can demand that you supply a fingerprint to unlock a device (but can't demand a passphrase). If you use the wrong one then "Oops, I was so stressed out I forgot which fingerprint to use". I really think it's unlikely that law enforcement will ever take an interest in my phone, yet I still like knowing that my data is my data.
  - shkkmo 11y ago
    > I like your idea of the duress fingerprint since the police can demand that you supply a fingerprint to unlock a device (but can't demand a passphrase). There are cases where a judge can force you to supply a password. https://www.eff.org/issues/know-your-rights#17 https://www.eff.org/issues/know-your-rights#17
    - deleted 11y ago
      [deleted]
- katbyte 11y ago
  > I'd like to be able to set up a "duress fingerprint" I personally just don't use the tip of my thumb, so unless you knew that I would just try it 5 times and lock out touch id.
  - knd775 11y ago
    Unless the FBI goes through your HN history ;)
michaelmrose 11y ago
How about proximity to a key fob which also contains a button to lock it down?
- simoncion 11y ago
  Last time I looked in to this (many years ago) the only way you can use software that reboots an Android phone is to have that software signed with the same key that signed the firmware running on the phone. [0] Sadly, it's not straightforward to make a remote reboot-phone button that's usable by the general public. [0] IIRC, calling halt(8) from the shell didn't work, either.
  - crummel 11y ago
    It's definitely possible if you have root: http://tasker.wikidot.com/devicereboot http://tasker.wikidot.com/devicereboot.
    - simoncion 11y ago
      Sure, sure. If you've flashed a non-stock firmware all sorts of useful things become possible.
unprepare 11y ago
Pretty sure this is exactly how my nexus 6p operates. I have fingerprint set up to unlock the screen - but at least once a day ill have to enter the passphrase and it wont accept fingerprint. It says something like "for additional security, please enter your passphrase" instead of "finger moved too fast" or whatever Every reboot you have to use the passphrase to unlock the phone the first time. I dont see any options for configuring the time period when it asks for the passphrase again though.
21 11y ago
One annoying fact on Android is that it doesn't allow you to set a long password for device boot unlock, and a short one for the lock screen. It forces you to use the same password for both. I would like to be able to shut down the phone when the risk of attacks/theft/loss is high, knowing that a high-entropy password protects it, but without having to enter it all the day.
- ikeboy 11y ago
  https://play.google.com/store/apps/details?id=org.nick.cryptfs.passwdmanager https://play.google.com/store/apps/details?id=org.nick.crypt... works but requires root.

mikeash 11y ago

This could actually be a way to cause some havoc. Leave nothing useful on the phone, but dangle it in front of authorities, making them go crazy trying to get into it. I'm sure this guy was not that clever, though. What you describe is essentially how Touch ID works on newer iPhones, just with your fingerprint as the simple passcode. On a fresh boot, you have to put in your full passphrase, and every 48 hours after that. After you put in your passphrase, fingerprint unlock is available until either you turn the phone off, 48 hours passes, or fingerprint authentication fails five times in a row. Unfortunately, the 48 hours thing isn't configurable, so it's not quite perfect, but it's pretty decent. Certainly for me, it has immensely improved the security of my phone. In situations where I don't trust the fingerprint authentication (e.g. crossing an international border), I can just shut the phone off. Otherwise, it provides "good enough" security. Yes, there are potential attacks on the system, by copying my fingerprints and replicating it, but the five-attempt limit and the 48-hour timeout are good enough. For me, it's a vast improvement over what came before, when I had a passcode of 0000 just to satisfy some apps that wouldn't offer certain features unless a passcode was set. There are some improvements I'd like to see. The timeout should be customizable. I'd like to be able to set up a "duress fingerprint" which immediately disables fingerprint authentication, as an easier alternative to turning off the phone. But overall it seems like a good blend of security and usability.

rietta 11y ago
Dump a few hundred megabytes from /dev/random into an encrypted file with a provocative name. The thing every Cypherpunk dreams about.
Johnny555 11y ago
Ahh interesting, I didn't realize that TouchID would also require a password periodically, I don't have much faith in fingerprint ID, but the required password helps. I like your idea of the duress fingerprint since the police can demand that you supply a fingerprint to unlock a device (but can't demand a passphrase). If you use the wrong one then "Oops, I was so stressed out I forgot which fingerprint to use". I really think it's unlikely that law enforcement will ever take an interest in my phone, yet I still like knowing that my data is my data.
- shkkmo 11y ago
  > I like your idea of the duress fingerprint since the police can demand that you supply a fingerprint to unlock a device (but can't demand a passphrase). There are cases where a judge can force you to supply a password. https://www.eff.org/issues/know-your-rights#17 https://www.eff.org/issues/know-your-rights#17
  - deleted 11y ago
    [deleted]
katbyte 11y ago
> I'd like to be able to set up a "duress fingerprint" I personally just don't use the tip of my thumb, so unless you knew that I would just try it 5 times and lock out touch id.
- knd775 11y ago
  Unless the FBI goes through your HN history ;)

michaelmrose 11y ago

How about proximity to a key fob which also contains a button to lock it down?

simoncion 11y ago
Last time I looked in to this (many years ago) the only way you can use software that reboots an Android phone is to have that software signed with the same key that signed the firmware running on the phone. [0] Sadly, it's not straightforward to make a remote reboot-phone button that's usable by the general public. [0] IIRC, calling halt(8) from the shell didn't work, either.
- crummel 11y ago
  It's definitely possible if you have root: http://tasker.wikidot.com/devicereboot http://tasker.wikidot.com/devicereboot.
  - simoncion 11y ago
    Sure, sure. If you've flashed a non-stock firmware all sorts of useful things become possible.

unprepare 11y ago

Pretty sure this is exactly how my nexus 6p operates. I have fingerprint set up to unlock the screen - but at least once a day ill have to enter the passphrase and it wont accept fingerprint. It says something like "for additional security, please enter your passphrase" instead of "finger moved too fast" or whatever Every reboot you have to use the passphrase to unlock the phone the first time. I dont see any options for configuring the time period when it asks for the passphrase again though.

21 11y ago

One annoying fact on Android is that it doesn't allow you to set a long password for device boot unlock, and a short one for the lock screen. It forces you to use the same password for both. I would like to be able to shut down the phone when the risk of attacks/theft/loss is high, knowing that a high-entropy password protects it, but without having to enter it all the day.

ikeboy 11y ago
https://play.google.com/store/apps/details?id=org.nick.cryptfs.passwdmanager https://play.google.com/store/apps/details?id=org.nick.crypt... works but requires root.