7 ms·

You've described the state of the law as it is, but surely that doesn't address the issue of the law as it should be. I think that it is possible to be an inte

by JadeNB 11y ago

You've described the state of the law as it is, but surely that doesn't address the issue of the law as it should be. I think that it is possible to be an intelligent but non-technical person and (EDIT: forgot the word 'not') realise that, all technical issues aside, the "something you know" and "something you have" parts of a password are on completely different legal footing; and I think that it is reasonable even for a technical person to wonder whether it should be so. EDIT: I know that complaints about downvotes are not welcome, and it's quite possible that I'm wrong in what I say, but I'd like to be told how rather than just downvoted! My comment was meant to be a constructive contribution. EDIT 2: Wow, these many replies help a lot! Thanks!

JoshTriplett 11y ago
I agree with the comments below: a fingerprint is a username, not a password. I don't have a problem with compelling the provision of identification given an appropriate warrant; I do have a problem with compelling the provision of information held only in someone's head, with or without a warrant.
- EdHominem 11y ago
  But it's not being used as a username, it's being used as a password. (Or rather, a username and a password.) It's hacking to bypass even a trivial password, so similarly it should be unreasonable to compel disclosure of even a trivial password... They don't need your usename - your phone assumes it's you and only asks for the password... The fingerprint that they're seeking is not a username, it's a crappy password.
dragonwriter 11y ago
"Something you have" isn't part of a password, its an alternative, non-password factor; passwords are always "something you know". There is a trend to use biometrics in place of passwords, which is a convenience feature which compromises security, even though it is often misrepresented as a security feature. (Using biometrics as a second factor helps security, but there is a big difference between "and" and "or" security measures.)
- m_eiman 11y ago
  A fingerprint can improve security in at least one way: it makes it impossible to shoulder-surf your password since you're not entering it.
pc86 11y ago
Courts are not (and should not be) interested in "the law as it should be." They are to interpret the law as it is written.
- JadeNB 11y ago
  > Courts are not (and should not be) interested in "the law as it should be." They are to interpret the law as it is written. I agree, but then neither are we the courts; and it is precisely the role of the commons to discuss the law as it should be, so that the legislative branch can, hopefully, enshrine that communal wisdom in the law as it is.
  - pc86 11y ago
    You are right, I misinterpreted your comment.
gruyere 11y ago
per your edit, you seem to forget you're at HN.
eganist 11y ago
> but I'd like to be told how rather than just downvoted! It's probably in the tone of your comment, which (though it isn't the case) implies that there's something wrong with the laws. I'd edit and rephrase in your position, especially since your criticism isn't of the law but is rather of the education of users. To your point: if users of devices could be educated in-device about the security of different identification and authentication schemes, the user could take better ownership of the security of said user's device.
- JadeNB 11y ago
  Thank you for your response! > It's probably in the tone of your comment, which (though it isn't the case) implies that there's something wrong with the laws. Rather than endorsing or decrying the law, I meant only to suggest that a simple, factual description of the state of the law, while non-controversial, also doesn't address the question of whether the law is appropriate. I am not at all sure that it is; but I am also a naïf in these matters, which is why I appreciate the many users who responded to my request for clarification. > I'd edit and rephrase in your position, especially since your criticism isn't of the law but is rather of the education of users. To your point: if users of devices could be educated in-device about the security of different identification and authentication schemes, the user could take better ownership of the security of said user's device. Indeed, I think that the point you make (and generously attribute to me) is a good one orthogonal to any questions of the law; whether the law is good or bad in any particular sense, it is as it is, and will be so enforced, and users should be educated as far as possible about this when choosing whether and how to secure their devices.
DannyBee 11y ago
"You've described the state of the law as it is, but surely that doesn't address the issue of the law as it should be." Fingerprints and other things like them are 100% non-testimonial. The fifth amendment does not cover non-testimonial evidence (because it only covers being a witness against yourself). This has been law since the amendment was enacted, was the purpose of it, etc. So I suspect if you want the law to be something else, your problem isn't even with the courts or judges, it's with the founders :)
- spdustin 11y ago
  Not true. There is an adage that the government can force you to produce the key to a lock, but not the combination to a safe. It just so happens that, today, the government can compel you to perform a physical gesture that, by proxy, happens to be used as a key on a device that normally accepts a combination. If it's been 48 hours since your finger was last applied to the Touch ID sensor on an iPhone, that "key" doesn't work any more. So, until the fingerprint is accepted by the courts as a "combination" (effectively, that's how the "common man" sees it, and which the courts treat as testimony-by-proxy) rather than a physical gesture (not testimony at all, and currently easily compelled), the only defense one has (if using Touch ID) is to stall for 48 hours.
  - DannyBee 11y ago
    Your adage is based on random supreme court dicta in Hubbell and Doe, and you know courts have gone either way. ;) So let's just both agree we are suggesting the world is a little more black and white than it is. I would not try to predict what would happen square-on today, given the splits involved.
maxerickson 11y ago
The OP states their opinion a couple of times, so surely that doesn't address the issue of the law as it should be. isn't a very good reply to what they said. That was my reasoning.
- JadeNB 11y ago
  Thank you for the explanation. Aside from saying once that he was not bothered by this state of things, I took the poster to be mainly explaining the consequences of the law (don't act as if your fingerprint is as secure as your password) rather than specifically endorsing it.
  - JoshTriplett 11y ago
    I definitely wasn't just giving the current state of the law; I was offering the opinion that out of the pile of problems we do have with government overreach, surveillance, and lack of understanding of technology, this case seems perfectly reasonable and not worth worrying about. I'm not bothered by the compelled production of a fingerprint, given the due process of a warrant; I don't see any obvious reason why someone should expect otherwise from the law, nor any right or reasonable expectation this violates, and I don't think the law needs to change in that area. (I do see other issues associated with fingerprints, such as the retention of fingerprints from non-criminals cleared of all charges, but I don't see an issue that applies to this case.) I am bothered by (attempted) compelled production of a passphrase. And I see those as significantly different cases.

by JadeNB 11y ago

JoshTriplett 11y ago

I agree with the comments below: a fingerprint is a username, not a password. I don't have a problem with compelling the provision of identification given an appropriate warrant; I do have a problem with compelling the provision of information held only in someone's head, with or without a warrant.

EdHominem 11y ago
But it's not being used as a username, it's being used as a password. (Or rather, a username and a password.) It's hacking to bypass even a trivial password, so similarly it should be unreasonable to compel disclosure of even a trivial password... They don't need your usename - your phone assumes it's you and only asks for the password... The fingerprint that they're seeking is not a username, it's a crappy password.

dragonwriter 11y ago

"Something you have" isn't part of a password, its an alternative, non-password factor; passwords are always "something you know". There is a trend to use biometrics in place of passwords, which is a convenience feature which compromises security, even though it is often misrepresented as a security feature. (Using biometrics as a second factor helps security, but there is a big difference between "and" and "or" security measures.)

m_eiman 11y ago
A fingerprint can improve security in at least one way: it makes it impossible to shoulder-surf your password since you're not entering it.

pc86 11y ago

Courts are not (and should not be) interested in "the law as it should be." They are to interpret the law as it is written.

JadeNB 11y ago
> Courts are not (and should not be) interested in "the law as it should be." They are to interpret the law as it is written. I agree, but then neither are we the courts; and it is precisely the role of the commons to discuss the law as it should be, so that the legislative branch can, hopefully, enshrine that communal wisdom in the law as it is.
- pc86 11y ago
  You are right, I misinterpreted your comment.

gruyere 11y ago

per your edit, you seem to forget you're at HN.

eganist 11y ago

> but I'd like to be told how rather than just downvoted! It's probably in the tone of your comment, which (though it isn't the case) implies that there's something wrong with the laws. I'd edit and rephrase in your position, especially since your criticism isn't of the law but is rather of the education of users. To your point: if users of devices could be educated in-device about the security of different identification and authentication schemes, the user could take better ownership of the security of said user's device.

JadeNB 11y ago
Thank you for your response! > It's probably in the tone of your comment, which (though it isn't the case) implies that there's something wrong with the laws. Rather than endorsing or decrying the law, I meant only to suggest that a simple, factual description of the state of the law, while non-controversial, also doesn't address the question of whether the law is appropriate. I am not at all sure that it is; but I am also a naïf in these matters, which is why I appreciate the many users who responded to my request for clarification. > I'd edit and rephrase in your position, especially since your criticism isn't of the law but is rather of the education of users. To your point: if users of devices could be educated in-device about the security of different identification and authentication schemes, the user could take better ownership of the security of said user's device. Indeed, I think that the point you make (and generously attribute to me) is a good one orthogonal to any questions of the law; whether the law is good or bad in any particular sense, it is as it is, and will be so enforced, and users should be educated as far as possible about this when choosing whether and how to secure their devices.

DannyBee 11y ago

"You've described the state of the law as it is, but surely that doesn't address the issue of the law as it should be." Fingerprints and other things like them are 100% non-testimonial. The fifth amendment does not cover non-testimonial evidence (because it only covers being a witness against yourself). This has been law since the amendment was enacted, was the purpose of it, etc. So I suspect if you want the law to be something else, your problem isn't even with the courts or judges, it's with the founders :)

spdustin 11y ago
Not true. There is an adage that the government can force you to produce the key to a lock, but not the combination to a safe. It just so happens that, today, the government can compel you to perform a physical gesture that, by proxy, happens to be used as a key on a device that normally accepts a combination. If it's been 48 hours since your finger was last applied to the Touch ID sensor on an iPhone, that "key" doesn't work any more. So, until the fingerprint is accepted by the courts as a "combination" (effectively, that's how the "common man" sees it, and which the courts treat as testimony-by-proxy) rather than a physical gesture (not testimony at all, and currently easily compelled), the only defense one has (if using Touch ID) is to stall for 48 hours.
- DannyBee 11y ago
  Your adage is based on random supreme court dicta in Hubbell and Doe, and you know courts have gone either way. ;) So let's just both agree we are suggesting the world is a little more black and white than it is. I would not try to predict what would happen square-on today, given the splits involved.

maxerickson 11y ago

The OP states their opinion a couple of times, so surely that doesn't address the issue of the law as it should be. isn't a very good reply to what they said. That was my reasoning.

JadeNB 11y ago
Thank you for the explanation. Aside from saying once that he was not bothered by this state of things, I took the poster to be mainly explaining the consequences of the law (don't act as if your fingerprint is as secure as your password) rather than specifically endorsing it.
- JoshTriplett 11y ago
  I definitely wasn't just giving the current state of the law; I was offering the opinion that out of the pile of problems we do have with government overreach, surveillance, and lack of understanding of technology, this case seems perfectly reasonable and not worth worrying about. I'm not bothered by the compelled production of a fingerprint, given the due process of a warrant; I don't see any obvious reason why someone should expect otherwise from the law, nor any right or reasonable expectation this violates, and I don't think the law needs to change in that area. (I do see other issues associated with fingerprints, such as the retention of fingerprints from non-criminals cleared of all charges, but I don't see an issue that applies to this case.) I am bothered by (attempted) compelled production of a passphrase. And I see those as significantly different cases.