3 ms·

Always remember: your fingerprint is identification. You can be forced to identify yourself to law enforcement. Do not make it your password. Your password is

Always remember: your fingerprint is identification. You can be forced to identify yourself to law enforcement. Do not make it your password. Your password is something you know, not something you are.

djsumdog 11y ago
Something you know, and ... something you can forget.
cloudjacker 11y ago
Or just restart your iPhone.
- astrodust 11y ago
  I've heard more than one person say if you're going to have to surrender your phone, if there's even the risk of it, turn it off.
  - TazeTSchnitzel 11y ago
    If you turn off your iPhone, you can't use it again without entering your password, and you would have to do that consciously. On the other hand, your phone could otherwise be unlocked with just your fingerprint.
    - colejohnson66 11y ago
      Is there a way to know Touch ID is available, but can't be used because the device was just rebooted? Or does it act like there's just a password?
      - thesimon 11y ago
        >Is there a way to know Touch ID is available, but can't be used because the device was just rebooted? I don't know the verbatim message, but it says something along the lines of "Passcode is required to enable Touch ID"
        jayrhynas 11y ago
        "iPhone requires your passcode after restarting" vs "Touch ID requires your passcode when iPhone restarts" Also, if Touch ID is disabled then putting a finger on the sensor does nothing, but if it's enabled it shows the passcode screen with the above message Edit: with Touch ID enabled, if you slide to the lock screen without touching the sensor, it says "iPhone requires your passcode after restarting" but the title says "Touch ID or Enter Passcode"
  - sotojuan 11y ago
    Yup: https://twitter.com/SwiftOnSecurity/status/726797926647746560 https://twitter.com/SwiftOnSecurity/status/72679792664774656... https://twitter.com/SwiftOnSecurity/status/726797364510388224 https://twitter.com/SwiftOnSecurity/status/72679736451038822...
  - jedmeyers 11y ago
    At the very least, use the wrong finger 5 times on the sensor and it will disable the Touch ID.
    - jdmichal 11y ago
      And risk being charged with obstruction. Like perjury, it's naturally difficult to prove, but one should be aware of the risks before moving down that course.
      - jedmeyers 11y ago
        No, I mean, disable Touch ID before any potential situation where the phone might be seized for any reason, not after a judge had ordered you to unlock the phone with a thumbprint.
        jdmichal 11y ago
        The moment you believe the phone is going to be seized by law enforcement and you act accordingly to make it more difficult or impossible to retrieve data from it, you are guilty of spoliation / tampering of evidence. This is the same set of laws that makes it illegal to shred papers before law enforcement can get to them. Locking or erasing your phone is simply the digital equivalent.
        astrodust 11y ago
        "I just turned it off since the battery wears down really quickly and I thought I might need it to make a call later." Difficult to prove.
        paulddraper 11y ago
        Difficult to prove and illegal. Like lots of things.
        11y ago
- emdd 11y ago
  Correct that you cannot be compelled to unlock your phone (with a code, not Touch ID) or reveal the passcode?
artursapek 11y ago
"Your fingerprint is your username, not your password."
draw_down 11y ago
You can be forced to do lots of things by law enforcement, like give up your password which is something other than your fingerprint.
- tombert 11y ago
  https://en.wikipedia.org/wiki/TrueCrypt#United_States_v._John_Doe https://en.wikipedia.org/wiki/TrueCrypt#United_States_v._Joh... > The court's ruling noted that FBI forensic examiners were unable to get past TrueCrypt's encryption (and therefore were unable to access the data) unless Doe either decrypted the drives or gave the FBI the password, and the court then ruled that Doe's Fifth Amendment right to remain silent legally prevented the Government from making him or her do so. So it seems like the law is a bit ambiguous on this front.
devy 11y ago
I wholeheartedly agree. This is the same to all biometric data(fingerprints, retina scans). They should only be used to identification NOT AUTHENTICATION!

djsumdog 11y ago

Something you know, and ... something you can forget.

cloudjacker 11y ago

Or just restart your iPhone.

astrodust 11y ago
I've heard more than one person say if you're going to have to surrender your phone, if there's even the risk of it, turn it off.
- TazeTSchnitzel 11y ago
  If you turn off your iPhone, you can't use it again without entering your password, and you would have to do that consciously. On the other hand, your phone could otherwise be unlocked with just your fingerprint.
  - colejohnson66 11y ago
    Is there a way to know Touch ID is available, but can't be used because the device was just rebooted? Or does it act like there's just a password?
    - thesimon 11y ago
      >Is there a way to know Touch ID is available, but can't be used because the device was just rebooted? I don't know the verbatim message, but it says something along the lines of "Passcode is required to enable Touch ID"
      - jayrhynas 11y ago
        "iPhone requires your passcode after restarting" vs "Touch ID requires your passcode when iPhone restarts" Also, if Touch ID is disabled then putting a finger on the sensor does nothing, but if it's enabled it shows the passcode screen with the above message Edit: with Touch ID enabled, if you slide to the lock screen without touching the sensor, it says "iPhone requires your passcode after restarting" but the title says "Touch ID or Enter Passcode"
- sotojuan 11y ago
  Yup: https://twitter.com/SwiftOnSecurity/status/726797926647746560 https://twitter.com/SwiftOnSecurity/status/72679792664774656... https://twitter.com/SwiftOnSecurity/status/726797364510388224 https://twitter.com/SwiftOnSecurity/status/72679736451038822...
- jedmeyers 11y ago
  At the very least, use the wrong finger 5 times on the sensor and it will disable the Touch ID.
  - jdmichal 11y ago
    And risk being charged with obstruction. Like perjury, it's naturally difficult to prove, but one should be aware of the risks before moving down that course.
    - jedmeyers 11y ago
      No, I mean, disable Touch ID before any potential situation where the phone might be seized for any reason, not after a judge had ordered you to unlock the phone with a thumbprint.
      - jdmichal 11y ago
        The moment you believe the phone is going to be seized by law enforcement and you act accordingly to make it more difficult or impossible to retrieve data from it, you are guilty of spoliation / tampering of evidence. This is the same set of laws that makes it illegal to shred papers before law enforcement can get to them. Locking or erasing your phone is simply the digital equivalent.
        astrodust 11y ago
        "I just turned it off since the battery wears down really quickly and I thought I might need it to make a call later." Difficult to prove.
        paulddraper 11y ago
        Difficult to prove and illegal. Like lots of things.
        11y ago
emdd 11y ago
Correct that you cannot be compelled to unlock your phone (with a code, not Touch ID) or reveal the passcode?

artursapek 11y ago

"Your fingerprint is your username, not your password."

draw_down 11y ago

You can be forced to do lots of things by law enforcement, like give up your password which is something other than your fingerprint.

tombert 11y ago
https://en.wikipedia.org/wiki/TrueCrypt#United_States_v._John_Doe https://en.wikipedia.org/wiki/TrueCrypt#United_States_v._Joh... > The court's ruling noted that FBI forensic examiners were unable to get past TrueCrypt's encryption (and therefore were unable to access the data) unless Doe either decrypted the drives or gave the FBI the password, and the court then ruled that Doe's Fifth Amendment right to remain silent legally prevented the Government from making him or her do so. So it seems like the law is a bit ambiguous on this front.

devy 11y ago

I wholeheartedly agree. This is the same to all biometric data(fingerprints, retina scans). They should only be used to identification NOT AUTHENTICATION!