4 ms·

> Among the pieces of evidence that Google suggests the Trust API could use are some obvious biometric indicators, such as your face shape and voice pattern, as

by s_kilk 10y ago

> Among the pieces of evidence that Google suggests the Trust API could use are some obvious biometric indicators, such as your face shape and voice pattern, as well as some less obvious ones: how you move, how you type and how you swipe on the screen. With the service continually running in the background of the phone, it can keep track of whether those indicators match how it knows you use your phone. I wonder how this would deal with changes in your behaviour, lets say, due to illness or disability. If I'm ill and high on painkillers, will the system lock me out? If I lose my right arm in an accident, (or even if my right arm is pinned under something and I desperately need to use the phone), will I be blocked from using the phone? I think this stuff sounds like a good idea in a vacuum, a vacuum in which you can presume you'll always be in the same state of mind and body as what Google consider 'normal'.

VLM 10y ago
> if my right arm is pinned under something and I desperately need to use the phone I have pattern locking today, and "emergency call" button on the lock screen is already a thing. I would imagine this would be option #7 or so for the lock screen. Depending on your phone's hardware, etc. I used to treat my phone like my wallet, aka no lock at all beyond anti-butt dialing swipe, but some obscure corner of VPN setup required more extreme measures. I assume that any lock technology on my phone is on the level of a kids diary book lock, and act accordingly. Anyone with physical access to my phone owns all of it, so I'm pretty happy with "swipe to unlock" and not happy about big brother authoritarianism WRT vpn configs and lock screen choices. I don't find a bunch of security theater about "wiggle analysis" or facial recognition to be interesting or useful and mostly want to know about it so as to avoid it.
- Godel_unicode 10y ago
  Anyone with physical access and lots of money to pay for a bespoke exploit (assuming you're using a phone where that's possible), sure they have can have access if they're willing to put in the time and considerable money it would take. If you're ok with the risk posture of not locking your phone that's your decision, but you're quite wrong about the level of access granted merely by possession of a modern smartphone.
  - gkya 10y ago
    What would be the amount of users who use a proper password on the lock screen, instead of the pattern or a PIN? I bet the actual pattern space is very little for these and these are very guessable. How hard would it be to brute force these or even analyse the human fat on the screen to figure sth out? I unlock and lock the phone very often, unlike a computer where I unlock once and lock when my session is done. Thus I opt for sth quick and convenient instead of a proper password. I'd like to have a little chip like a yubikey that I'd use with an ordinary pattern or pin, guess that'd be the best approach that's both convenient and secure.
    - 794CD01 10y ago
      You're describing the exact use pattern touch ID was designed for.
    - VLM 10y ago
      That seems very complicated compared to looking at security camera footage from the hundreds of cameras I walk past. Type in the code you see on the video and there you are. Likewise no one in .com or .gov technically needs my phone other than to look at what I might have saved locally on it; they own everyone from the mfgr thru the telco thru every app writer and SaaS provider either by just buying/sharing data or NSLs.
      - Godel_unicode 10y ago
        Do you also not lock your front door because someone could possibly take a picture of your key and 3d-print one, then follow you to see where you live and rob you? Coming up with theoretical nightmare scenarios is fun and all, but you should try to bring some reality to your security decisions.
    - Godel_unicode 10y ago
      1 - patterns and pins are not as insecure as you apparently believe (consider that length isn't mandated and watch the search space explode). Enable the "10 tries and it's wiped" setting and get on with your life 2 - I wasn't talking about Joe public, I'm talking about the type of person who posts in smartphone security articles on HN. They'll pick a good enough PIN/Pattern 3 - we're not trying to secure against an advanced adversary, by far the most likely bad actor is the thief who pulled it out of your bag at Starbucks. A PIN/Pattern is fort Knox to them. Security is all about risk mitigation, you have to consider against whom you want the system to be secured.

by s_kilk 10y ago

VLM 10y ago

> if my right arm is pinned under something and I desperately need to use the phone I have pattern locking today, and "emergency call" button on the lock screen is already a thing. I would imagine this would be option #7 or so for the lock screen. Depending on your phone's hardware, etc. I used to treat my phone like my wallet, aka no lock at all beyond anti-butt dialing swipe, but some obscure corner of VPN setup required more extreme measures. I assume that any lock technology on my phone is on the level of a kids diary book lock, and act accordingly. Anyone with physical access to my phone owns all of it, so I'm pretty happy with "swipe to unlock" and not happy about big brother authoritarianism WRT vpn configs and lock screen choices. I don't find a bunch of security theater about "wiggle analysis" or facial recognition to be interesting or useful and mostly want to know about it so as to avoid it.

Godel_unicode 10y ago
Anyone with physical access and lots of money to pay for a bespoke exploit (assuming you're using a phone where that's possible), sure they have can have access if they're willing to put in the time and considerable money it would take. If you're ok with the risk posture of not locking your phone that's your decision, but you're quite wrong about the level of access granted merely by possession of a modern smartphone.
- gkya 10y ago
  What would be the amount of users who use a proper password on the lock screen, instead of the pattern or a PIN? I bet the actual pattern space is very little for these and these are very guessable. How hard would it be to brute force these or even analyse the human fat on the screen to figure sth out? I unlock and lock the phone very often, unlike a computer where I unlock once and lock when my session is done. Thus I opt for sth quick and convenient instead of a proper password. I'd like to have a little chip like a yubikey that I'd use with an ordinary pattern or pin, guess that'd be the best approach that's both convenient and secure.
  - 794CD01 10y ago
    You're describing the exact use pattern touch ID was designed for.
  - VLM 10y ago
    That seems very complicated compared to looking at security camera footage from the hundreds of cameras I walk past. Type in the code you see on the video and there you are. Likewise no one in .com or .gov technically needs my phone other than to look at what I might have saved locally on it; they own everyone from the mfgr thru the telco thru every app writer and SaaS provider either by just buying/sharing data or NSLs.
    - Godel_unicode 10y ago
      Do you also not lock your front door because someone could possibly take a picture of your key and 3d-print one, then follow you to see where you live and rob you? Coming up with theoretical nightmare scenarios is fun and all, but you should try to bring some reality to your security decisions.
  - Godel_unicode 10y ago
    1 - patterns and pins are not as insecure as you apparently believe (consider that length isn't mandated and watch the search space explode). Enable the "10 tries and it's wiped" setting and get on with your life 2 - I wasn't talking about Joe public, I'm talking about the type of person who posts in smartphone security articles on HN. They'll pick a good enough PIN/Pattern 3 - we're not trying to secure against an advanced adversary, by far the most likely bad actor is the thief who pulled it out of your bag at Starbucks. A PIN/Pattern is fort Knox to them. Security is all about risk mitigation, you have to consider against whom you want the system to be secured.