7 ms·

This is why my unlock is not tied to biometrics. Once I realized the government can compel you to unlock your phone without a warrant using your fingerprint it

by yardie 10y ago

This is why my unlock is not tied to biometrics. Once I realized the government can compel you to unlock your phone without a warrant using your fingerprint it became a much less compelling feature. The same for facial recognition.

rhizome 10y ago
Yep. I got into a little argument with my brother over this last week, as he is a "I don't care, I have nothing to hide."
- adventured 10y ago
  My favorite fast response to disarm that is always: that's not up to you [whether or not you have something to hide]. I've found it instantly shakes the false comfort they're trying to derive from their premise and opens up a moment of rethink.
  - roel_v 10y ago
    Not for me, I don't even understand your point. Of course it's up to me if I have something to hide. I have nothing on my phone that I wouldn't be perfectly OK with to have printed and displayed in a busy public place. How is it not up to me to decide what details of my life I have to hide?
    - morganvachon 10y ago
      Easy: Your contact list. You may not care who sees your list, but the people on your contact list would probably be upset if their private email address, cellphone number, chat name, home address and other personal data were exposed to the general public. Ditto any conversation you had with them via text; you may not care who sees the conversation, but your partner/friend/boss may object to having their privately texted words plastered all over Times Square. Your GPS location data is another good one. Hypothetically speaking, would you really want the public, which contains some seedy characters mixed in with the "normal" people, to see the route you take to drop off/pick up your daughter at school, making her easy pickings for a kidnapping? There's more than just the websites you browse and the people you talk to on your phone. It's a digital vault of every move you make, every question you ponder, every person you've interacted with, every store you shop at. Your banking data is there, your stocks, your hobbies, your bursts of anger, your outlook on life, your loved ones' and associates' addresses and contact information. In short, you hurt more than yourself by exposing your private data, whether to the public at large, the government, or commercial entities seeking to hoover it up for advertising revenue. It's your responsibility to keep it private.
      - munin 10y ago
        Do you ever find it ironic that you are trying to combat totalitarian fear-mongering with an argument that in part is literally "think of the children?"
        morganvachon 10y ago
        It was just an example; besides, sometimes "think of the children" is the correct stance. If that is your only counter to my point, then I feel safe in my position. :-)
    - chillingeffect 10y ago
      Currently you have nothing on your phone that wouldn't be OK to be made public. Depending on who is in power in your area, that could change very quickly. If you're of the wrong race, someone like Donald Trump might use three-letter agency-collected data to move you out of the country. Foreign states might want to use your identity to get cheap health care for their citizens. Immigration policies, substance legal statuses and acceptable social practices and attitudes change overnight. Someone could spam with you child pornography and border officials could find it in your phone at the border. Furthermore, you don't know what you're going to do with the rest of your life and how the decisions you make now could be perceived in the future. Maybe someone's watching your house, keeping track of when you're not home. Or maybe they're using your phone patterns to do the same: Checking your phone when you're in the gym, in the bathroom at a restaurant. And any of these scenarios could be used to threaten you or someone you care about. Did a neighbor ask if you could babysit their children when they're away? Did your aunt admit she has a mental disorder that could get her fired? Did a friend reveal he has a substance abuse problem? Did your elderly parents send you copies of official financial documents to review? Ever looked for a "questionable" book on Amazon? Furthermore, if you're not following proper safety practices, you could be a liability for future business partners. Who wants to risk sharing data with someone who's loosey-goosey about the info on their systems? In conclusion, it's not just you, right now that bears thinking about. It's everyone in your social circle over the long-term future.
    - rdtsc 10y ago
      Do you mean that in the sense of: The police asks you to surrender you phone. Telling "you have nothing to hide, you shouldn't mind" and you respond with "It is not up to decide if I have something to hide" Or, your friend is arguing for letting the police see their phone because your friend has nothing to hide. Your friend says "I have nothing to hide". But you respond with "It is not up to you if you have nothing to hide, so you shouldn't have that attitude". Assuming you meant the second, what is the reasoning behind it?
      - rhizome 10y ago
        Say your friend is arrested for smoking pot in Arizona or Indiana or anywhere else that has draconian cannabis laws, now each of their contacts is possibly a dealer. They're in a different state? The DEA will be happy to help make a federal case out of it. It's not implausible.
    - jessaustin 10y ago
      You may not care about jackbooted thugs in the service of evil politicians, but they care about you.
- Zyst 10y ago
  I find that convenience is a perfectly acceptable reason to surrender personal safety/privacy. I'm not saying I personally agree, I'm saying I can respect it.
  - praptak 10y ago
    It is acceptable but not "perfectly". It is acceptable with an additional condition: if you also accept the fact that the act of surrendering your privacy increases the pressure to expose the privacy of those who are not so willing to expose theirs.
- bsder 10y ago
  Then they will use your unlocked phone and plant the evidence they need. At least, if they can't unlock the phone, then they even have to worry about the evidence they fabricate as you might have something that counters it on the phone.
- Terr_ 10y ago
  That only works if you trust the person looking. If the authorities are seeking to blame or frame or shame... suddenly you have everything to hide.
  - usrusr 10y ago
    Without trust, you have everything to protect from evidence planting.
roel_v 10y ago
From a glance at your profile, you hardly seem to be a person a government would be interested in (maybe you're a drug king pin in your off hours, don't tell me if you are). What is your threat profile? If you loose your phone and some kid racks up a few hundreds $ in whatever one can buy through a phone nowadays, is that threat worth less to you than the convenience of fingerprint phone locking? Why would you give up that convenience out of fear for something that is much less likely to happen than other, realistic threats? I know it's a snarky question because there is no way to phrase it without being so; but I honestly don't understand the reasoning behind 'convenience features are worthless/I turn them off because they're not 100% secure against [some powerful actor] that might hypothetically want to look at my phone'. I mean, they can get comms metadata from carriers; speech comms content from wiretaps; email content through subpoenas (minus those you encrypt with client-side tools, a major pain to do on a phone anyway). If you're going to run a coke line from South America or plan to overthrow the government or conspire to bomb immigrants, you're better off not using any such obvious electronic communication tools in the first place. So what's your reasoning?
- morganvachon 10y ago
  > From a glance at your profile, you hardly seem to be a person a government would be interested in He may not be someone the government is interested in right now, but as is clear in the case we all are discussing, the government is on a fishing expedition, seeking to unlock a non-suspect's phone in the hopes of making a suspect out of them. That's some 1980s USSR shit right there, and it's disheartening that our government is trying to become what they once fought against. They can get a warrant first, or they can get bent. To put it another way, you don't want your neighbor poking around in your garage looking for something she can report to the fire marshal "just because", even though you're pretty sure there's nothing she can call out, so you keep your garage locked.
- delinka 10y ago
  "...you hardly seem to be a person a government would be interested in..." "If you've got nothing to hide..." - right?
  - 10y ago
candiodari 10y ago
Do you travel ? In much if not all of Europe not giving your password, even to a random search when passing through (not entering the country), is a crime. Therefore legal advice is to provide custom agents and other police with access to any device upon request and then.
- golemotron 10y ago
  Forgetting your password is a crime? Have they consulted neurologists?
  - Kudos 10y ago
    You'd have to convince a judge of that.
- the-dude 10y ago
  Sources please. Only thing I can think of in the UK, something about forced to unencrypt. I do not carry a phone though.
  - iliketosleep 10y ago
    Wikipedia gives a good summary for each nation: https://en.wikipedia.org/wiki/Key_disclosure_law https://en.wikipedia.org/wiki/Key_disclosure_law
    - ljf 10y ago
      Key Disclosure Law is not what was implied by the parent: h >not giving your password, even to a random search
- ljf 10y ago
  Really? Never heard of that in the UK or when travelling in Europe, but I could be wrong. Do you have any links to more information on this?
  - 10y ago
lern_too_spel 10y ago
They don't even need to compel you. They get your fingerprint in the booking process and then they can reuse it however they please.
- r00fus 10y ago
  Does that really work on iPhones? Plus, if they ever get my phone, I'd do my best to ensure it's powered down (needs password to unlock from boot).
  - lern_too_spel 10y ago
    Yes, it works on iPhones. It doesn't even require specialized equipment. http://qz.com/631697/a-regular-inkjet-printer-can-spoof-a-fingerprint-and-unlock-a-phone-in-under-15-minutes/ http://qz.com/631697/a-regular-inkjet-printer-can-spoof-a-fi...
    - r00fus 10y ago
      From your link: "The process starts with a scanned photo of the target user’s fingerprint. This image is scanned, then some fiddling with contrast levels may be required." "Cao told Quartz that the spoof worked on the iPhone during an earlier attempt, but it didn’t work when he tried to replicate the result for the technical report. “We unlocked it at the start of the project, but when we prepared the report, I could not unlock the iPhone. I used the same protocol and method. I’m not sure why it didn’t unlock,” Cao said." I wouldn't exactly say this was a slam dunk then, eh? Seriously I'd like to know if someone can reproduce the exploit on film using non-exotic materials or process (ie, no latex glue or pre-existing high-resolution images). Of note, if feds can get fingerprints through existing paperwork, why do they need a seek a warrant for this?
      - lern_too_spel 10y ago
        > Of note, if feds can get fingerprints through existing paperwork, why do they need a seek a warrant for this? It's less work if the judge will approve it.

by yardie 10y ago

rhizome 10y ago

Yep. I got into a little argument with my brother over this last week, as he is a "I don't care, I have nothing to hide."

adventured 10y ago
My favorite fast response to disarm that is always: that's not up to you [whether or not you have something to hide]. I've found it instantly shakes the false comfort they're trying to derive from their premise and opens up a moment of rethink.
- roel_v 10y ago
  Not for me, I don't even understand your point. Of course it's up to me if I have something to hide. I have nothing on my phone that I wouldn't be perfectly OK with to have printed and displayed in a busy public place. How is it not up to me to decide what details of my life I have to hide?
  - morganvachon 10y ago
    Easy: Your contact list. You may not care who sees your list, but the people on your contact list would probably be upset if their private email address, cellphone number, chat name, home address and other personal data were exposed to the general public. Ditto any conversation you had with them via text; you may not care who sees the conversation, but your partner/friend/boss may object to having their privately texted words plastered all over Times Square. Your GPS location data is another good one. Hypothetically speaking, would you really want the public, which contains some seedy characters mixed in with the "normal" people, to see the route you take to drop off/pick up your daughter at school, making her easy pickings for a kidnapping? There's more than just the websites you browse and the people you talk to on your phone. It's a digital vault of every move you make, every question you ponder, every person you've interacted with, every store you shop at. Your banking data is there, your stocks, your hobbies, your bursts of anger, your outlook on life, your loved ones' and associates' addresses and contact information. In short, you hurt more than yourself by exposing your private data, whether to the public at large, the government, or commercial entities seeking to hoover it up for advertising revenue. It's your responsibility to keep it private.
    - munin 10y ago
      Do you ever find it ironic that you are trying to combat totalitarian fear-mongering with an argument that in part is literally "think of the children?"
      - morganvachon 10y ago
        It was just an example; besides, sometimes "think of the children" is the correct stance. If that is your only counter to my point, then I feel safe in my position. :-)
  - chillingeffect 10y ago
    Currently you have nothing on your phone that wouldn't be OK to be made public. Depending on who is in power in your area, that could change very quickly. If you're of the wrong race, someone like Donald Trump might use three-letter agency-collected data to move you out of the country. Foreign states might want to use your identity to get cheap health care for their citizens. Immigration policies, substance legal statuses and acceptable social practices and attitudes change overnight. Someone could spam with you child pornography and border officials could find it in your phone at the border. Furthermore, you don't know what you're going to do with the rest of your life and how the decisions you make now could be perceived in the future. Maybe someone's watching your house, keeping track of when you're not home. Or maybe they're using your phone patterns to do the same: Checking your phone when you're in the gym, in the bathroom at a restaurant. And any of these scenarios could be used to threaten you or someone you care about. Did a neighbor ask if you could babysit their children when they're away? Did your aunt admit she has a mental disorder that could get her fired? Did a friend reveal he has a substance abuse problem? Did your elderly parents send you copies of official financial documents to review? Ever looked for a "questionable" book on Amazon? Furthermore, if you're not following proper safety practices, you could be a liability for future business partners. Who wants to risk sharing data with someone who's loosey-goosey about the info on their systems? In conclusion, it's not just you, right now that bears thinking about. It's everyone in your social circle over the long-term future.
  - rdtsc 10y ago
    Do you mean that in the sense of: The police asks you to surrender you phone. Telling "you have nothing to hide, you shouldn't mind" and you respond with "It is not up to decide if I have something to hide" Or, your friend is arguing for letting the police see their phone because your friend has nothing to hide. Your friend says "I have nothing to hide". But you respond with "It is not up to you if you have nothing to hide, so you shouldn't have that attitude". Assuming you meant the second, what is the reasoning behind it?
    - rhizome 10y ago
      Say your friend is arrested for smoking pot in Arizona or Indiana or anywhere else that has draconian cannabis laws, now each of their contacts is possibly a dealer. They're in a different state? The DEA will be happy to help make a federal case out of it. It's not implausible.
  - jessaustin 10y ago
    You may not care about jackbooted thugs in the service of evil politicians, but they care about you.
Zyst 10y ago
I find that convenience is a perfectly acceptable reason to surrender personal safety/privacy. I'm not saying I personally agree, I'm saying I can respect it.
- praptak 10y ago
  It is acceptable but not "perfectly". It is acceptable with an additional condition: if you also accept the fact that the act of surrendering your privacy increases the pressure to expose the privacy of those who are not so willing to expose theirs.
bsder 10y ago
Then they will use your unlocked phone and plant the evidence they need. At least, if they can't unlock the phone, then they even have to worry about the evidence they fabricate as you might have something that counters it on the phone.
Terr_ 10y ago
That only works if you trust the person looking. If the authorities are seeking to blame or frame or shame... suddenly you have everything to hide.
- usrusr 10y ago
  Without trust, you have everything to protect from evidence planting.

roel_v 10y ago

From a glance at your profile, you hardly seem to be a person a government would be interested in (maybe you're a drug king pin in your off hours, don't tell me if you are). What is your threat profile? If you loose your phone and some kid racks up a few hundreds $ in whatever one can buy through a phone nowadays, is that threat worth less to you than the convenience of fingerprint phone locking? Why would you give up that convenience out of fear for something that is much less likely to happen than other, realistic threats? I know it's a snarky question because there is no way to phrase it without being so; but I honestly don't understand the reasoning behind 'convenience features are worthless/I turn them off because they're not 100% secure against [some powerful actor] that might hypothetically want to look at my phone'. I mean, they can get comms metadata from carriers; speech comms content from wiretaps; email content through subpoenas (minus those you encrypt with client-side tools, a major pain to do on a phone anyway). If you're going to run a coke line from South America or plan to overthrow the government or conspire to bomb immigrants, you're better off not using any such obvious electronic communication tools in the first place. So what's your reasoning?

morganvachon 10y ago
> From a glance at your profile, you hardly seem to be a person a government would be interested in He may not be someone the government is interested in right now, but as is clear in the case we all are discussing, the government is on a fishing expedition, seeking to unlock a non-suspect's phone in the hopes of making a suspect out of them. That's some 1980s USSR shit right there, and it's disheartening that our government is trying to become what they once fought against. They can get a warrant first, or they can get bent. To put it another way, you don't want your neighbor poking around in your garage looking for something she can report to the fire marshal "just because", even though you're pretty sure there's nothing she can call out, so you keep your garage locked.
delinka 10y ago
"...you hardly seem to be a person a government would be interested in..." "If you've got nothing to hide..." - right?
- 10y ago

candiodari 10y ago

Do you travel ? In much if not all of Europe not giving your password, even to a random search when passing through (not entering the country), is a crime. Therefore legal advice is to provide custom agents and other police with access to any device upon request and then.

golemotron 10y ago
Forgetting your password is a crime? Have they consulted neurologists?
- Kudos 10y ago
  You'd have to convince a judge of that.
the-dude 10y ago
Sources please. Only thing I can think of in the UK, something about forced to unencrypt. I do not carry a phone though.
- iliketosleep 10y ago
  Wikipedia gives a good summary for each nation: https://en.wikipedia.org/wiki/Key_disclosure_law https://en.wikipedia.org/wiki/Key_disclosure_law
  - ljf 10y ago
    Key Disclosure Law is not what was implied by the parent: h >not giving your password, even to a random search
ljf 10y ago
Really? Never heard of that in the UK or when travelling in Europe, but I could be wrong. Do you have any links to more information on this?
- 10y ago

lern_too_spel 10y ago

They don't even need to compel you. They get your fingerprint in the booking process and then they can reuse it however they please.

r00fus 10y ago
Does that really work on iPhones? Plus, if they ever get my phone, I'd do my best to ensure it's powered down (needs password to unlock from boot).
- lern_too_spel 10y ago
  Yes, it works on iPhones. It doesn't even require specialized equipment. http://qz.com/631697/a-regular-inkjet-printer-can-spoof-a-fingerprint-and-unlock-a-phone-in-under-15-minutes/ http://qz.com/631697/a-regular-inkjet-printer-can-spoof-a-fi...
  - r00fus 10y ago
    From your link: "The process starts with a scanned photo of the target user’s fingerprint. This image is scanned, then some fiddling with contrast levels may be required." "Cao told Quartz that the spoof worked on the iPhone during an earlier attempt, but it didn’t work when he tried to replicate the result for the technical report. “We unlocked it at the start of the project, but when we prepared the report, I could not unlock the iPhone. I used the same protocol and method. I’m not sure why it didn’t unlock,” Cao said." I wouldn't exactly say this was a slam dunk then, eh? Seriously I'd like to know if someone can reproduce the exploit on film using non-exotic materials or process (ie, no latex glue or pre-existing high-resolution images). Of note, if feds can get fingerprints through existing paperwork, why do they need a seek a warrant for this?
    - lern_too_spel 10y ago
      > Of note, if feds can get fingerprints through existing paperwork, why do they need a seek a warrant for this? It's less work if the judge will approve it.