5 ms·

Face ID is going to screw this all up. Cops won't even need your cooperation to unlock.

valine 9y ago
Apple is adding a kill switch to iOS 11 that lets you discreetly disable Touch ID (and presumably Face ID) by hitting the power button 5 times. And of course if you're concerned you can opt out of Touch or Face ID entirely and simply use a pass-code. https://www.theverge.com/2017/8/17/16161758/ios-11-touch-id-disable-emergency-services-lock https://www.theverge.com/2017/8/17/16161758/ios-11-touch-id-...
- X86BSD 9y ago
  I think I would prefer the passcode which can be set to a length much larger than 4 digits when travelling or getting anywhere near fed-gov.
  - extrapickles 9y ago
    iOS lets you set a complex password instead of a 4 digit pin (turn off the "simple passcode" setting).
  - bobsil1 9y ago
    Default PIN has been 6 digits since iOS 10, and you can make it a long passphrase instead.
    - X86BSD 9y ago
      I am aware. I don't know why I phrased it the way I did. I meant I would rather use that feature of the longer passcode instead of facial recognition. Bad grammar for the win.
- rorosaurus 9y ago
  Thanks for sharing that info, but I think the problem is that Apple is marketing these methods of identification as methods of authentication. Sacrificing security for convenience. Even if they have a kill switch in place, the users least likely to know about it are the users who are most likely to use insecure methods to "secure" their phone, I would think.
  - aiyodev 9y ago
    There were two sentences in his post. You only read the first one.
- lathiat 9y ago
  Something that I think people underestimate is just how easy it is to observe you entering your password on a phone, and why that (in my opinion) makes thumbprints much more secure than passwords for casual usage - e.g. every-time you unlock your phone. All you need is a camera over your shoulder and you don't even need to observe the key-presses as generally the current character is displayed on screen. You could likely observe 100s or 1000s of them a day with an overhead camera at transit stations and the like. The same thing goes for "Tap And Go" contact less payments not requiring a PIN number under $100. Everyone goes on about how people can run up a few hundred dollars at different stores with your card if they steal it. But consider exposing your pin to surveillance during most common transactions which then also lets you remove cash from an ATM with that card if stolen which is much harder to recover and is also much higher value than the generally $30-$100 limit for transactions without a PIN. Next minute you'll freak out when I tell you I can clone your house key from a photo of it hanging off your belt... The general point is that security trade-offs are generally deeper than you might realise on the surface, especially at "public outrage" levels of observation which so frequently haunt the public mind in recent times. I'm not sold on this Face ID business yet though.. will see how it is presented tomorrow.
eugeniub 9y ago
How is that different from Touch ID?
- saagarjha 9y ago
  Presumably they can just point the phone at your face instead of forcing you to put your finger on the sensor.
- r00fus 9y ago
  TouchID has 3-5 tries before it gives up and requires password. There are 10 fingers + failed presses. It can also be turned off in duress (or will deactivate after a few hours or after reboot). I always turn off my iPhone for checkpoints or traffic stops. They want it, they can decrypt it the hard way.
vlozko 9y ago
Too soon to tell. For all we know, Face ID may give you the option to provide a facial expression to unlock.
- fiatpandas 9y ago
  That's a great capability I hadn't considered. Your passcode isn't just a 3d composite of your face, but instead could be a 3d composite of your face performing a specific gesture over a short amount of time (wink, kiss, tilt, etc). Would be harder to spoof.
  - bobsil1 9y ago
    "I'm sorry, Bob. You didn't make a stink face. Would you like to try again?"
    - LeoNatan25 9y ago
      http://s2.dmcdn.net/LF_3z/1280x720-95I.jpg http://s2.dmcdn.net/LF_3z/1280x720-95I.jpg
  - jon_richards 9y ago
    Is a facial expression speech? One of the issues with touch ID is that biometrics aren't protected by the 4th, while passwords and the like are. It would be an interesting question whether a court can compel you to make a certain expression.
- lathiat 9y ago
  I'm patenting the Duck(face)Lock(TM)(R)(C)(Registered)(DontStealMe) immediately

Apple is adding a kill switch to iOS 11 that lets you discreetly disable Touch ID (and presumably Face ID) by hitting the power button 5 times. And of course if you're concerned you can opt out of Touch or Face ID entirely and simply use a pass-code. https://www.theverge.com/2017/8/17/16161758/ios-11-touch-id-disable-emergency-services-lock https://www.theverge.com/2017/8/17/16161758/ios-11-touch-id-...

X86BSD 9y ago
I think I would prefer the passcode which can be set to a length much larger than 4 digits when travelling or getting anywhere near fed-gov.
- extrapickles 9y ago
  iOS lets you set a complex password instead of a 4 digit pin (turn off the "simple passcode" setting).
- bobsil1 9y ago
  Default PIN has been 6 digits since iOS 10, and you can make it a long passphrase instead.
  - X86BSD 9y ago
    I am aware. I don't know why I phrased it the way I did. I meant I would rather use that feature of the longer passcode instead of facial recognition. Bad grammar for the win.
rorosaurus 9y ago
Thanks for sharing that info, but I think the problem is that Apple is marketing these methods of identification as methods of authentication. Sacrificing security for convenience. Even if they have a kill switch in place, the users least likely to know about it are the users who are most likely to use insecure methods to "secure" their phone, I would think.
- aiyodev 9y ago
  There were two sentences in his post. You only read the first one.
lathiat 9y ago
Something that I think people underestimate is just how easy it is to observe you entering your password on a phone, and why that (in my opinion) makes thumbprints much more secure than passwords for casual usage - e.g. every-time you unlock your phone. All you need is a camera over your shoulder and you don't even need to observe the key-presses as generally the current character is displayed on screen. You could likely observe 100s or 1000s of them a day with an overhead camera at transit stations and the like. The same thing goes for "Tap And Go" contact less payments not requiring a PIN number under $100. Everyone goes on about how people can run up a few hundred dollars at different stores with your card if they steal it. But consider exposing your pin to surveillance during most common transactions which then also lets you remove cash from an ATM with that card if stolen which is much harder to recover and is also much higher value than the generally $30-$100 limit for transactions without a PIN. Next minute you'll freak out when I tell you I can clone your house key from a photo of it hanging off your belt... The general point is that security trade-offs are generally deeper than you might realise on the surface, especially at "public outrage" levels of observation which so frequently haunt the public mind in recent times. I'm not sold on this Face ID business yet though.. will see how it is presented tomorrow.

eugeniub 9y ago

How is that different from Touch ID?

saagarjha 9y ago
Presumably they can just point the phone at your face instead of forcing you to put your finger on the sensor.
r00fus 9y ago
TouchID has 3-5 tries before it gives up and requires password. There are 10 fingers + failed presses. It can also be turned off in duress (or will deactivate after a few hours or after reboot). I always turn off my iPhone for checkpoints or traffic stops. They want it, they can decrypt it the hard way.

vlozko 9y ago

Too soon to tell. For all we know, Face ID may give you the option to provide a facial expression to unlock.

fiatpandas 9y ago
That's a great capability I hadn't considered. Your passcode isn't just a 3d composite of your face, but instead could be a 3d composite of your face performing a specific gesture over a short amount of time (wink, kiss, tilt, etc). Would be harder to spoof.
- bobsil1 9y ago
  "I'm sorry, Bob. You didn't make a stink face. Would you like to try again?"
  - LeoNatan25 9y ago
    http://s2.dmcdn.net/LF_3z/1280x720-95I.jpg http://s2.dmcdn.net/LF_3z/1280x720-95I.jpg
- jon_richards 9y ago
  Is a facial expression speech? One of the issues with touch ID is that biometrics aren't protected by the 4th, while passwords and the like are. It would be an interesting question whether a court can compel you to make a certain expression.
lathiat 9y ago
I'm patenting the Duck(face)Lock(TM)(R)(C)(Registered)(DontStealMe) immediately