8 ms·

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-re

by apeace 9y ago

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN This is what has been missing from every discussion of this issue that I've seen so far. The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get in the security line! Pin will be required on start. Pin is also required when plugging into a new computer. The rest of the time when you're going about your daily life, and are not worried about a government agent spoofing your face or pointing the phone at your face, you can use this nice feature. Most people will be _less_ secure without it. They don't want to punch a pin every time they want to tap their phone to pay for coffee. So without the face scan feature, they will opt for no security at all. The reboot/plug-in pin requirements change the discussion quite a bit, but are usually ignored, seemingly so bloggers can state the obvious "but someone can spoof your face!"

n42 9y ago
On top of this, iOS 11 introduced an emergency mode that is enabled by tapping the standby button five times rapidly. It is easy to do discretely in your pocket, and it locks your phone by requiring your passcode to be entered again.
- joombaga 9y ago
  You can achieve the same effect on some Android devices by exploiting the password lock from scanning the wrong finger repeatedly.
  - irq-1 9y ago
    If a judge issues a warrant allowing the police to compel the use of biometrics, can a person use the wrong finger? Courts can't compel someone enter their PIN. So can a court compel not only biometric "use" but the correct biometric? My Android forces PIN entry after 5 wrong fingerprints.
    - tonyztan 9y ago
      If you refuse to tell them which finger you used, and comply by only pressing whichever finger they ask you to press, they will have a 10% chance of getting in each time. So if you chose only 1 finger and you chose it randomly, they will have a 50% chance of getting in after 5 attempts.
      - ithkuil 9y ago
        And hope they're biased against the middle finger
  - valuearb 9y ago
    You've always been able to do this on iOS as well, but it risks an obstruction of justice charge.
- crindy 9y ago
  One thing to note: It's at least five times, not exactly. Just click that side button until your phone vibrates a bit and it's locked. I mainly see myself using this feature in high stress situations, like going through airport security or being pulled over, so not needing to count is a small plus.
- knolan 9y ago
  It's also worth pointing out that iOS already has an option to erase your phone when the PIN is entered incorrectly a certain number of times. A lot of companies enforce this if you receive your work email on your device (eight times in my case). So if you are in a situation where a PIN is being demanded there's still a way to keep secure. Your phone can be easily restored from an iCloud backup once you've got access to wifi. You can always restore from another device or backup if there's data you don't want seen if somehow you can be compelled to do a restore.
  - andrei_says_ 9y ago
    I'm not sure how I feel about storing 100+ GB in icloud and restoring it via my data plan.
    - giobox 9y ago
      Local encrypted backups via itunes are an option too, if you are traveling with a laptop.
      - kccqzy 9y ago
        Is that still going to work? I have the impression that Apple is simplifying iTunes and removing everything but audio and video.
        giobox 9y ago
        I haven't tried since installing itunes 12.7 (the version that removes the App Store etc), but reports I've read suggest it still backs up everything with the notable exception of apps. These have to re-download from the appstore on the phone iteself presumably now. I'm assuming though that all app data is preserved (one would hope so!). Happy to be corrected if this proves not the case. From macdailynews: "iTunes backups are still there for iOS devices, but performing a restore won’t transfer your apps from your Mac, but will instead download them over the Internet from Apple, which is, of course, likely to be slower."
bodz 9y ago
> The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get in the security line! Pin will be required on start. As far as border searches go, border officers have the authority to request your PIN just as they have the authority to request your thumbprint/faceprint/etc. If you don't give it to them, you can be detained and/or your phone confiscated [1]. Rebooting your phone won't help. 1: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2017/02/13/can-federal-agents-detain-citizens-at-border-checkpoints-until-they-disclose-their-smartphone-passcodes/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...
- jfoutz 9y ago
  Also, the border is 100 miles from the Mexico/Canada borders and 100 miles from the shore. So, if you're concerned it's not when you're entering or leaving the country. It's any time you're in LA, NY, DC, SF, Huston or Detroit. Or any of the other thousands of miles of border.
  - ianmiers 9y ago
    Common misconception: If you have crossed the boarder, then within 100 miles of it they can search you. Of course, how you prove you didn't cross the boarder is an open question. But you can in fact refuse the search on that claim. I suppose they may detain you then.
    - jfoutz 9y ago
      I think you're looking for the phrase `probable cause`. If the officer has probable cause to think you crossed the border, they can search you. I'm not a lawyer, but i think they can search you anyway. It just won't be admissible in court. edit to clarify, US law pushes police right up to the edge. there is a preference for false positives rather than false negatives. it's more important to catch all of the criminals than it is to inconvenience some innocent people. The risk of letting one criminal go is much more than cost of detaining a doctor for a couple of hours. Now, we're in this weird time where that doctor can have 20 years of hippa protected medical records in their pocket that they might be forced to disclose. Historically, that doctor may have some records in a briefcase, but not tens of thousands.
OkGoDoIt 9y ago
Since I use fingerprint authentication for the vast majority of authentications with my iPhone, I set the actual pin to a complex alphanumeric password. I only have to enter it a few times a week, so it’s worth the hassle. In this sense fingerprint authentication has significantly improved the security of my phone, because it’s so much more difficult to shoulder surf that alphanumeric password that it is a 4/6 digit numeric pin. Biometric authentication definitely seems like a win to me.
gist 9y ago
I don't want to be that 'if you've got nothing to hide then' guy but why are people so worried about what border agents in particular will see on their cell phone? I am not saying that I wouldn't mind at all if my phone was searched. But I can't think of anything in particular that I would be concerned about if it was. Sure in theory the agent could remember some personal information and come back later and use that info or pass it to someone for some nefarious purpose. But that's a pretty small chance event. It's more or less the equivalent of thinking you will get sick because you find a hair in your food at the restaurant. You don't like it and you send it back or demand a refund but the actual harm is more mental in nature. Or what am I missing here?
- kibwen 9y ago
  Depends on how difficult it is to produce an automated system whereby one needs only plug an unlocked phone into a computer in order to hoover up all locally-stored messages, contacts, saved passwords, synced browser histories, etc. The agent themselves doesn't need to care, they can just be instructed to "unlock the phone, plug it in to this computer, wait until the progress bar finishes, hand phone back". Are you on Github? Is your Github password saved in your browser? Do you have commit access to any marginally important projects? God only knows who has commit access to those projects now. Considering this is HN, I imagine this is an attack vector that a lot of people here are particularly concerned about. Given how much code we use that's written by others, it ought to concern the rest of us as well. :)
  - late2part 9y ago
    This is not an attack. This is iTunes. This is trivial to do.
- slazaro 9y ago
  What if they automate the search and copy all your data for further mining and save all that info to see if you're not "desirable" for the "people in power"?
- colejohnson66 9y ago
  It’s not about agents looking at your phone; it’s about the slow erosion of our rights among other things
ojbyrne 9y ago
In addition, most customs/immigration lines have signs requiring you to turn off your phone.
dpkonofa 9y ago
You don't even have to do that anymore. With the new OS that will be standard on the new iPhones, you can just tap the power button 5 times to put it into a forced-lock mode. It'll require the use of your passcode before Face ID or Touch ID can be activated.
deleted 9y ago
[deleted]

by apeace 9y ago

n42 9y ago

On top of this, iOS 11 introduced an emergency mode that is enabled by tapping the standby button five times rapidly. It is easy to do discretely in your pocket, and it locks your phone by requiring your passcode to be entered again.

joombaga 9y ago
You can achieve the same effect on some Android devices by exploiting the password lock from scanning the wrong finger repeatedly.
- irq-1 9y ago
  If a judge issues a warrant allowing the police to compel the use of biometrics, can a person use the wrong finger? Courts can't compel someone enter their PIN. So can a court compel not only biometric "use" but the correct biometric? My Android forces PIN entry after 5 wrong fingerprints.
  - tonyztan 9y ago
    If you refuse to tell them which finger you used, and comply by only pressing whichever finger they ask you to press, they will have a 10% chance of getting in each time. So if you chose only 1 finger and you chose it randomly, they will have a 50% chance of getting in after 5 attempts.
    - ithkuil 9y ago
      And hope they're biased against the middle finger
- valuearb 9y ago
  You've always been able to do this on iOS as well, but it risks an obstruction of justice charge.
crindy 9y ago
One thing to note: It's at least five times, not exactly. Just click that side button until your phone vibrates a bit and it's locked. I mainly see myself using this feature in high stress situations, like going through airport security or being pulled over, so not needing to count is a small plus.
knolan 9y ago
It's also worth pointing out that iOS already has an option to erase your phone when the PIN is entered incorrectly a certain number of times. A lot of companies enforce this if you receive your work email on your device (eight times in my case). So if you are in a situation where a PIN is being demanded there's still a way to keep secure. Your phone can be easily restored from an iCloud backup once you've got access to wifi. You can always restore from another device or backup if there's data you don't want seen if somehow you can be compelled to do a restore.
- andrei_says_ 9y ago
  I'm not sure how I feel about storing 100+ GB in icloud and restoring it via my data plan.
  - giobox 9y ago
    Local encrypted backups via itunes are an option too, if you are traveling with a laptop.
    - kccqzy 9y ago
      Is that still going to work? I have the impression that Apple is simplifying iTunes and removing everything but audio and video.
      - giobox 9y ago
        I haven't tried since installing itunes 12.7 (the version that removes the App Store etc), but reports I've read suggest it still backs up everything with the notable exception of apps. These have to re-download from the appstore on the phone iteself presumably now. I'm assuming though that all app data is preserved (one would hope so!). Happy to be corrected if this proves not the case. From macdailynews: "iTunes backups are still there for iOS devices, but performing a restore won’t transfer your apps from your Mac, but will instead download them over the Internet from Apple, which is, of course, likely to be slower."

bodz 9y ago

> The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get in the security line! Pin will be required on start. As far as border searches go, border officers have the authority to request your PIN just as they have the authority to request your thumbprint/faceprint/etc. If you don't give it to them, you can be detained and/or your phone confiscated [1]. Rebooting your phone won't help. 1: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2017/02/13/can-federal-agents-detain-citizens-at-border-checkpoints-until-they-disclose-their-smartphone-passcodes/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

jfoutz 9y ago
Also, the border is 100 miles from the Mexico/Canada borders and 100 miles from the shore. So, if you're concerned it's not when you're entering or leaving the country. It's any time you're in LA, NY, DC, SF, Huston or Detroit. Or any of the other thousands of miles of border.
- ianmiers 9y ago
  Common misconception: If you have crossed the boarder, then within 100 miles of it they can search you. Of course, how you prove you didn't cross the boarder is an open question. But you can in fact refuse the search on that claim. I suppose they may detain you then.
  - jfoutz 9y ago
    I think you're looking for the phrase `probable cause`. If the officer has probable cause to think you crossed the border, they can search you. I'm not a lawyer, but i think they can search you anyway. It just won't be admissible in court. edit to clarify, US law pushes police right up to the edge. there is a preference for false positives rather than false negatives. it's more important to catch all of the criminals than it is to inconvenience some innocent people. The risk of letting one criminal go is much more than cost of detaining a doctor for a couple of hours. Now, we're in this weird time where that doctor can have 20 years of hippa protected medical records in their pocket that they might be forced to disclose. Historically, that doctor may have some records in a briefcase, but not tens of thousands.

OkGoDoIt 9y ago

Since I use fingerprint authentication for the vast majority of authentications with my iPhone, I set the actual pin to a complex alphanumeric password. I only have to enter it a few times a week, so it’s worth the hassle. In this sense fingerprint authentication has significantly improved the security of my phone, because it’s so much more difficult to shoulder surf that alphanumeric password that it is a 4/6 digit numeric pin. Biometric authentication definitely seems like a win to me.

gist 9y ago

I don't want to be that 'if you've got nothing to hide then' guy but why are people so worried about what border agents in particular will see on their cell phone? I am not saying that I wouldn't mind at all if my phone was searched. But I can't think of anything in particular that I would be concerned about if it was. Sure in theory the agent could remember some personal information and come back later and use that info or pass it to someone for some nefarious purpose. But that's a pretty small chance event. It's more or less the equivalent of thinking you will get sick because you find a hair in your food at the restaurant. You don't like it and you send it back or demand a refund but the actual harm is more mental in nature. Or what am I missing here?

kibwen 9y ago
Depends on how difficult it is to produce an automated system whereby one needs only plug an unlocked phone into a computer in order to hoover up all locally-stored messages, contacts, saved passwords, synced browser histories, etc. The agent themselves doesn't need to care, they can just be instructed to "unlock the phone, plug it in to this computer, wait until the progress bar finishes, hand phone back". Are you on Github? Is your Github password saved in your browser? Do you have commit access to any marginally important projects? God only knows who has commit access to those projects now. Considering this is HN, I imagine this is an attack vector that a lot of people here are particularly concerned about. Given how much code we use that's written by others, it ought to concern the rest of us as well. :)
- late2part 9y ago
  This is not an attack. This is iTunes. This is trivial to do.
slazaro 9y ago
What if they automate the search and copy all your data for further mining and save all that info to see if you're not "desirable" for the "people in power"?
colejohnson66 9y ago
It’s not about agents looking at your phone; it’s about the slow erosion of our rights among other things

ojbyrne 9y ago

In addition, most customs/immigration lines have signs requiring you to turn off your phone.

dpkonofa 9y ago

You don't even have to do that anymore. With the new OS that will be standard on the new iPhones, you can just tap the power button 5 times to put it into a forced-lock mode. It'll require the use of your passcode before Face ID or Touch ID can be activated.

deleted 9y ago

[deleted]