13 ms·
Police told to avoid looking at recent iPhones to avoid lockouts
- goldenkey 8y agoThats just comically funny. "Hey cellmate, I need you to punch my face in." "You sure dude?" "Yeah, they are gonna make me unlock my phone today...gotta make it fail!"
- jimworm 8y agoA PSA on biometric security's weakness against coercion - including law enforcement, but likely more often abusive spouses or employers.
- icebraining 8y agoUnlike the courts, an abusive spouse or employer won't presume innocence. They will take your initial refusal to insert PIN/password as proof of guilt and coerce you into doing so.
- rocqua 8y agoWith a spouse the 'threat' is that they can unlock your phone when you're sleeping. This isn't about giving in to coercion, but about covert access. Not sure how this works with an employer though.
- flixic 8y agoThat's why iPhones have "Require Attention" option, that checks that your eyes are open and looking into the TrueDepth sensor.
- pbhjpbhj 8y agoHow do they cope against a video of you, like if I pretend to take a selfie but video instead, oh whoops .. but then I have a video to use to unlock your phone? Or police could use the mugshot process to get a video?
- icebraining 8y agoThe iPhone camera makes a 3D "scan" by projecting infrared dots onto the face, so putting a screen or sheet in front won't work. https://en.wikipedia.org/wiki/Structured-light_3D_scanner https://en.wikipedia.org/wiki/Structured-light_3D_scanner
- pbhjpbhj 8y agoCool, I missed that development; seems it needs a bit of work to crack - https://www.wired.com/story/hackers-say-broke-face-id-security/ https://www.wired.com/story/hackers-say-broke-face-id-securi....
- JustSomeNobody 8y agoIf it’s to this point she needs to leave.
- colanderman 8y agoThat's not helpful advice to someone trapped in an abusive relationship.
- colanderman 8y agoTo clarify: if someone is at the point where their SO is snooping around their phone at night, there is a potentially dangerous power imbalance in the relationship. Step one is not "leave". That may not be possible without catastrophic effect in some cases (think stalking, violence, blackmail). Rather, step one is to prevent the toxic SO from gaining more power over you. (Step two is to reduce their power.) Technology that automatically prevents them from snooping on your digital life is a great way to do this. (And yes, it is best if the tech is a given. If a toxic partner notices that you are taking actions to keep them at bay, that can be dangerous too. E.g. this is why Facebook broadcasting idle time to everyone in your network is terrible for those with stalkers. The implementors of that feature should be ashamed.)
- tux1968 8y agoBiometric authentication should stop working once a lockout has been triggered.
- gok 8y agoOn iPhones it does.
- techsupporter 8y agoDiscussion on a similar article here: https://news.ycombinator.com/item?id=18208954 https://news.ycombinator.com/item?id=18208954 (65 comments)
- netgusto 8y agoMaybe a stupid question, but how comes they cannot just obstruct the front sensors for faceid to fail?
- orcs 8y agoThat's what I thought. Just like making sure the phone doesn't connect to the internet so it can't be remotely wiped. I don't own an iPhone so I might be wrong but can't the cop just tape over the camera/sensor?
- janekm 8y agoMost likely they would place it in a shielding bag to cover both issues.
- quickthrower2 8y agoThat is a good reason not to use face recognition.
- okket 8y agoSo you are fine with always type in a long password/numbers in public? And sure nobody looks at you/films your typing?
- quickthrower2 8y agoIts a tradeoff. It depends how defensive you want to be against law enforcement. You could change the password on a regular basis as mitigation against prying eyes.
- akvadrako 8y agoExcept the law is most likely to be the ones watching you entering the password. So the tradeoff is about one attack vs another.
- philipbjorge 8y agoOn iPhone X, you can hold the power button and volume up for 5 seconds and it will lock the phone, disable Face ID, and force entering your passcode to unlock.
- tehmaco 8y agoYou can also tap the power button five times in a row, which brings up the emergency screen (Power Off, Medical ID, SOS call), but also disables face recognition until a pin unlock has happened.
- reneherse 8y agoNote this initiates an alarm and emergency call, with a three second window in which to cancel. Quite a surprise!!
- deleted 8y ago[deleted]
- Chazprime 8y agoProbably best not to disable the “Require Attention” option for facial recognition - then if your eyes are closed or not focused on the phone, it won’t unlock.
- sbr464 8y agoDupe https://news.ycombinator.com/item?id=18208954 https://news.ycombinator.com/item?id=18208954
- ysr23 8y ago[european here] I can't read this article as there is no way to opt-out of the tracking - isn't this in breach of GDPR?
- berdario 8y agoI'm pretty sure it is. I also spent some time to click around to find the opt-out toggle, but that's nowhere to be found. I guess that sooner or later they'll be forced into compliance.
- antidesitter 8y ago> I guess that sooner or later they'll be forced into compliance. Forced by whom?
- ZoomStop 8y agoA fellow HN detailed how he did it here, seems extremely non-intuitive. https://news.ycombinator.com/item?id=17235923 https://news.ycombinator.com/item?id=17235923
- yholio 8y agoIt's somewhat easier to just browse in Firefox's private mode all the time with trakingprotection enabled and no 3rd party cookies. Nothing is shared with the tracking networks and any cookie set by the site itself is deleted at the end of the session. As for the consent and GDPR annoyances themselves, they can be killed easily with uBlock (along with the ads etc.). Welcome to the smooth, no-tracking surfing experience of circa 2003.
- jhabdas 8y agoHope you're also using garlic encryption and blocking other apps which might (probably are) sniping on you anyway.
- LaGrange 8y agoAs long as it's not opt-in, I'm pretty sure it is a breach. I really hope EU gets its act together on this before the law becomes functionally dead.
- jhabdas 8y agoThough the iPhone X series uses a special chip to store the face I never read it doesn't site the face of others. None of this really matters though as any "authority" looking at your phone has the power to force you to unlock it against your will. New Zealand, for example, recently instituted a $5000 maximum fine for individuals at airports who are unwilling to unlock their phones even asked by "officials". Both the US and NZ, along with several other countries, are part of the same surveilance ring. So if you think not looking at your phone matters in the slightest it doesn't. Not at all.
- qwertay 8y agoSeems like it would be best to totally wipe all of your devices before crossing a boarder and restore from backup over the internet when you are over it.
- pandapower2 8y agoCurious what the border control response is to being handed a phone that has clearly been wiped immediately before the flight.
- chris_wot 8y agoTell them it’s a new iPhone.
- _jal 8y agoWhat are they going to do, demand a replacement with real data? It is the phone you're traveling with. The point is supposed to be about bringing illegal stuff into the country. A blank phone contains none. If they want to explain that they need fed juicy private stuff for admission, well, I'd love to hear all the details about that.
- falcolas 8y ago> What are they going to do If it comes to the point where they're wanting to look at your devices, their response to stock devices with no data will be to confiscate your device, detain you, and/or turn you away from crossing the border.
- nnd 8y agoA quick reminder: on iPhone X you can hold power button + one of the volume up/down buttons for 2 seconds to temporarily disable Face ID.
- jorvi 8y agoAnd if your movement is restricted, “Hey Siri, who am I?” will also trigger a lockout requiring a PIN. Edit: for clarification - this will not lock your phone by itself. If your phone is locked (so on your lockscreen with the lock icon still there) it will trigger a lockout and won’t allow biometric authentication until your PIN has been entered.
- joshstrange 8y agoJust tried this and it didn't work, (iPhone XS Max iOS 12.0)
- jorvi 8y agoAre you doing this with your lock screen in the ‘unlocked’ state or in the ‘locked’ state? If the lock screen is already unlocked, it doesn’t work (and wouldn’t matter, since whatever adversary you have already has access to your phone). Try it again with your phone locked and the screen off. If it still doesn’t work, report it as a bug to Apple. I can personally vouch for it working on a 6, 6S, 7 and X.
- village-idiot 8y agoTried it locked and unlocked. No difference.
- jorvi 8y agoFollow my comment tree with joshstrange. You basically need a ‘my info’/‘my contact’ card configured.
- sorahn 8y ago
- andraganescu 8y agoOath's gdpr wizard îs torture. I hope they will pay their share of fines for it, just to compensate for the time wasted ...
- IshKebab 8y agoMe too but has anyone actually been fined for this sort of thing yet? I tried to report one site to the UK ICO and didn't even get an automated email reply. Seems like the law exists but there's nobody to enforce it.
- deleted 8y ago[deleted]
- smaili 8y agoVery strange. I submitted this story about a half day ago and was marked as a dupe.
- dang 8y agoNot so strange; it's just that moderators don't see everything.
- kgwxd 8y agoFace id and finger print id, unless used in addition to, not instead of, a passcode, are convenience features, not security features. Removing the "something you know" part of digital security makes anything else just shy of useless. Apple should remove the options or start using honest terminology in the configuration steps if they actually care about security.
- dbuder 8y agoIf you're not a US citizen you do not get the 5th amendment protection and will be coerced into providing your passcode.