11 ms·

Cops can force your finger onto an iPhone to see if it unlocks, says judge

138 points by kofejnik 8y ago

dsfyu404ed 8y ago
>Specifically, Judge Judith Dein, of the federal district court of Massachusetts, gave agents from the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) the right to press Robert Brito-Pina's fingers on any iPhone found in his apartment in Boston. The bloke was suspected to be trafficking guns, hence the application for a search warrant Yesterday in the thread about the MA state police getting told they need a warrant for real time location date I said that MA judges will consider politics when reading the law. This is exactly what I mean. MA really doesn't like guns (this is a statement of fact, I'm not going to get into a discussion of whether that hate is justified). It's no surprise that a MA judge allowed the state to go after someone accused of a firearms related crime. Had this been the DEA asking for a warrant for a drug trafficker's phone the judge would likely have ruled the other way. >Jacobsen notes that gun traffickers "often use cellular telephones to acquire or sell illegal guns" and that they are "normally maintained for reasonably long periods of time because they are expensive, can often be subject to long-term contracts that contain substantial penalties for early termination, can store large amounts of information, and do not easily wear out." He also notes that even when people buy a new phone, they will typically transfer the contents of their old phone onto it. What BS. People who make their living trafficking in illegal things use burners for their business. Everyone with a brain knows this. The ATF know they are not likely to find anything on that phone they don't already know. The ATF is just looking to set a precedent and they picked a forum likely to let them set that precedent. FYI the second page of this article includes a pretty good summary of relevant case law to date.
- ataturk 8y ago
  You only got downvoted because most HN people hate guns, too. Never mind that free people owning guns is the only thing standing in the way of total "boot on the face" tyranny like China has. It's the one little last check against oppression that every Venezuelan wishes they had right now. It disgusts me that Massachusetts, home of Boston, home of the American Revolution, would stoop so low. But Marxists gonna Marxist no matter what.
- bradyd 8y ago
  You are confusing the state and federal judges. The new MA law doesn't apply to federal agencies and this was a federal judge not a state judge and the ATF is a federal agency.
  - dsfyu404ed 8y ago
    >You are confusing the state and federal judges. Districts and states more or less align. You're not going to get a judge who's worked their career in Arkansas appointed to a federal position in MA unless there's some edge case political shenanigans going on. For all practical purposes this guy is an MA, or at least New England judge. >The new MA law doesn't apply to federal agencies and this was a federal judge not a state judge There is no new MA law relevant here. I'm simply contrasting this with the ruling discussed yesterday.
- drak0n1c 8y ago
  In related context about MA judges arbitrarily applying or not applying the law, Judge Shelley Joseph was charged yesterday with improperly ending court proceedings and aiding the escape of a felon. https://www.wcvb.com/article/massachusetts-judge-trial-court-officer-to-face-federal-charges-on-suspicion-of-helping-immigrant-evade-ice-officer/27271791 https://www.wcvb.com/article/massachusetts-judge-trial-court...
AmericanPriot11 8y ago
with FaceID american cops can leave you tied to waterboarding table.
hprotagonist 8y ago
Not that this is a good solution, but it is a semi-practical countermeasure: mashing the power button 5 times on an iPhone disables all biometrics immediately, starts an audible siren countdown, and calls 911 if not dismissed. Holding power + volume up for a few seconds disables biometrics silently. I long ago enabled the "10 failed logins in a row deletes the phone" toggle. edit: There are two ways to disable biometrics for post-iPhoneX models, which are described above. Pre iPhoneX, there is no panic-mode-with-a-siren, but 5 clicks of the power button will disable biometrics. I routinely do this before i go through the TSA complimentary-preflight-massage line, when i'm within about 50 miles of the mexico border, and whenever i'm pulled over at a traffic stop. and i'm not even doing anything particularly interesting. At least this case involved An Actual Warrant. It's not the best, but it's a whole lot better than the no-warrant scenario.
- athenot 8y ago
  > I long ago enabled the "10 failed logins in a row deletes the phone" toggle. Unfortunately this is not adviseable if you have small children. A relative of mine saw her phone get wiped after letting my toddler fiddle with it for a few minutes.
  - RandallBrown 8y ago
    This happened to a coworker of mine once. The feature was turned on by our IT department after he set up his work email on the device so he didn't really know about it. He came to work one day pretty upset about Apple's "Delete your iPad when your kid plays with it" feature.
    - mieseratte 8y ago
      > The feature was turned on by our IT department after he set up his work email on the device so he didn't really know about it. Perhaps don't let children fiddle with your work devices? That just sounds like an accident waiting to happen.
      - 8y ago
mLuby 8y ago
Basically, biometrics aren't protected like knowledge (a password) is. Fine, sometimes the old ways are best. Here's hoping the next big feature for iOS and Android is a panic passcode that unlocks a totally banal version of the OS. That's the one of two places I see this ending, the other being always-on government (possibly corporate) spying embedded.
- skocznymroczny 8y ago
  Well, alternatively the officer could ask you if you used the 'panic passcode'. If you say you did, they'll ask you to put in the real passcode. If you say you didn't, they can withhold your phone and if they find out you did, they can arrest you for lying.
  - Mirioron 8y ago
    Passcodes are protected though, aren't they?
  - mLuby 8y ago
    So you're saying you need a N+1 panic codes to prove it wasn't your panic code. That's why this should be done at the manufacturer level. If all iPhones, say, have this feature built in, then it works. But if it's a default-off feature, having it enabled makes it useless.
  - kofejnik 8y ago
    yes, but you can't be forced to provide an answer to this
    - logfromblammo 8y ago
      If you can be prosecuted for lying, you don't have to answer the question--basic right against self-incrimination.
      - deleted 8y ago
        [deleted]
golergka 8y ago
People who refuse all government intrusion on privacy, including search warrants, regardless of circumstances, altogether, have logically consistent position. People who accept that government can overrule any privacy that you might have for the purposes of investigation also have logically consistent position. But people who, on one hand, don't have any problem with things like search warrants to go through suspect's home, but at the same time treat any intrusion to suspect's digital privacy as a violation - this viewpoint I find very weird and contradictory.
- DannyBee 8y ago
  "this viewpoint I find very weird and contradictory" There are very few things at the intersection of society and justice (like law is) that are logically consistent. This is by design, because people are not logically consistent in how they operate (provably so, in fact). Maybe in a few million years depending on how we evolve. But for now, I'm not sure why you would expect anything else. This is similar to the old saying of "in nature, the optimum is rarely at the extremes" The extremes tend to be the most logically consistent positions.
- mindslight 8y ago
  Contemplate computing devices as direct extensions of one's mind. There's a long held philosophical right to not incriminate oneself that even extends to spouses. The justification for this paradigm is so that technology augments human intelligence (functioning as agents for each of us individually), as opposed to islands of human intelligence being left at the mercy of technology. Imagine if that devices you interacted with for a significant part of the day were all bona fide agents of the state, and you could never actually trust them with your raw thoughts. I know with the deluge of proprietary apps and pervasive surveillance it can still effectively feel that way for the technologically illiterate, but that's a temporary condition and far from calcifying it as uniform policy. And sure, the same argument could be applied to paper records (bookkeeping) or other close personal possessions, yet hasn't been. But what's forcing the issue now is the sheer level of advancement of computational intelligence.
SigmundA 8y ago
This doesn't seem surprising to me considering Forced fingerprinting, photographing and measuring has been part of the law for some time and held up in the supreme court. Even forced DNA samples and I believe blood samples are allowed. My understanding is that those things are not considered testimony unlike forced password production. A related distinction is made between being forced to surrender a key to a safe vs the combination to the safe. One is physical the other is testimony.
PopeDotNinja 8y ago
And that is the reason I use a pin code.
- cf498 8y ago
  Its not just police being able to force to unlock your device. The idea of possession alone for security authentication is generally very problematic. Its only introduced out of convenience, which is generally not a good sign when it comes to security. Opsec unfortunately is and remains rather difficult.
jrs95 8y ago
And we will complain about this here on Hacker News and the American public still won't give a flying fuck...I wonder if our "democracy" will stop being such a disappointment in our lifetimes. And I say it in quotes not because I have any opposition to democracy but because our "representatives" and unelected members of government regularly act against our interests. The system is broken.
- kilo_bravo_3 8y ago
  There is no difference between a cop pressing a finger against a fingerprint reader to unlock a phone to gather evidence, and a cop pressing a finger against an inkpad (or scanner) to collect a fingerprint to compare to one found on an object or surface found at a crime scene. If law enforcement suspects your fingerprints are on a crowbar found at the scene of a bank robbery, they tell a judge, present their evidence, and get a court order for you to press your finger on a fingerprint scanner. If law enforcement suspects your fingerprint will unlock your phone and your phone as evidence of a crime on it, they tell a judge, present their evidence, and get a court order for you to press your finger on a fingerprint reader. Nothing is broken.
  - jrs95 8y ago
    It’s not just your phone, and a warrant isn’t always needed thanks to this precedent. Police are able to search without a warrant under many circumstances. For example, they could pull you over, give their dog a command to “hit” on your car, claim the dog smells drugs to search your vehicle, and force anyone in the vehicle to unlock their phones if they’re using biometric security.
    - kofejnik 8y ago
      I don't think it works like that in a traffic stop without a warrant
  - ameister14 8y ago
    The difference is in scope. So if you open a person's phone, you can potentially access their correspondence, browsing history, banking history, location history, etc. If you take someone's fingerprint to match against a fingerprint you already have, all you get is confirmation of something you suspect.
typenil 8y ago
I wish that phone manufacturers would respond to this by allowing you to set one of your fingers as a biometric kill switch. If you scan your index finger - biometrics disabled. Middle finger gets you in. Then these forced unlockings would go nowhere pretty fast.
- mhb 8y ago
  Sure, but obviously the middle finger should be the one that disables the biometrics.
  - justusthane 8y ago
    I know you're making a joke, but no, it should be the obvious finger that disables biometrics.
    - clort 8y ago
      obviously, it should be different on every phone..
- apendleton 8y ago
  You'd have to make it silent, otherwise the kill switch finger would still confirm that the phone is yours, even if it didn't divulge the contents.
- colejohnson66 8y ago
  If you did it after the police “asked” you to unlock your phone and they knew you had this feature, they could charge you with obstruction
- AWildC182 8y ago
  Don't even need software for this. Just tell them all but one of your fingers will wipe the flash but they get to figure out which one it is!
  - darkarmani 8y ago
salawat 8y ago
So, when do we get an interpretive dance based unlock? I'd almost be okay with it if I had the satisfaction of knowing some poor bastard out there had a job that basically boiled down to trying to figure out how the user would dance with a cellphone. Bonus points in that security minded people would get some much needed exercise.
lamby 8y ago
Whilst I applaud and appreciate the sentiment behind the various technological workarounds suggested here (killswitches, canaries, extra levels of security, etc.) do bear in mind that the legal/justice system is not an algorithm that works and operates like code. There are no clever tricks.
- deadbunny 8y ago
  But there are. In the US you have a constitutional right to not incriminate yourself and judges have ruled that extends to giving law enforcement pins/passwords. Biometrics have not received the same status.
- horsawlarway 8y ago
  I'd disagree entirely with this sentiment. I'd say at one point there was a fairly good weighting between "letter of the law" vs "intent of the law". Where the intent of the law mattered and was considered in cases. I haven't seen much good faith consideration of intent of the law in a long time. More and more I find we're just following the letter of the law as closely as possible - reverting to precedent when it exists. Given this tendency... Law is EXACTLY like an algorithm that works and operates like code. It is riddled with clever tricks and often explicitly allows precisely following the letter of the law while shitting all over its original intent.
judge2020 8y ago
At what point does Apple put in an option along the lines of "insta-lock if the face detected is definitely not yours"?
- deleted 8y ago
  [deleted]
gmoore 8y ago
Though it appears that most of the conversation here is about the Apple OS - many of us are using Android. The only "emergency" action I know of on Android is to simply turn your phone off if you can. When it reboots - the password is required before bio-metrics are re-enabled.
- wool_gather 8y ago
  For completeness, the same is true of iOS.
  - buzzerbetrayed 8y ago
    For completeness, the same is not true for iOS. At least not the bit about the only option being to turn your phone off.
    - wool_gather 7y ago
      Ah, interesting. I was replying to the point about rebooting disabling biometric login, and glossing over the "only". (This probably explains the downvotes on my comment.)
- plttn 8y ago
  On Pixels at least there's an optional lockdown button in the power menu. Disables all biometrics/smart lock, hides all notifications on lock screen, and more importantly doesn't say anything like "locked manually".
  - nichos 8y ago
    Which is good, but you have to unlock it first to get that screen to come up. It would be nice if holding the power button down, or like others have said, using certain fingers, would put it in lockdown mode.
    - helper 8y ago
dumbfounder 8y ago
Or if they have a newer iPhone they just hold it near their face. They don't even need to touch the person. It means someone can take your phone while you are sleeping and unlock it as well. Glad my kids don't realize this yet.
- jfk13 8y ago
  In theory, that's not supposed to work, as FaceID has an "attention check" to make sure your eyes are open and looking at the phone. I don't know how robust this is, but perhaps your kids could do some tests?
  - dumbfounder 8y ago
    Seems to be true, yet I can unlock with my sunglasses on. So my kids will hold the phone up in front of my face, poke me to wake me up, and then run.
    - mi100hael 8y ago
      I believe it's still checking for attention. The sunglasses probably aren't enough to completely obscure your eyes from the camera.
- marvin 7y ago
  Face ID requires eye contact, so it will most likely not unlock as long as your eyes are closed.
vectorEQ 8y ago
do it with the siren and call 911 :D now you have 2 officers forcing you do use your appliances :D in my country, police take what they want. they just do, and you can buck up and fuck off if u don't like it. and to be honest, thats how police should be. that being said, they don't randomly beat people up so much :D so perhaps our people are still a bit more forthcoming to them
GeekyBear 8y ago
This is one of those issues where Federal judges in different states have ruled differently, so eventually the Supreme Court will have to weigh in on the issue. For instance: >A US judge last week denied police a warrant to unlock a number of devices using biometrics identifiers like fingerprints and faces, extending more privacy to device owners than previous recent cases. The order comes from Northern California Federal District Judge Kandis Westmore in response to a request by the government to search and seize the devices found at a premises in Oakland, California, connected to two suspects. The judge… made clear that she believes device owners should not have to testify against themselves, in accordance with US Fifth Amendment protection. "Even if probable cause exists to seize devices located during a lawful search based on a reasonable belief that they belong to a suspect, probable cause does not permit the Government to compel a suspect to waive rights otherwise afforded by the Constitution, including the Fifth Amendment right against self-incrimination," she wrote in her order. https://www.theregister.co.uk/2019/01/14/biometric_device_access/ https://www.theregister.co.uk/2019/01/14/biometric_device_ac...
- hannasanarion 8y ago
  These two cases are very different. In one case the police have a suspect in custody and strong evidence that they were engaged in illegal arms dealing, and are looking for specific additional evidence. In the other, the police are basically going on a hunch, with suspects not in custody, and seeking to search the phones of a broad group of people for a broad array of evidence that they don't have good reason to believe exists. It's not as simple as "Can search phone? YES or NO" if the cops were asking to search filing cabinets, the rulings would be the same.
kevin_b_er 8y ago
This was to be expected for years. The court could always force you to do something just not reveal what you know. Of the 3 factors, something you have, something you are, and something you know, only "something you know" is protected from warrant. They can seize your 2 factor key, they can use your fingerprint, they can use your face. They can't force you to tell a password. This is why fundamentally killing passwords is a bad idea, because of rulings like this.
- snarf21 8y ago
  I mostly agree with you but there is no reason you can't have a strong passcode on your phone that protects your accounts using something other than passwords.
brandeded 8y ago
"siri, fuck the po-lice" <-- attention word to erase all fingerprint credentials even when phone is locked.
- ninkendo 8y ago
  "Hey siri, whose phone is this?" already does this.
craftinator 8y ago
Not if I cut off all of my fingers! Take that, Coppers!
- justbaker 8y ago
  huh-hah! I've already scalded off all my fingerprints!
hospitate 8y ago
The police have machines that can unlock an iPhone. I believe they are called greykey machines. They use an exploit to override the limits on password attempts and the rate limit on attempts which allows them to brute force the password. The only way to protect yourself is to use a very strong password. The password on my iPhone would take a few million years for greykey to guess. I really like the combination of a strong password and biometrics. I use biometrics for unlocking most of the time. But if I’m getting pulled over, I press the lock button five times and now my iPhone is totally useless to the police even if they have a greykey. I also lock it when I go to sleep. I’m really looking forward to the day that I’m in an interrogation room and they ask for my phone. I refuse to give the password and they smugly tell me that they have “other ways.” To which I will respond “good luck with that!”
njharman 8y ago
Only after judge signs warrant. That, ignoring that warrant signing might be rubber stamp in some courts cause that is a different issue, is an ok compromise between privacy and enforcing laws.
codewritinfool 8y ago
Just don't use biometrics to unlock your phone. It seems silly to me to discuss ways to disable the biometrics on-demand. It still reduces to something you can be compelled to produce (your finger) vs. something you must remember (your passphrase). Now, you might end up spending time in jail to help your memory, so there's that to think about too. I'll stick with the passcode. It places the ball into my court automatically.
batoure 8y ago
This is why I use my big toe
bitbang 8y ago
That's cool, so long as they don't mark it with chalk.

138 points by kofejnik 8y ago

>Specifically, Judge Judith Dein, of the federal district court of Massachusetts, gave agents from the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) the right to press Robert Brito-Pina's fingers on any iPhone found in his apartment in Boston. The bloke was suspected to be trafficking guns, hence the application for a search warrant Yesterday in the thread about the MA state police getting told they need a warrant for real time location date I said that MA judges will consider politics when reading the law. This is exactly what I mean. MA really doesn't like guns (this is a statement of fact, I'm not going to get into a discussion of whether that hate is justified). It's no surprise that a MA judge allowed the state to go after someone accused of a firearms related crime. Had this been the DEA asking for a warrant for a drug trafficker's phone the judge would likely have ruled the other way. >Jacobsen notes that gun traffickers "often use cellular telephones to acquire or sell illegal guns" and that they are "normally maintained for reasonably long periods of time because they are expensive, can often be subject to long-term contracts that contain substantial penalties for early termination, can store large amounts of information, and do not easily wear out." He also notes that even when people buy a new phone, they will typically transfer the contents of their old phone onto it. What BS. People who make their living trafficking in illegal things use burners for their business. Everyone with a brain knows this. The ATF know they are not likely to find anything on that phone they don't already know. The ATF is just looking to set a precedent and they picked a forum likely to let them set that precedent. FYI the second page of this article includes a pretty good summary of relevant case law to date.

ataturk 8y ago
You only got downvoted because most HN people hate guns, too. Never mind that free people owning guns is the only thing standing in the way of total "boot on the face" tyranny like China has. It's the one little last check against oppression that every Venezuelan wishes they had right now. It disgusts me that Massachusetts, home of Boston, home of the American Revolution, would stoop so low. But Marxists gonna Marxist no matter what.
bradyd 8y ago
You are confusing the state and federal judges. The new MA law doesn't apply to federal agencies and this was a federal judge not a state judge and the ATF is a federal agency.
- dsfyu404ed 8y ago
  >You are confusing the state and federal judges. Districts and states more or less align. You're not going to get a judge who's worked their career in Arkansas appointed to a federal position in MA unless there's some edge case political shenanigans going on. For all practical purposes this guy is an MA, or at least New England judge. >The new MA law doesn't apply to federal agencies and this was a federal judge not a state judge There is no new MA law relevant here. I'm simply contrasting this with the ruling discussed yesterday.
drak0n1c 8y ago
In related context about MA judges arbitrarily applying or not applying the law, Judge Shelley Joseph was charged yesterday with improperly ending court proceedings and aiding the escape of a felon. https://www.wcvb.com/article/massachusetts-judge-trial-court-officer-to-face-federal-charges-on-suspicion-of-helping-immigrant-evade-ice-officer/27271791 https://www.wcvb.com/article/massachusetts-judge-trial-court...

AmericanPriot11 8y ago

with FaceID american cops can leave you tied to waterboarding table.

hprotagonist 8y ago

Not that this is a good solution, but it is a semi-practical countermeasure: mashing the power button 5 times on an iPhone disables all biometrics immediately, starts an audible siren countdown, and calls 911 if not dismissed. Holding power + volume up for a few seconds disables biometrics silently. I long ago enabled the "10 failed logins in a row deletes the phone" toggle. edit: There are two ways to disable biometrics for post-iPhoneX models, which are described above. Pre iPhoneX, there is no panic-mode-with-a-siren, but 5 clicks of the power button will disable biometrics. I routinely do this before i go through the TSA complimentary-preflight-massage line, when i'm within about 50 miles of the mexico border, and whenever i'm pulled over at a traffic stop. and i'm not even doing anything particularly interesting. At least this case involved An Actual Warrant. It's not the best, but it's a whole lot better than the no-warrant scenario.

athenot 8y ago
> I long ago enabled the "10 failed logins in a row deletes the phone" toggle. Unfortunately this is not adviseable if you have small children. A relative of mine saw her phone get wiped after letting my toddler fiddle with it for a few minutes.
- RandallBrown 8y ago
  This happened to a coworker of mine once. The feature was turned on by our IT department after he set up his work email on the device so he didn't really know about it. He came to work one day pretty upset about Apple's "Delete your iPad when your kid plays with it" feature.
  - mieseratte 8y ago
    > The feature was turned on by our IT department after he set up his work email on the device so he didn't really know about it. Perhaps don't let children fiddle with your work devices? That just sounds like an accident waiting to happen.
    - 8y ago

mLuby 8y ago

Basically, biometrics aren't protected like knowledge (a password) is. Fine, sometimes the old ways are best. Here's hoping the next big feature for iOS and Android is a panic passcode that unlocks a totally banal version of the OS. That's the one of two places I see this ending, the other being always-on government (possibly corporate) spying embedded.

skocznymroczny 8y ago
Well, alternatively the officer could ask you if you used the 'panic passcode'. If you say you did, they'll ask you to put in the real passcode. If you say you didn't, they can withhold your phone and if they find out you did, they can arrest you for lying.
- Mirioron 8y ago
  Passcodes are protected though, aren't they?
- mLuby 8y ago
  So you're saying you need a N+1 panic codes to prove it wasn't your panic code. That's why this should be done at the manufacturer level. If all iPhones, say, have this feature built in, then it works. But if it's a default-off feature, having it enabled makes it useless.
- kofejnik 8y ago
  yes, but you can't be forced to provide an answer to this
  - logfromblammo 8y ago
    If you can be prosecuted for lying, you don't have to answer the question--basic right against self-incrimination.
    - deleted 8y ago
      [deleted]

golergka 8y ago

People who refuse all government intrusion on privacy, including search warrants, regardless of circumstances, altogether, have logically consistent position. People who accept that government can overrule any privacy that you might have for the purposes of investigation also have logically consistent position. But people who, on one hand, don't have any problem with things like search warrants to go through suspect's home, but at the same time treat any intrusion to suspect's digital privacy as a violation - this viewpoint I find very weird and contradictory.

DannyBee 8y ago
"this viewpoint I find very weird and contradictory" There are very few things at the intersection of society and justice (like law is) that are logically consistent. This is by design, because people are not logically consistent in how they operate (provably so, in fact). Maybe in a few million years depending on how we evolve. But for now, I'm not sure why you would expect anything else. This is similar to the old saying of "in nature, the optimum is rarely at the extremes" The extremes tend to be the most logically consistent positions.
mindslight 8y ago
Contemplate computing devices as direct extensions of one's mind. There's a long held philosophical right to not incriminate oneself that even extends to spouses. The justification for this paradigm is so that technology augments human intelligence (functioning as agents for each of us individually), as opposed to islands of human intelligence being left at the mercy of technology. Imagine if that devices you interacted with for a significant part of the day were all bona fide agents of the state, and you could never actually trust them with your raw thoughts. I know with the deluge of proprietary apps and pervasive surveillance it can still effectively feel that way for the technologically illiterate, but that's a temporary condition and far from calcifying it as uniform policy. And sure, the same argument could be applied to paper records (bookkeeping) or other close personal possessions, yet hasn't been. But what's forcing the issue now is the sheer level of advancement of computational intelligence.

SigmundA 8y ago

This doesn't seem surprising to me considering Forced fingerprinting, photographing and measuring has been part of the law for some time and held up in the supreme court. Even forced DNA samples and I believe blood samples are allowed. My understanding is that those things are not considered testimony unlike forced password production. A related distinction is made between being forced to surrender a key to a safe vs the combination to the safe. One is physical the other is testimony.

PopeDotNinja 8y ago

And that is the reason I use a pin code.

cf498 8y ago
Its not just police being able to force to unlock your device. The idea of possession alone for security authentication is generally very problematic. Its only introduced out of convenience, which is generally not a good sign when it comes to security. Opsec unfortunately is and remains rather difficult.

jrs95 8y ago

And we will complain about this here on Hacker News and the American public still won't give a flying fuck...I wonder if our "democracy" will stop being such a disappointment in our lifetimes. And I say it in quotes not because I have any opposition to democracy but because our "representatives" and unelected members of government regularly act against our interests. The system is broken.

kilo_bravo_3 8y ago
There is no difference between a cop pressing a finger against a fingerprint reader to unlock a phone to gather evidence, and a cop pressing a finger against an inkpad (or scanner) to collect a fingerprint to compare to one found on an object or surface found at a crime scene. If law enforcement suspects your fingerprints are on a crowbar found at the scene of a bank robbery, they tell a judge, present their evidence, and get a court order for you to press your finger on a fingerprint scanner. If law enforcement suspects your fingerprint will unlock your phone and your phone as evidence of a crime on it, they tell a judge, present their evidence, and get a court order for you to press your finger on a fingerprint reader. Nothing is broken.
- jrs95 8y ago
  It’s not just your phone, and a warrant isn’t always needed thanks to this precedent. Police are able to search without a warrant under many circumstances. For example, they could pull you over, give their dog a command to “hit” on your car, claim the dog smells drugs to search your vehicle, and force anyone in the vehicle to unlock their phones if they’re using biometric security.
  - kofejnik 8y ago
    I don't think it works like that in a traffic stop without a warrant
- ameister14 8y ago
  The difference is in scope. So if you open a person's phone, you can potentially access their correspondence, browsing history, banking history, location history, etc. If you take someone's fingerprint to match against a fingerprint you already have, all you get is confirmation of something you suspect.

typenil 8y ago

I wish that phone manufacturers would respond to this by allowing you to set one of your fingers as a biometric kill switch. If you scan your index finger - biometrics disabled. Middle finger gets you in. Then these forced unlockings would go nowhere pretty fast.

mhb 8y ago
Sure, but obviously the middle finger should be the one that disables the biometrics.
- justusthane 8y ago
  I know you're making a joke, but no, it should be the obvious finger that disables biometrics.
  - clort 8y ago
    obviously, it should be different on every phone..
apendleton 8y ago
You'd have to make it silent, otherwise the kill switch finger would still confirm that the phone is yours, even if it didn't divulge the contents.
colejohnson66 8y ago
If you did it after the police “asked” you to unlock your phone and they knew you had this feature, they could charge you with obstruction
AWildC182 8y ago
Don't even need software for this. Just tell them all but one of your fingers will wipe the flash but they get to figure out which one it is!
- darkarmani 8y ago

salawat 8y ago

So, when do we get an interpretive dance based unlock? I'd almost be okay with it if I had the satisfaction of knowing some poor bastard out there had a job that basically boiled down to trying to figure out how the user would dance with a cellphone. Bonus points in that security minded people would get some much needed exercise.

lamby 8y ago

Whilst I applaud and appreciate the sentiment behind the various technological workarounds suggested here (killswitches, canaries, extra levels of security, etc.) do bear in mind that the legal/justice system is not an algorithm that works and operates like code. There are no clever tricks.

deadbunny 8y ago
But there are. In the US you have a constitutional right to not incriminate yourself and judges have ruled that extends to giving law enforcement pins/passwords. Biometrics have not received the same status.
horsawlarway 8y ago
I'd disagree entirely with this sentiment. I'd say at one point there was a fairly good weighting between "letter of the law" vs "intent of the law". Where the intent of the law mattered and was considered in cases. I haven't seen much good faith consideration of intent of the law in a long time. More and more I find we're just following the letter of the law as closely as possible - reverting to precedent when it exists. Given this tendency... Law is EXACTLY like an algorithm that works and operates like code. It is riddled with clever tricks and often explicitly allows precisely following the letter of the law while shitting all over its original intent.

judge2020 8y ago

At what point does Apple put in an option along the lines of "insta-lock if the face detected is definitely not yours"?

deleted 8y ago
[deleted]

gmoore 8y ago

Though it appears that most of the conversation here is about the Apple OS - many of us are using Android. The only "emergency" action I know of on Android is to simply turn your phone off if you can. When it reboots - the password is required before bio-metrics are re-enabled.

wool_gather 8y ago
For completeness, the same is true of iOS.
- buzzerbetrayed 8y ago
  For completeness, the same is not true for iOS. At least not the bit about the only option being to turn your phone off.
  - wool_gather 7y ago
    Ah, interesting. I was replying to the point about rebooting disabling biometric login, and glossing over the "only". (This probably explains the downvotes on my comment.)
plttn 8y ago
On Pixels at least there's an optional lockdown button in the power menu. Disables all biometrics/smart lock, hides all notifications on lock screen, and more importantly doesn't say anything like "locked manually".
- nichos 8y ago
  Which is good, but you have to unlock it first to get that screen to come up. It would be nice if holding the power button down, or like others have said, using certain fingers, would put it in lockdown mode.
  - helper 8y ago

dumbfounder 8y ago

Or if they have a newer iPhone they just hold it near their face. They don't even need to touch the person. It means someone can take your phone while you are sleeping and unlock it as well. Glad my kids don't realize this yet.

jfk13 8y ago
In theory, that's not supposed to work, as FaceID has an "attention check" to make sure your eyes are open and looking at the phone. I don't know how robust this is, but perhaps your kids could do some tests?
- dumbfounder 8y ago
  Seems to be true, yet I can unlock with my sunglasses on. So my kids will hold the phone up in front of my face, poke me to wake me up, and then run.
  - mi100hael 8y ago
    I believe it's still checking for attention. The sunglasses probably aren't enough to completely obscure your eyes from the camera.
marvin 7y ago
Face ID requires eye contact, so it will most likely not unlock as long as your eyes are closed.

vectorEQ 8y ago

do it with the siren and call 911 :D now you have 2 officers forcing you do use your appliances :D in my country, police take what they want. they just do, and you can buck up and fuck off if u don't like it. and to be honest, thats how police should be. that being said, they don't randomly beat people up so much :D so perhaps our people are still a bit more forthcoming to them

GeekyBear 8y ago

This is one of those issues where Federal judges in different states have ruled differently, so eventually the Supreme Court will have to weigh in on the issue. For instance: >A US judge last week denied police a warrant to unlock a number of devices using biometrics identifiers like fingerprints and faces, extending more privacy to device owners than previous recent cases. The order comes from Northern California Federal District Judge Kandis Westmore in response to a request by the government to search and seize the devices found at a premises in Oakland, California, connected to two suspects. The judge… made clear that she believes device owners should not have to testify against themselves, in accordance with US Fifth Amendment protection. "Even if probable cause exists to seize devices located during a lawful search based on a reasonable belief that they belong to a suspect, probable cause does not permit the Government to compel a suspect to waive rights otherwise afforded by the Constitution, including the Fifth Amendment right against self-incrimination," she wrote in her order. https://www.theregister.co.uk/2019/01/14/biometric_device_access/ https://www.theregister.co.uk/2019/01/14/biometric_device_ac...

hannasanarion 8y ago
These two cases are very different. In one case the police have a suspect in custody and strong evidence that they were engaged in illegal arms dealing, and are looking for specific additional evidence. In the other, the police are basically going on a hunch, with suspects not in custody, and seeking to search the phones of a broad group of people for a broad array of evidence that they don't have good reason to believe exists. It's not as simple as "Can search phone? YES or NO" if the cops were asking to search filing cabinets, the rulings would be the same.

kevin_b_er 8y ago

This was to be expected for years. The court could always force you to do something just not reveal what you know. Of the 3 factors, something you have, something you are, and something you know, only "something you know" is protected from warrant. They can seize your 2 factor key, they can use your fingerprint, they can use your face. They can't force you to tell a password. This is why fundamentally killing passwords is a bad idea, because of rulings like this.

snarf21 8y ago
I mostly agree with you but there is no reason you can't have a strong passcode on your phone that protects your accounts using something other than passwords.

brandeded 8y ago

"siri, fuck the po-lice" <-- attention word to erase all fingerprint credentials even when phone is locked.

ninkendo 8y ago
"Hey siri, whose phone is this?" already does this.

craftinator 8y ago

Not if I cut off all of my fingers! Take that, Coppers!

justbaker 8y ago
huh-hah! I've already scalded off all my fingerprints!

hospitate 8y ago

The police have machines that can unlock an iPhone. I believe they are called greykey machines. They use an exploit to override the limits on password attempts and the rate limit on attempts which allows them to brute force the password. The only way to protect yourself is to use a very strong password. The password on my iPhone would take a few million years for greykey to guess. I really like the combination of a strong password and biometrics. I use biometrics for unlocking most of the time. But if I’m getting pulled over, I press the lock button five times and now my iPhone is totally useless to the police even if they have a greykey. I also lock it when I go to sleep. I’m really looking forward to the day that I’m in an interrogation room and they ask for my phone. I refuse to give the password and they smugly tell me that they have “other ways.” To which I will respond “good luck with that!”

njharman 8y ago

Only after judge signs warrant. That, ignoring that warrant signing might be rubber stamp in some courts cause that is a different issue, is an ok compromise between privacy and enforcing laws.

codewritinfool 8y ago

Just don't use biometrics to unlock your phone. It seems silly to me to discuss ways to disable the biometrics on-demand. It still reduces to something you can be compelled to produce (your finger) vs. something you must remember (your passphrase). Now, you might end up spending time in jail to help your memory, so there's that to think about too. I'll stick with the passcode. It places the ball into my court automatically.

batoure 8y ago

This is why I use my big toe

bitbang 8y ago

That's cool, so long as they don't mark it with chalk.