5 ms·

Not that this is a good solution, but it is a semi-practical countermeasure: mashing the power button 5 times on an iPhone disables all biometrics immediately,

Not that this is a good solution, but it is a semi-practical countermeasure: mashing the power button 5 times on an iPhone disables all biometrics immediately, starts an audible siren countdown, and calls 911 if not dismissed. Holding power + volume up for a few seconds disables biometrics silently. I long ago enabled the "10 failed logins in a row deletes the phone" toggle. edit: There are two ways to disable biometrics for post-iPhoneX models, which are described above. Pre iPhoneX, there is no panic-mode-with-a-siren, but 5 clicks of the power button will disable biometrics. I routinely do this before i go through the TSA complimentary-preflight-massage line, when i'm within about 50 miles of the mexico border, and whenever i'm pulled over at a traffic stop. and i'm not even doing anything particularly interesting. At least this case involved An Actual Warrant. It's not the best, but it's a whole lot better than the no-warrant scenario.

athenot 8y ago
> I long ago enabled the "10 failed logins in a row deletes the phone" toggle. Unfortunately this is not adviseable if you have small children. A relative of mine saw her phone get wiped after letting my toddler fiddle with it for a few minutes.
- RandallBrown 8y ago
  This happened to a coworker of mine once. The feature was turned on by our IT department after he set up his work email on the device so he didn't really know about it. He came to work one day pretty upset about Apple's "Delete your iPad when your kid plays with it" feature.
  - mieseratte 8y ago
    > The feature was turned on by our IT department after he set up his work email on the device so he didn't really know about it. Perhaps don't let children fiddle with your work devices? That just sounds like an accident waiting to happen.
    - mathgeek 8y ago
      Sounds like it was a personal device that had access to work email. That's a whole other issue that I wish had a better option than "adding your work accounts lets anyone using the phone see them."
    - athenot 8y ago
      I have a strict policy to not let my kids play with phones. (Books and toys are plenty fine.) And I don't let my phone hang around and used as a passive toy (in locked mode) either. Yet more than once my phone has been "found" and the max password attempt has been triggered. It happens really easily despite my efforts. Now in the grand scheme of things, this is just an annoyance as I can restore the phone from up-to-date backups. If someone is concerned enough, they could also toggle the wipe feature on/off based on their travels and live with the risk of an accidental wipe knowing that things can be restored.
      - derekp7 8y ago
        This can happen from carrying it in your pocket. Moisture (sweat) from your leg can cause random inputs on the touch screen.
        xvector 8y ago
        Solution is to put the phone in your pocket facing outwards. Also prevents turning on the camera or flashlight with your leg.
        Thetawaves 8y ago
        lol
      - dontbenebby 8y ago
        On the iPhone, 2fa codes must be set up again manually using recovery codes - can't be restored from backup. Huge pain in the butt IMHO
  - rossenberg79 8y ago
    It was completely irresponsible on his part. If you are given a work device it is not for you to hand off to your child to play with. You should have more than enough disposable income at that point (since you have a child and a job that gives you an iPad) to buy a dedicated device for your child.
- hprotagonist 8y ago
  Considering the exponential growth of mandatory lockout timers between repeated failed attempts, i'm not super worried.
  - leejoramo 8y ago
    Correct. I think it takes something like a total of 4 hours of failed password logins to trigger a wiped phone. That is a long time to be worried about your kids playing with the phone. Once the phone is wiped you can restore the phone from backup. If you allow kids to play unsupervised with a phone for 4 hours, I hope you have it backed up for a variety of other worse case scenarios.
- overcast 8y ago
  Sure it is, and that's why you have proper backups. iCloud is stupid simple to setup, and forget about until needed.
  - alfalfasprout 8y ago
    Law enforcement can also subpoena Apple for your iCloud data. It's hosted using a key that they control.
    - overcast 8y ago
      This is about their kid accidentally deleting their phone.
- SlowRobotAhead 8y ago
  >A relative of mine saw her phone get wiped after letting my toddler fiddle with it for a few minutes. Yea... You might want to check that story. It's a staged timeout. First 1 minute, then 5, then 10, then an hour, then 3 hours or something like that. Not that a toddler wasn't playing with the phone for 4 hours straight - just that if you let that happen you should expect a broken phone.
joshstrange 8y ago
Also saying "Hey Siri, who am I?" will do it as long as you have a contact for yourself (see comments [0]) [0] https://news.ycombinator.com/item?id=18212978 https://news.ycombinator.com/item?id=18212978
- hprotagonist 8y ago
  Nice find! Given my nick, I think i should rebind that to "do you have any relatives in afghanistan?"
basseq 8y ago
> holding power + volume up for a few seconds disables biometrics silently I didn't know about this great shortcut until today. Note that it isn't particularly "silent", as it displays an "Emergency SOS" slider that, when canceled, prompts you for your password. Apparently, saying "Hey Siri, whose phone is this?" will disable biometrics as well. Finally, you may be interested in the "Police" shortcut[1], which sends a text to a contact, starts recording voice and video, and saves it to the cloud. [1] https://www.icloud.com/shortcuts/2d68cb1ee7b84f08ace2fd600b9855b5 https://www.icloud.com/shortcuts/2d68cb1ee7b84f08ace2fd600b9...
- hprotagonist 8y ago
  it's audibly silent -- on post-iPhoneX models, clicking power 5 times will emit a siren tone and then autodial 911 in addition to locking out biometrics. power + volumeup displays on the screen but does not emit a noise. I think the police shortcut got nerfed with 12.2, but I'm not sure.
  - basseq 8y ago
    Good clarification, thanks. I can't find any immediate results on the Police shortcut no longer working—almost every reference is from Q3 2018.
  - rhinoceraptor 8y ago
    Clicking the power 5 times also gives me a heart attack when I do it accidentally when I'm trying to turn up my podcast.
- klodolph 8y ago
  > Apparently, saying "Hey Siri, whose phone is this?" will disable biometrics as well. This does not work on 7+, at least. Nor does holding side button + volume up. Pressing the side button 5 times will bring up the emergency screen (just press "cancel" when it shows up) and disable biometrics.
  - iheartpotatoes 8y ago
kolla 8y ago
The mashing of the power button works but the "power + volume up" only gives me the option to turn of the phone. It does not do anything for biometrics. iPhone 7.
- hprotagonist 8y ago
  ah, yes. there's a model-specific change in button sequence. i'll edit my comment above.
- oasisbob 8y ago
  It works for me on the XR, brings up the sliders for power off, etc and Face ID is disabled.
sh-run 8y ago
On the iPhone Xr power + volume down brings you to the emergency call screen and disables faceID. Technically either volume button works, but if the phone is awake power + volume up just takes a screenshot. On my Xr with apple pay enabled mashing the power button 5 times just brings up apple pay, puts the phone to sleep and then wakes it back up. I'm not sure if it's the same on other iPhone X models.
- hprotagonist 8y ago
  Settings>Emergency SOS has the relevant things to fiddle with, i think.
jayess 8y ago
Anything similar in Android?
- Stephen304 8y ago
  What I do on my Pixel 2 is use the wrong finger 5 times to force passcode / pattern entry, though I'm not sure if it resets after a certain amount of time or forces the next unlock to be passcode / pattern. Still might be useful in a pinch or if being coerced to unlock the phone under duress.
- gregstoll 8y ago
  Yes - with Android Pie and above you can add a "Lockdown" option to your Restart/Shutdown menu, see https://android.gadgethacks.com/how-to/quickly-disable-fingerprints-smart-lock-android-pie-for-extra-security-0183475/ https://android.gadgethacks.com/how-to/quickly-disable-finge... You can also just restart the phone - at least on mine you can't login for the first time after a restart with a fingerprint.
maximilianroos 8y ago
> I routinely do this before i go through the TSA complimentary-preflight-massage line, when i'm within about 50 miles of the mexico border, and whenever i'm pulled over at a traffic stop. These are all unnecessary, to various degrees. Compelling your fingerprint requires a warrant, which officers had in the linked case. The controversy is whether a search warrant of a property extends to compelling a fingerprint, not whether officers can go searching phones with abandon. Specifically: - TSA officers aren't police officers. They can search you because you're entering an airport, but you're free to leave at any time (though they can detain you until police arrive, as any citizen can). - Within 100 miles of the border (not only the Mexican) officers can detain people momentarily or search vehicles to ascertain their citizenship. That's the only additional power they have, they can't search your phone (or even search your glove compartment) without probable cause. - When you're pulled over for a traffic stop, a search requires probable cause. You didn't mention the one time you might think about doing this: going through customs, where your 4A rights are weaker and less certain. If you're interested in learning more, US vs Cotterman is a good jumping-off point.
- hprotagonist 8y ago
  I power my devices off completely when CBP gets involved.
- spraak 8y ago
  > These are all unnecessary, to various degrees. Even limiting your search to HN there is a plethora of examples of situations that OP describes where phones and devices have been invaded
  - maximilianroos 8y ago
    Police routinely violate 4A rights. But we have a court system that suppresses evidence that's gained from those violations, or any evidence that's found from information gained in those violations. Do you have examples where courts have allowed that evidence to be used against people?
- civility 8y ago
gmiller123456 8y ago
>mashing the power button 5 times on an iPhone disables all biometrics immediately, starts an audible siren countdown, and calls 911 if not dismissed While you could do this before the police took position of the phone, it's important to point out that making any changes to the phone after it's in their possession, without permission, would be considered tampering with evidence. So, disabling biometrics before going through TSA is probably OK. But mashing your finger five times on the power button when the police told you to unlock it will most likely result in some criminal charges.
- jrockway 8y ago
  > considered tampering with evidence You have to weigh the consequences. Let's say your phone has incontrovertible proof that you murdered someone, and you live in a state with the death penalty. The few years of prison you get for tampering with evidence is better than being executed, right? So it's still good to know.
  - breakpointalpha 8y ago
    A better example would be traveling through a country known to execute people for their sexual orientation. I'm only thinking ethically, it's better to use technology to protect people from prosecution for victimless "crimes" than to support murder. ;)
- jstarfish 8y ago
  > While you could do this before the police took position of the phone, it's important to point out that making any changes to the phone after it's in their possession, without permission, would be considered tampering with evidence. It's obstruction either way. Competent departments know to store the phone in a Faraday bag to prevent this, so it's not always an option in the first place.
ZebZ 8y ago
Similarly, rebooting an Android will disable the fingerprint unlock. The first time you log in after a reboot, it requires you to enter your pin.
- nichos 8y ago
  If you have a newer version of android (oreo I think? Not sure, I have a pixel), you can enable "lockdown" Lockdown brings up a menu when you press and hold the power button to disable the fingerprint reader for the next unlock. It's not on by default, you have to turn it on in the settings.

athenot 8y ago

> I long ago enabled the "10 failed logins in a row deletes the phone" toggle. Unfortunately this is not adviseable if you have small children. A relative of mine saw her phone get wiped after letting my toddler fiddle with it for a few minutes.

RandallBrown 8y ago
This happened to a coworker of mine once. The feature was turned on by our IT department after he set up his work email on the device so he didn't really know about it. He came to work one day pretty upset about Apple's "Delete your iPad when your kid plays with it" feature.
- mieseratte 8y ago
  > The feature was turned on by our IT department after he set up his work email on the device so he didn't really know about it. Perhaps don't let children fiddle with your work devices? That just sounds like an accident waiting to happen.
  - mathgeek 8y ago
    Sounds like it was a personal device that had access to work email. That's a whole other issue that I wish had a better option than "adding your work accounts lets anyone using the phone see them."
  - athenot 8y ago
    I have a strict policy to not let my kids play with phones. (Books and toys are plenty fine.) And I don't let my phone hang around and used as a passive toy (in locked mode) either. Yet more than once my phone has been "found" and the max password attempt has been triggered. It happens really easily despite my efforts. Now in the grand scheme of things, this is just an annoyance as I can restore the phone from up-to-date backups. If someone is concerned enough, they could also toggle the wipe feature on/off based on their travels and live with the risk of an accidental wipe knowing that things can be restored.
    - derekp7 8y ago
      This can happen from carrying it in your pocket. Moisture (sweat) from your leg can cause random inputs on the touch screen.
      - xvector 8y ago
        Solution is to put the phone in your pocket facing outwards. Also prevents turning on the camera or flashlight with your leg.
        Thetawaves 8y ago
        lol
    - dontbenebby 8y ago
      On the iPhone, 2fa codes must be set up again manually using recovery codes - can't be restored from backup. Huge pain in the butt IMHO
- rossenberg79 8y ago
  It was completely irresponsible on his part. If you are given a work device it is not for you to hand off to your child to play with. You should have more than enough disposable income at that point (since you have a child and a job that gives you an iPad) to buy a dedicated device for your child.
hprotagonist 8y ago
Considering the exponential growth of mandatory lockout timers between repeated failed attempts, i'm not super worried.
- leejoramo 8y ago
  Correct. I think it takes something like a total of 4 hours of failed password logins to trigger a wiped phone. That is a long time to be worried about your kids playing with the phone. Once the phone is wiped you can restore the phone from backup. If you allow kids to play unsupervised with a phone for 4 hours, I hope you have it backed up for a variety of other worse case scenarios.
overcast 8y ago
Sure it is, and that's why you have proper backups. iCloud is stupid simple to setup, and forget about until needed.
- alfalfasprout 8y ago
  Law enforcement can also subpoena Apple for your iCloud data. It's hosted using a key that they control.
  - overcast 8y ago
    This is about their kid accidentally deleting their phone.
SlowRobotAhead 8y ago
>A relative of mine saw her phone get wiped after letting my toddler fiddle with it for a few minutes. Yea... You might want to check that story. It's a staged timeout. First 1 minute, then 5, then 10, then an hour, then 3 hours or something like that. Not that a toddler wasn't playing with the phone for 4 hours straight - just that if you let that happen you should expect a broken phone.

joshstrange 8y ago

Also saying "Hey Siri, who am I?" will do it as long as you have a contact for yourself (see comments [0]) [0] https://news.ycombinator.com/item?id=18212978 https://news.ycombinator.com/item?id=18212978

hprotagonist 8y ago
Nice find! Given my nick, I think i should rebind that to "do you have any relatives in afghanistan?"

basseq 8y ago

> holding power + volume up for a few seconds disables biometrics silently I didn't know about this great shortcut until today. Note that it isn't particularly "silent", as it displays an "Emergency SOS" slider that, when canceled, prompts you for your password. Apparently, saying "Hey Siri, whose phone is this?" will disable biometrics as well. Finally, you may be interested in the "Police" shortcut[1], which sends a text to a contact, starts recording voice and video, and saves it to the cloud. [1] https://www.icloud.com/shortcuts/2d68cb1ee7b84f08ace2fd600b9855b5 https://www.icloud.com/shortcuts/2d68cb1ee7b84f08ace2fd600b9...

hprotagonist 8y ago
it's audibly silent -- on post-iPhoneX models, clicking power 5 times will emit a siren tone and then autodial 911 in addition to locking out biometrics. power + volumeup displays on the screen but does not emit a noise. I think the police shortcut got nerfed with 12.2, but I'm not sure.
- basseq 8y ago
  Good clarification, thanks. I can't find any immediate results on the Police shortcut no longer working—almost every reference is from Q3 2018.
- rhinoceraptor 8y ago
  Clicking the power 5 times also gives me a heart attack when I do it accidentally when I'm trying to turn up my podcast.
klodolph 8y ago
> Apparently, saying "Hey Siri, whose phone is this?" will disable biometrics as well. This does not work on 7+, at least. Nor does holding side button + volume up. Pressing the side button 5 times will bring up the emergency screen (just press "cancel" when it shows up) and disable biometrics.
- iheartpotatoes 8y ago

kolla 8y ago

The mashing of the power button works but the "power + volume up" only gives me the option to turn of the phone. It does not do anything for biometrics. iPhone 7.

hprotagonist 8y ago
ah, yes. there's a model-specific change in button sequence. i'll edit my comment above.
oasisbob 8y ago
It works for me on the XR, brings up the sliders for power off, etc and Face ID is disabled.

sh-run 8y ago

On the iPhone Xr power + volume down brings you to the emergency call screen and disables faceID. Technically either volume button works, but if the phone is awake power + volume up just takes a screenshot. On my Xr with apple pay enabled mashing the power button 5 times just brings up apple pay, puts the phone to sleep and then wakes it back up. I'm not sure if it's the same on other iPhone X models.

hprotagonist 8y ago
Settings>Emergency SOS has the relevant things to fiddle with, i think.

jayess 8y ago

Anything similar in Android?

Stephen304 8y ago
What I do on my Pixel 2 is use the wrong finger 5 times to force passcode / pattern entry, though I'm not sure if it resets after a certain amount of time or forces the next unlock to be passcode / pattern. Still might be useful in a pinch or if being coerced to unlock the phone under duress.
gregstoll 8y ago
Yes - with Android Pie and above you can add a "Lockdown" option to your Restart/Shutdown menu, see https://android.gadgethacks.com/how-to/quickly-disable-fingerprints-smart-lock-android-pie-for-extra-security-0183475/ https://android.gadgethacks.com/how-to/quickly-disable-finge... You can also just restart the phone - at least on mine you can't login for the first time after a restart with a fingerprint.

maximilianroos 8y ago

> I routinely do this before i go through the TSA complimentary-preflight-massage line, when i'm within about 50 miles of the mexico border, and whenever i'm pulled over at a traffic stop. These are all unnecessary, to various degrees. Compelling your fingerprint requires a warrant, which officers had in the linked case. The controversy is whether a search warrant of a property extends to compelling a fingerprint, not whether officers can go searching phones with abandon. Specifically: - TSA officers aren't police officers. They can search you because you're entering an airport, but you're free to leave at any time (though they can detain you until police arrive, as any citizen can). - Within 100 miles of the border (not only the Mexican) officers can detain people momentarily or search vehicles to ascertain their citizenship. That's the only additional power they have, they can't search your phone (or even search your glove compartment) without probable cause. - When you're pulled over for a traffic stop, a search requires probable cause. You didn't mention the one time you might think about doing this: going through customs, where your 4A rights are weaker and less certain. If you're interested in learning more, US vs Cotterman is a good jumping-off point.

hprotagonist 8y ago
I power my devices off completely when CBP gets involved.
spraak 8y ago
> These are all unnecessary, to various degrees. Even limiting your search to HN there is a plethora of examples of situations that OP describes where phones and devices have been invaded
- maximilianroos 8y ago
  Police routinely violate 4A rights. But we have a court system that suppresses evidence that's gained from those violations, or any evidence that's found from information gained in those violations. Do you have examples where courts have allowed that evidence to be used against people?
civility 8y ago

gmiller123456 8y ago

>mashing the power button 5 times on an iPhone disables all biometrics immediately, starts an audible siren countdown, and calls 911 if not dismissed While you could do this before the police took position of the phone, it's important to point out that making any changes to the phone after it's in their possession, without permission, would be considered tampering with evidence. So, disabling biometrics before going through TSA is probably OK. But mashing your finger five times on the power button when the police told you to unlock it will most likely result in some criminal charges.

jrockway 8y ago
> considered tampering with evidence You have to weigh the consequences. Let's say your phone has incontrovertible proof that you murdered someone, and you live in a state with the death penalty. The few years of prison you get for tampering with evidence is better than being executed, right? So it's still good to know.
- breakpointalpha 8y ago
  A better example would be traveling through a country known to execute people for their sexual orientation. I'm only thinking ethically, it's better to use technology to protect people from prosecution for victimless "crimes" than to support murder. ;)
jstarfish 8y ago
> While you could do this before the police took position of the phone, it's important to point out that making any changes to the phone after it's in their possession, without permission, would be considered tampering with evidence. It's obstruction either way. Competent departments know to store the phone in a Faraday bag to prevent this, so it's not always an option in the first place.

ZebZ 8y ago

Similarly, rebooting an Android will disable the fingerprint unlock. The first time you log in after a reboot, it requires you to enter your pin.

nichos 8y ago
If you have a newer version of android (oreo I think? Not sure, I have a pixel), you can enable "lockdown" Lockdown brings up a menu when you press and hold the power button to disable the fingerprint reader for the next unlock. It's not on by default, you have to turn it on in the settings.