6 ms·

Nice. This is yet another reason why I avoid biometrics for authentication, and I'm glad that the court backed up my assumption that it is more secure. In this

Nice. This is yet another reason why I avoid biometrics for authentication, and I'm glad that the court backed up my assumption that it is more secure. In this particular case, I hope this perpetrator is convicted regardless (assuming he's guilty, that is), but I'm glad the courts agree that nobody should be compelled to give up information. This is a big win for privacy.

seibelj 7y ago
Another good point is that biometrics aren’t secure. They invest millions and billions in fingerprint and eye scanner systems that get fooled by scotch tape. Just not effective security.
- rhinoceraptor 7y ago
  It's better than no security. Most people aren't going to use a secure pin code on their phone.
  - pshc 7y ago
    Exactly. I have accidentally witnessed so many 4-digit PINs typed into phones by friends and casual acquaintances. It’s kind of unavoidable if you spend any reasonable amount of time in person with them. Very few people in my experience go the extra mile to set a long fulltext passphrase on their phone.
- anoncake 7y ago
  It's effective against nosy people which is probably the main threat for most people.
- saagarjha 7y ago
  Depends on the device.
  - lstodd 7y ago
    It doesn't.
andyv 7y ago
Biometrics are a userid, not a password.
- smt88 7y ago
  Not on iOS or Android phones. On most recent phones, they're both.
  - djsumdog 7y ago
    Which is why I will never enable fingerprint or face unlocking ever. I'm fine with physically typing in my password. I like real security.
    - dannyw 7y ago
      For the average user whose password is 0000, maybe face unlocking IS more secure for them.
      - luxuryballs 7y ago
        unfortunately for that user, face unlock doesn’t disable passcode unlock
    - leokennis 7y ago
      I have an iPhone with Face ID and an 8 digit passcode. If I were to be arrested or whatever, all I need to do is press the power button 5 times in quick succession and Face ID is disabled and my passcode is required. So I can choose: - Unlock my phone with ease for 10’s of years and then quickly lock it once - Struggle to unlock it for 10’s of years to avoid having to quickly lock it once
      - Crosseye_Jack 7y ago
        If you enable voice control in accessibility you can reboot the device using a voice command “reboot this device”. After which you will need your passcode/word to unlock the device. Handy if you foresee a time you won’t be able to reach your device and tap the unlock button 5 times.
jonstewart 7y ago
How will he be convicted if the primary evidence is on his computer? My geek half that believes in strong 4th and 5th Amendment tights and crypto thinks this is a fine decision. My forensics half bets this guy has gigabytes of atrocious child pornography on his system and that CP cases are the motivating factor for the police wanting to decrypt your hard drive in 99 out of 100 cases with a search warrant. These cases are not abstractions; every pic is of a child who was abused and the perpetrators organize themselves into networks that include distributors and abusers/“content producers.” How is justice served if these networks can’t be rolled up due to full disk encryption? I like encryption. I don’t want to be compelled to give up my password to a tyrannical government. But I think the tech community is quick to take an absolutist view of the right to strong crypto, and quick to discount that harm can happen as a result. I also don’t think that view is shared by most people... so it seems like a problem worth solving.
- ClumsyPilot 7y ago
  Don't we have other forms of surveillance, installing of cameras/microphones in people's homes and sting operations that could help catch people? I think that demanding citizens incriminate themselves is an especially lazy form of justice.
  - jonstewart 7y ago
    I don’t think such techniques are readily and cheaply available to most police departments.
    - vunie 7y ago
      That's a good thing. It forces the police to actually do their homework rather than invade people's privacy whenever they want.
- nickpsecurity 7y ago
  Schneier et. al.'s Keys Under Dormats paper tackles that problem from many angles. You might find it interesting. https://www.schneier.com/academic/paperfiles/paper-keys-under-doormats-CSAIL.pdf https://www.schneier.com/academic/paperfiles/paper-keys-unde...
dependenttypes 7y ago
I hope he doesn't. We don't need more lives ruined for victimless crimes/thought crimes.
- tzs 7y ago
  Child porn is victimless?
  - cuvzxvcmew 7y ago
    To me the possession of child porn is victim-less, just as the possession of media of murders is victim-less, or the possession of media of any other crime is victim-less. The purchasing of media of a crime is dubious, as it may serve to reward people who commit that crime, and the committing of these crimes almost always has a victim (excluding cases for example someone wanting to be murdered or something). The prosecution of these cases seems to look a lot like crimes of morality than crimes that directly impact someone else's life and happiness. Sometimes I've heard people say that the mere fact of media existing of a crime that they were in hurts them, and hurts them more when people watch it. But to me, prosecution of these cases, if anything makes one more aware of people watching media of these things, not less. The thing that bugs me the most about these sorts of prosecutions of "thought crimes" is that the trail from the "thought criminal" to the actual crime is always hazy, and definitely not 1-1. E.g Imagine someone who was really into collecting child porn as some kind of bizarre stamp collecting type of thing. They were never into it per-se, it was just some kind of messed up hobby. They'd trawl forums on the dark web and download every image they see, maybe write a script to do it. It would be very hard to trace a direct line to a victim there. More likely than not, particularly if no money ever changed hands, there probably wasn't a direct victim. Someone may have paid for it at some time in the past, but not the stamp-collector. It seems like these are crimes that convict people who hurt others, but also those who do not hurt others.

seibelj 7y ago

Another good point is that biometrics aren’t secure. They invest millions and billions in fingerprint and eye scanner systems that get fooled by scotch tape. Just not effective security.

rhinoceraptor 7y ago
It's better than no security. Most people aren't going to use a secure pin code on their phone.
- pshc 7y ago
  Exactly. I have accidentally witnessed so many 4-digit PINs typed into phones by friends and casual acquaintances. It’s kind of unavoidable if you spend any reasonable amount of time in person with them. Very few people in my experience go the extra mile to set a long fulltext passphrase on their phone.
anoncake 7y ago
It's effective against nosy people which is probably the main threat for most people.
saagarjha 7y ago
Depends on the device.
- lstodd 7y ago
  It doesn't.

andyv 7y ago

Biometrics are a userid, not a password.

smt88 7y ago
Not on iOS or Android phones. On most recent phones, they're both.
- djsumdog 7y ago
  Which is why I will never enable fingerprint or face unlocking ever. I'm fine with physically typing in my password. I like real security.
  - dannyw 7y ago
    For the average user whose password is 0000, maybe face unlocking IS more secure for them.
    - luxuryballs 7y ago
      unfortunately for that user, face unlock doesn’t disable passcode unlock
  - leokennis 7y ago
    I have an iPhone with Face ID and an 8 digit passcode. If I were to be arrested or whatever, all I need to do is press the power button 5 times in quick succession and Face ID is disabled and my passcode is required. So I can choose: - Unlock my phone with ease for 10’s of years and then quickly lock it once - Struggle to unlock it for 10’s of years to avoid having to quickly lock it once
    - Crosseye_Jack 7y ago
      If you enable voice control in accessibility you can reboot the device using a voice command “reboot this device”. After which you will need your passcode/word to unlock the device. Handy if you foresee a time you won’t be able to reach your device and tap the unlock button 5 times.

jonstewart 7y ago

How will he be convicted if the primary evidence is on his computer? My geek half that believes in strong 4th and 5th Amendment tights and crypto thinks this is a fine decision. My forensics half bets this guy has gigabytes of atrocious child pornography on his system and that CP cases are the motivating factor for the police wanting to decrypt your hard drive in 99 out of 100 cases with a search warrant. These cases are not abstractions; every pic is of a child who was abused and the perpetrators organize themselves into networks that include distributors and abusers/“content producers.” How is justice served if these networks can’t be rolled up due to full disk encryption? I like encryption. I don’t want to be compelled to give up my password to a tyrannical government. But I think the tech community is quick to take an absolutist view of the right to strong crypto, and quick to discount that harm can happen as a result. I also don’t think that view is shared by most people... so it seems like a problem worth solving.

ClumsyPilot 7y ago
Don't we have other forms of surveillance, installing of cameras/microphones in people's homes and sting operations that could help catch people? I think that demanding citizens incriminate themselves is an especially lazy form of justice.
- jonstewart 7y ago
  I don’t think such techniques are readily and cheaply available to most police departments.
  - vunie 7y ago
    That's a good thing. It forces the police to actually do their homework rather than invade people's privacy whenever they want.
nickpsecurity 7y ago
Schneier et. al.'s Keys Under Dormats paper tackles that problem from many angles. You might find it interesting. https://www.schneier.com/academic/paperfiles/paper-keys-under-doormats-CSAIL.pdf https://www.schneier.com/academic/paperfiles/paper-keys-unde...

dependenttypes 7y ago

I hope he doesn't. We don't need more lives ruined for victimless crimes/thought crimes.

tzs 7y ago
Child porn is victimless?
- cuvzxvcmew 7y ago
  To me the possession of child porn is victim-less, just as the possession of media of murders is victim-less, or the possession of media of any other crime is victim-less. The purchasing of media of a crime is dubious, as it may serve to reward people who commit that crime, and the committing of these crimes almost always has a victim (excluding cases for example someone wanting to be murdered or something). The prosecution of these cases seems to look a lot like crimes of morality than crimes that directly impact someone else's life and happiness. Sometimes I've heard people say that the mere fact of media existing of a crime that they were in hurts them, and hurts them more when people watch it. But to me, prosecution of these cases, if anything makes one more aware of people watching media of these things, not less. The thing that bugs me the most about these sorts of prosecutions of "thought crimes" is that the trail from the "thought criminal" to the actual crime is always hazy, and definitely not 1-1. E.g Imagine someone who was really into collecting child porn as some kind of bizarre stamp collecting type of thing. They were never into it per-se, it was just some kind of messed up hobby. They'd trawl forums on the dark web and download every image they see, maybe write a script to do it. It would be very hard to trace a direct line to a victim there. More likely than not, particularly if no money ever changed hands, there probably wasn't a direct victim. Someone may have paid for it at some time in the past, but not the stamp-collector. It seems like these are crimes that convict people who hurt others, but also those who do not hurt others.