5 ms·

They can, however, still coerce you to give away your text-based password. I agree, though, that slicing one's finger off is simpler for all parties.

La1n 5y ago
https://xkcd.com/538/ https://xkcd.com/538/
- toyg 5y ago
  The wrench can be resisted by determined individuals; whereas fingerprints and face-recog cannot.
  - ChuckNorris89 5y ago
    The wrench does not represent physical torture, but metaphorical, basically representing a pressure point tailored to each individual.
    - pessimizer 5y ago
      People resist torture all of the time. The problem with torture is that there's often little reason to think that the torture would end if you give up the password, other than the word of the torturer.
      - ChuckNorris89 5y ago
        Like I said, the wrench is not physical torture. By pressure point I meant things like blackmail, threats against your family or loved ones, etc. Everyone has something valuable to lose.
toyg 5y ago
You don’t even need to slice, just manhandle. It’s easy and mechanical, can be done in a few minutes in a dark alley. Whereas a code, any code, requires a degree of cooperation that the individual can choose never to grant. (Obviously a lot of people will grant it, but a sufficiently motivated person - human-rights activist, political dissenter, journalist, etc etc - might not)
- munchbunny 5y ago
  If we’re getting that deep into the hypotheticals, couldn’t said person just not set up biometric logins? For the rest of us where physical coercion to unlock the phone isn’t in the threat model, it really does improve on the trade offs between security and convenience. Feels disproportionate to say we should not do the latter because of the former.
  - toyg 5y ago
    Your threat model likely involves simple robbery; making you “look here” is quick and painless, and increases the loot value significantly. And yes, biometrics in general are not good. The best protection remains a pin or passcode.
    - munchbunny 5y ago
      If they're going to physically threaten you into unlocking your phone, a PIN or passcode won't change that.
      - pmontra 5y ago
        Pickpocketers minimize any physical contact. Biometrics protect against them. PINs do not. Anecdotally I know about an iPhone that got unlocked after a theft at a party. It was protected by a PIN. The owner thinks that the pickpocketer learned the PIN by looking over his shoulder. On the other side burglars can get into a house and force people to unlock their phones or reveal their passwords, if they care to. There is no protection against that unless those people value their secrets more than the harm the burglars will do to them. All considered, I unlock with my fingerprints.
ad404b8a372f2b9 5y ago
We're not talking about the same adversaries here. If the police unlock people's phone by pointing it at their face it'll be done with impunity and in a widespread manner. Less so if they start cutting off fingers.
- xxs 5y ago
  State actors would have zero issues lifting a fingerprint off a phone, then making a prop for the sensor. Alternatively all they need is a minor tranquilizer and there you go, provided the human asset is available.
  - ad404b8a372f2b9 5y ago
    Sorry I was unclear, I meant "cutting fingers" as an example of torture meant to extract passwords, not in the sense that they'd use the finger to unlock the phone. Face-ID and fingerprints share the same issues compared to a password.
- ajdude 5y ago
  In the U.S. at least, passwords are protected under the 5th amendment but you can be ordered to unlock a phone with a fingerprint or a face since it's something you are and not something you know.
  - Mediterraneo10 5y ago
    > passwords are protected under the 5th amendment This is not the case, at least, the law is not very settled in that direction. There has been at least one famous case [0] where an appeals court found that a defendant could be help in contempt of court and imprisoned for refusing to provide his password. [0] https://www.theregister.com/2017/03/20/appeals_court_contempt_passwords/ https://www.theregister.com/2017/03/20/appeals_court_contemp...

La1n 5y ago

https://xkcd.com/538/ https://xkcd.com/538/

toyg 5y ago
The wrench can be resisted by determined individuals; whereas fingerprints and face-recog cannot.
- ChuckNorris89 5y ago
  The wrench does not represent physical torture, but metaphorical, basically representing a pressure point tailored to each individual.
  - pessimizer 5y ago
    People resist torture all of the time. The problem with torture is that there's often little reason to think that the torture would end if you give up the password, other than the word of the torturer.
    - ChuckNorris89 5y ago
      Like I said, the wrench is not physical torture. By pressure point I meant things like blackmail, threats against your family or loved ones, etc. Everyone has something valuable to lose.

toyg 5y ago

You don’t even need to slice, just manhandle. It’s easy and mechanical, can be done in a few minutes in a dark alley. Whereas a code, any code, requires a degree of cooperation that the individual can choose never to grant. (Obviously a lot of people will grant it, but a sufficiently motivated person - human-rights activist, political dissenter, journalist, etc etc - might not)

munchbunny 5y ago
If we’re getting that deep into the hypotheticals, couldn’t said person just not set up biometric logins? For the rest of us where physical coercion to unlock the phone isn’t in the threat model, it really does improve on the trade offs between security and convenience. Feels disproportionate to say we should not do the latter because of the former.
- toyg 5y ago
  Your threat model likely involves simple robbery; making you “look here” is quick and painless, and increases the loot value significantly. And yes, biometrics in general are not good. The best protection remains a pin or passcode.
  - munchbunny 5y ago
    If they're going to physically threaten you into unlocking your phone, a PIN or passcode won't change that.
    - pmontra 5y ago
      Pickpocketers minimize any physical contact. Biometrics protect against them. PINs do not. Anecdotally I know about an iPhone that got unlocked after a theft at a party. It was protected by a PIN. The owner thinks that the pickpocketer learned the PIN by looking over his shoulder. On the other side burglars can get into a house and force people to unlock their phones or reveal their passwords, if they care to. There is no protection against that unless those people value their secrets more than the harm the burglars will do to them. All considered, I unlock with my fingerprints.

ad404b8a372f2b9 5y ago

We're not talking about the same adversaries here. If the police unlock people's phone by pointing it at their face it'll be done with impunity and in a widespread manner. Less so if they start cutting off fingers.

xxs 5y ago
State actors would have zero issues lifting a fingerprint off a phone, then making a prop for the sensor. Alternatively all they need is a minor tranquilizer and there you go, provided the human asset is available.
- ad404b8a372f2b9 5y ago
  Sorry I was unclear, I meant "cutting fingers" as an example of torture meant to extract passwords, not in the sense that they'd use the finger to unlock the phone. Face-ID and fingerprints share the same issues compared to a password.
ajdude 5y ago
In the U.S. at least, passwords are protected under the 5th amendment but you can be ordered to unlock a phone with a fingerprint or a face since it's something you are and not something you know.
- Mediterraneo10 5y ago
  > passwords are protected under the 5th amendment This is not the case, at least, the law is not very settled in that direction. There has been at least one famous case [0] where an appeals court found that a defendant could be help in contempt of court and imprisoned for refusing to provide his password. [0] https://www.theregister.com/2017/03/20/appeals_court_contempt_passwords/ https://www.theregister.com/2017/03/20/appeals_court_contemp...