4 ms·

Biometrics are not passwords, they are usernames. You can change passwords.

Clubber 5y ago
They are authentication and authorization just like a username/password set. I don't see the Supreme Court allowing this if they won't allow compulsion of releasing a password. Right against self incrimination. Should be interesting though.
- therobot24 5y ago
  i think the difference is compelled speech - you don't have to 'say' your biometric user/pass combo
- ColinWright 5y ago
  Quoting: "Reffitt’s lawyer told CNN ...that the laptop is now unlocked."
- leereeves 5y ago
  > Right against self incrimination. You can be forced to submit to fingerprinting, which could also be incriminating.
  - Clubber 5y ago
    That's a good point, but those fingerprints aren't used to open say, a biometric safe. They are used to compare with fingerprints found at the scene of a crime. Here's some interesting copy on similar cases. https://arstechnica.com/tech-policy/2020/06/indiana-supreme-court-its-unconstitutional-to-force-phone-unlocking/ https://arstechnica.com/tech-policy/2020/06/indiana-supreme-...
    - deleted 5y ago
      [deleted]
- ortusdux 5y ago
  "A password, sometimes called a passcode, is secret data, typically a string of characters, usually used to confirm a user's identity." https://en.wikipedia.org/wiki/Password https://en.wikipedia.org/wiki/Password There is nothing secret about your biometrics. Especially not while you are in detention.
  - Clubber 5y ago
    No but compelling you to use your biometrics to self incriminate is something else altogether.
    - ortusdux 5y ago
      Imagine their password was written on a bracelet. Plainly visible to the public, easily recreated from photos, and 0% secret. The cops wouldn't even need a court order to read it. That is what biometrics are. They are the sticky note next to the monitor with a password written on it.
      - twirlock 5y ago
        So what is the court order for then?
      - Clubber 5y ago
        The state doesn't need your cooperation to type in a password that is plainly visible though. That's where the self incrimination comes in.
- threatofrain 5y ago
  The Supreme Court has repeatedly punted the issue down to state courts. What do you think is different this time?
  - Clubber 5y ago
    They'll eventually have to rule on it because the state courts are split, when that is, who knows. It's certainly a 5th amendment case, so they'll have to address it eventually, perhaps they are waiting on the right case? I dunno.
    - alistairSH 5y ago
      What appellate courts have ruled in favor or biometrics being protected? That would potentially upend decades of case law - the government can compel somebody to produce a physical key (which now includes fingerprints and other biometrics) but cannot compel production of a passcode/combination.
      - Clubber 5y ago
        >What appellate courts have ruled in favor or biometrics being protected? This article talks about a case in the 11th circuit in 2012 and another in the Pennsylvania Supreme Court, Commonwealth v. Davis. Apparently the only time you can compel someone to give their password (which biometrics serve the same purpose) is if the state already knows what's on there. It's called "foregone conclusion exception." Yet if the government can show that it already knows of the existence and the suspect’s possession of the documents at issue—i.e., that these matters are a “foregone conclusion” and thus that the factual assertions implicit in the act of production add “little or nothing to the sum total of the Government’s information”—then “no Fifth Amendment right is touched because the ‘question is not of testimony but of surrender.’” https://crsreports.congress.gov/product/pdf/LSB/LSB10416 https://crsreports.congress.gov/product/pdf/LSB/LSB10416
therobot24 5y ago
they are both a username and a password as a single entity, they identify the user and verify said user
- dragonwriter 5y ago
  > they are both a username and a password as a single entity And should your username ever also be your password?
  - CompuHacker 5y ago
    It shouldn't be, but it shouldn't be disallowed.
  - kube-system 5y ago
    Sometimes it is fine, depending on the particular application. I often use a single token to identify myself to office buildings, my car, my house, etc. Even my bank is okay with it, although that is more debatable.
samatman 5y ago
We're at a point where this old saw needs to be retired. Yes, if a system is storing your biometric data remotely, then it can't be changed and it's a username, not a password. But modern biometrics don't work that way, at all. The biometrics is stored client-side (hopefully securely and considerable effort is made to realize that hope), and it is used to access a private key which signs a challenge. The biometric can be revoked, the private key can be revoked, all of these things can be changed by the user. So let's say someone busts my fingerprint out of the TouchID secure enclave. That's not great (nor is it easy!), but they don't have an ability to generate a private key with it which Apple will recognize: that requires my password. So I can generate a fresh key, confirm it with my password, and now my copy of the biometric works and theirs doesn't. Edit: "courts or police can compel your fingerprint but not your password" is a completely different argument, and the solution is a way to rapidly lock out biometric authentication so that the password is a hard requirement. It also doesn't apply in a number of jurisdictions. As a practical matter, actors who are unwilling to reach for the rubber hose can't get a password, while a fingerprint just requires the willingness to manhandle someone without injuring them, and that much is basically universal.

They are authentication and authorization just like a username/password set. I don't see the Supreme Court allowing this if they won't allow compulsion of releasing a password. Right against self incrimination. Should be interesting though.

therobot24 5y ago
i think the difference is compelled speech - you don't have to 'say' your biometric user/pass combo
ColinWright 5y ago
Quoting: "Reffitt’s lawyer told CNN ...that the laptop is now unlocked."
leereeves 5y ago
> Right against self incrimination. You can be forced to submit to fingerprinting, which could also be incriminating.
- Clubber 5y ago
  That's a good point, but those fingerprints aren't used to open say, a biometric safe. They are used to compare with fingerprints found at the scene of a crime. Here's some interesting copy on similar cases. https://arstechnica.com/tech-policy/2020/06/indiana-supreme-court-its-unconstitutional-to-force-phone-unlocking/ https://arstechnica.com/tech-policy/2020/06/indiana-supreme-...
  - deleted 5y ago
    [deleted]
ortusdux 5y ago
"A password, sometimes called a passcode, is secret data, typically a string of characters, usually used to confirm a user's identity." https://en.wikipedia.org/wiki/Password https://en.wikipedia.org/wiki/Password There is nothing secret about your biometrics. Especially not while you are in detention.
- Clubber 5y ago
  No but compelling you to use your biometrics to self incriminate is something else altogether.
  - ortusdux 5y ago
    Imagine their password was written on a bracelet. Plainly visible to the public, easily recreated from photos, and 0% secret. The cops wouldn't even need a court order to read it. That is what biometrics are. They are the sticky note next to the monitor with a password written on it.
    - twirlock 5y ago
      So what is the court order for then?
    - Clubber 5y ago
      The state doesn't need your cooperation to type in a password that is plainly visible though. That's where the self incrimination comes in.
threatofrain 5y ago
The Supreme Court has repeatedly punted the issue down to state courts. What do you think is different this time?
- Clubber 5y ago
  They'll eventually have to rule on it because the state courts are split, when that is, who knows. It's certainly a 5th amendment case, so they'll have to address it eventually, perhaps they are waiting on the right case? I dunno.
  - alistairSH 5y ago
    What appellate courts have ruled in favor or biometrics being protected? That would potentially upend decades of case law - the government can compel somebody to produce a physical key (which now includes fingerprints and other biometrics) but cannot compel production of a passcode/combination.
    - Clubber 5y ago
      >What appellate courts have ruled in favor or biometrics being protected? This article talks about a case in the 11th circuit in 2012 and another in the Pennsylvania Supreme Court, Commonwealth v. Davis. Apparently the only time you can compel someone to give their password (which biometrics serve the same purpose) is if the state already knows what's on there. It's called "foregone conclusion exception." Yet if the government can show that it already knows of the existence and the suspect’s possession of the documents at issue—i.e., that these matters are a “foregone conclusion” and thus that the factual assertions implicit in the act of production add “little or nothing to the sum total of the Government’s information”—then “no Fifth Amendment right is touched because the ‘question is not of testimony but of surrender.’” https://crsreports.congress.gov/product/pdf/LSB/LSB10416 https://crsreports.congress.gov/product/pdf/LSB/LSB10416

therobot24 5y ago

they are both a username and a password as a single entity, they identify the user and verify said user

dragonwriter 5y ago
> they are both a username and a password as a single entity And should your username ever also be your password?
- CompuHacker 5y ago
  It shouldn't be, but it shouldn't be disallowed.
- kube-system 5y ago
  Sometimes it is fine, depending on the particular application. I often use a single token to identify myself to office buildings, my car, my house, etc. Even my bank is okay with it, although that is more debatable.

samatman 5y ago

We're at a point where this old saw needs to be retired. Yes, if a system is storing your biometric data remotely, then it can't be changed and it's a username, not a password. But modern biometrics don't work that way, at all. The biometrics is stored client-side (hopefully securely and considerable effort is made to realize that hope), and it is used to access a private key which signs a challenge. The biometric can be revoked, the private key can be revoked, all of these things can be changed by the user. So let's say someone busts my fingerprint out of the TouchID secure enclave. That's not great (nor is it easy!), but they don't have an ability to generate a private key with it which Apple will recognize: that requires my password. So I can generate a fresh key, confirm it with my password, and now my copy of the biometric works and theirs doesn't. Edit: "courts or police can compel your fingerprint but not your password" is a completely different argument, and the solution is a way to rapidly lock out biometric authentication so that the password is a hard requirement. It also doesn't apply in a number of jurisdictions. As a practical matter, actors who are unwilling to reach for the rubber hose can't get a password, while a fingerprint just requires the willingness to manhandle someone without injuring them, and that much is basically universal.