8 ms·

Exactly. It would be great to have a secondary pin (or my middle finger fingerprint, for example) in my phone to enter in a dummy environment with a few games,

Exactly. It would be great to have a secondary pin (or my middle finger fingerprint, for example) in my phone to enter in a dummy environment with a few games, some family pics and so.

ChrisMarshallNY 5y ago
It would need to be baked into the OS. With FaceID, I guess I could use eyes crossed, as a queue.
- anigbrowl 5y ago
  I do not understand why any security concerned person would use biometric identification for anything, ever.
  - dredmorbius 5y ago
    If that's what's mandated, you may have little choice.
    - bonzini 5y ago
      Somebody mandates using biometric identification instead of a PIN?!?
      - dredmorbius 5y ago
        Biometric passports: https://www.dhs.gov/e-passports https://www.dhs.gov/e-passports Face ID: https://support.apple.com/en-us/HT208109 https://support.apple.com/en-us/HT208109 Fingerprint Readers: https://www.samsung.com/us/support/answer/ANS00082563/ https://www.samsung.com/us/support/answer/ANS00082563/ These are extant, and either part of or required within numerous presently-used systems.
        anigbrowl 5y ago
        Sure, but nobody can pre-emptively mandate you use facial recognition on your personal communications device, and then put sensitive information in there. I can see a situation in a repressive country where if you buy a phone they set it up with facial recognition in the store and make you activate it, but then you know not to store stuff there. You could just physically damage the camera at a later date and claim you weren't able to make use of that any more.
        dredmorbius 5y ago
        I'm nowhere near that sanguine about this. I've a device (Onyx BOOX) which apparently can only be password-secured if I create a vendor-based account on it. (I've been trying to see if this is bypassable, so far, no dice.) That's not biometrics, but it's a case of being strongly limited by a system architecture. If you're using a device at the obligation of an employer, you may well find that it has, and/or organisational policy requires, biometrics. It's increasingly difficult to find devices that don't include some form of biometrics-based functionality. The notion that that becomes the primary or only means of securing access is not entirely far-fetched. Capabilities, possibilities, and dependencies have a really funny way of becoming hard requirements over time. I could speak the Celtic of my ancient ancestors or communicate in cuneiform or ancient Egyptian hyroglyphics, if really wanted to. My ability to integrate and participate in modern life would be quite limited. The online and digital world are rapidly approaching this state.
  - lxgr 5y ago
    Why would being security conscious automatically disqualify biometrics? Security is all about threat models, and I can imagine quite a few scenarios where biometrics might fare better than passwords. Shoulder surfing and trivial passwords/PINs come to mind, for example. And who said that it's biometrics vs. anything else? It's quite advisable to combine authentication factors.
    - anigbrowl 5y ago
      Shoulder surfing and weak passwords are both something you can control at any time. Biometric identification can be exploited involuntarily by someone literally using force to apply your finger to a device or similar. I shouldn't need to say this, it's so obvious that it's a common plot device in action movies.
      - sabas123 5y ago
        And with a little bit more force they beat the password out of me anyway regardless which system I use...
        anigbrowl 5y ago
        If you are so easily swayed, you would probably not be in an adversarial situation with a government anyway. But this article is about a system for giving up passwords under duress without necessarily compromising all your security, such that your antagonist has no way of knowing or showing that there's another password concealing more important information.
        ikiris 5y ago
        https://xkcd.com/538/ https://xkcd.com/538/
        bigiain 5y ago
        Pretty sure Guantanamo Bay and “enhances interrogation” has shown us that after your antagonist has used the $5 wrench to beat a working password out of you, they then keep on beating you every day for another few weeks just in case there’s more you should have told them. If “those guys” are your adversary, you were fucked before you started.
  - SalimoS 5y ago
    Because there is a difference between identification and authentication and unfortunately the Touch/Face ID mixed then
- bartvk 5y ago
  That'd be neat. With Touch ID, it would be very intuitive to configure the middle finger as the trigger to run a duress script.
  - laurent92 5y ago
    Always configure a non-obvious part of your thumb (or left thumb) as Touch-ID. Then when under duress, use your normal thumb to make it fail.
    - SalimoS 5y ago
      You can push the lock button many time (when pulling you phone from the pocket for example) and it will require lock the phone and require to use your passcode
dheera 5y ago
I think on Android you can set up multiple users.
- canada_dry 5y ago
  I'd love that feature (android 9+) if it allowed me to install some of the gazillion apps (e.g. every bloody fast food place that only has deals via their app) but restricts them from accessing my real user contacts, emails, msgs, gps/location, etc. Blackberry phones had this feature and it was pretty bulletproof.
  - dheera 5y ago
    I believe users cannot access each others' data. So yes you can use it this way. I'm pretty sure it existed at Android 9. Are you running stock Android or some Samsung bull?
  - mimimi31 5y ago
    Have a look at Shelter[1] or Insular[2]. Both make use of Android's work profile feature to completely isolate apps in a separate environment. [1] https://f-droid.org/en/packages/net.typeblog.shelter https://f-droid.org/en/packages/net.typeblog.shelter [2] https://f-droid.org/en/packages/com.oasisfeng.island.fdroid https://f-droid.org/en/packages/com.oasisfeng.island.fdroid
- squarefoot 5y ago
  I don't think they hide their existence from each other however. If they're like Unix users, then one might see something like /home/user1 /home/user2 /home/user3, etc. so that all usernames would be clearly visible and the user could be then forced to reveal all passwords. The aim is to obtain plausible deniability, that is logging in as the safest user according to the situation, while at the same time hiding all others.
lisnake 5y ago
The feature exactly like that exists in Xiaomi phones. It's called Second space, and basically allows you to have second profile with different apps or accounts. Interesting thing is that you can set it up to open when unlocking the phone with specific fingerprint. The idea is to fill that Second space with dummy info, and unlock it with your little finger, for example (or vice versa, use it for sensitive information). Obviously, it wouldn't fool thorough phone scan (and if you dig deep enough in the settings you can see if the feature is enabled) but can be useful at quick cursory scans, like if you need to provide your phone at the border

Exactly. It would be great to have a secondary pin (or my middle finger fingerprint, for example) in my phone to enter in a dummy environment with a few games, some family pics and so.

ChrisMarshallNY 5y ago

It would need to be baked into the OS. With FaceID, I guess I could use eyes crossed, as a queue.

anigbrowl 5y ago
I do not understand why any security concerned person would use biometric identification for anything, ever.
- dredmorbius 5y ago
  If that's what's mandated, you may have little choice.
  - bonzini 5y ago
    Somebody mandates using biometric identification instead of a PIN?!?
    - dredmorbius 5y ago
      Biometric passports: https://www.dhs.gov/e-passports https://www.dhs.gov/e-passports Face ID: https://support.apple.com/en-us/HT208109 https://support.apple.com/en-us/HT208109 Fingerprint Readers: https://www.samsung.com/us/support/answer/ANS00082563/ https://www.samsung.com/us/support/answer/ANS00082563/ These are extant, and either part of or required within numerous presently-used systems.
      - anigbrowl 5y ago
        Sure, but nobody can pre-emptively mandate you use facial recognition on your personal communications device, and then put sensitive information in there. I can see a situation in a repressive country where if you buy a phone they set it up with facial recognition in the store and make you activate it, but then you know not to store stuff there. You could just physically damage the camera at a later date and claim you weren't able to make use of that any more.
        dredmorbius 5y ago
        I'm nowhere near that sanguine about this. I've a device (Onyx BOOX) which apparently can only be password-secured if I create a vendor-based account on it. (I've been trying to see if this is bypassable, so far, no dice.) That's not biometrics, but it's a case of being strongly limited by a system architecture. If you're using a device at the obligation of an employer, you may well find that it has, and/or organisational policy requires, biometrics. It's increasingly difficult to find devices that don't include some form of biometrics-based functionality. The notion that that becomes the primary or only means of securing access is not entirely far-fetched. Capabilities, possibilities, and dependencies have a really funny way of becoming hard requirements over time. I could speak the Celtic of my ancient ancestors or communicate in cuneiform or ancient Egyptian hyroglyphics, if really wanted to. My ability to integrate and participate in modern life would be quite limited. The online and digital world are rapidly approaching this state.
- lxgr 5y ago
  Why would being security conscious automatically disqualify biometrics? Security is all about threat models, and I can imagine quite a few scenarios where biometrics might fare better than passwords. Shoulder surfing and trivial passwords/PINs come to mind, for example. And who said that it's biometrics vs. anything else? It's quite advisable to combine authentication factors.
  - anigbrowl 5y ago
    Shoulder surfing and weak passwords are both something you can control at any time. Biometric identification can be exploited involuntarily by someone literally using force to apply your finger to a device or similar. I shouldn't need to say this, it's so obvious that it's a common plot device in action movies.
    - sabas123 5y ago
      And with a little bit more force they beat the password out of me anyway regardless which system I use...
      - anigbrowl 5y ago
        If you are so easily swayed, you would probably not be in an adversarial situation with a government anyway. But this article is about a system for giving up passwords under duress without necessarily compromising all your security, such that your antagonist has no way of knowing or showing that there's another password concealing more important information.
        ikiris 5y ago
        https://xkcd.com/538/ https://xkcd.com/538/
        bigiain 5y ago
        Pretty sure Guantanamo Bay and “enhances interrogation” has shown us that after your antagonist has used the $5 wrench to beat a working password out of you, they then keep on beating you every day for another few weeks just in case there’s more you should have told them. If “those guys” are your adversary, you were fucked before you started.
- SalimoS 5y ago
  Because there is a difference between identification and authentication and unfortunately the Touch/Face ID mixed then
bartvk 5y ago
That'd be neat. With Touch ID, it would be very intuitive to configure the middle finger as the trigger to run a duress script.
- laurent92 5y ago
  Always configure a non-obvious part of your thumb (or left thumb) as Touch-ID. Then when under duress, use your normal thumb to make it fail.
  - SalimoS 5y ago
    You can push the lock button many time (when pulling you phone from the pocket for example) and it will require lock the phone and require to use your passcode

dheera 5y ago

I think on Android you can set up multiple users.

canada_dry 5y ago
I'd love that feature (android 9+) if it allowed me to install some of the gazillion apps (e.g. every bloody fast food place that only has deals via their app) but restricts them from accessing my real user contacts, emails, msgs, gps/location, etc. Blackberry phones had this feature and it was pretty bulletproof.
- dheera 5y ago
  I believe users cannot access each others' data. So yes you can use it this way. I'm pretty sure it existed at Android 9. Are you running stock Android or some Samsung bull?
- mimimi31 5y ago
  Have a look at Shelter[1] or Insular[2]. Both make use of Android's work profile feature to completely isolate apps in a separate environment. [1] https://f-droid.org/en/packages/net.typeblog.shelter https://f-droid.org/en/packages/net.typeblog.shelter [2] https://f-droid.org/en/packages/com.oasisfeng.island.fdroid https://f-droid.org/en/packages/com.oasisfeng.island.fdroid
squarefoot 5y ago
I don't think they hide their existence from each other however. If they're like Unix users, then one might see something like /home/user1 /home/user2 /home/user3, etc. so that all usernames would be clearly visible and the user could be then forced to reveal all passwords. The aim is to obtain plausible deniability, that is logging in as the safest user according to the situation, while at the same time hiding all others.

lisnake 5y ago

The feature exactly like that exists in Xiaomi phones. It's called Second space, and basically allows you to have second profile with different apps or accounts. Interesting thing is that you can set it up to open when unlocking the phone with specific fingerprint. The idea is to fill that Second space with dummy info, and unlock it with your little finger, for example (or vice versa, use it for sensitive information). Obviously, it wouldn't fool thorough phone scan (and if you dig deep enough in the settings you can see if the feature is enabled) but can be useful at quick cursory scans, like if you need to provide your phone at the border