4 ms·

I think my favourite Usenix paper is appropriate here: "Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’l

I think my favourite Usenix paper is appropriate here: "Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT." -- https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf Good passwords and biometrics help if your adversary is not-Mossad. Anybody who thinks biometrics or encryption or anything short of "Magical amulets? Fake your own death, move into a submarine?" is going to protect them again a nation state level adversary is kidding themselves.

smnrchrds 5y ago
Whether passwords are considered testimony or not is not quite settled in US and Canada yet. There are instances where the court has determined that the accused can be forced to put their finger on the fingerprint reader of their device, but cannot be forced to give up their password. Although there are cases where the password was forced to be given up as well. Until this is resolved one way or another, passwords remain potentially safer than biometrics.
- Aulig 5y ago
  It's similar in Germany. Police may just take your finger and put it on the sensor. But you can't be forced to give out your password.
  - fastball 5y ago
    FaceID might be useful here? Won't work if your eyes are closed.
    - Thlom 5y ago
      I think you can disable that by disabling "require attention". If "require attention" is enabled FaceID won't work unless you are looking at your phone. I believe it is enabled by default. But pro-tip if you are being apprehended by police is to furiously click on the side button as the phone will require pin code after that.
      - jcla1 5y ago
        > But pro-tip if you are being apprehended by police is to furiously click on the side button as the phone will require pin code after that. Apparently that won't work on Android -- though there's a lockdown feature (that will disable biometric-unlock) that you can access after long pressing the power button.
        Aulig 5y ago
        Yea, I wish lockdown was easier to access on Android. An alternative would be holding the power button for long enough to turn the phone off. Not great either though.
    - Fnoord 5y ago
      I don't know about Germany but here in The Netherlands Face ID falls in same ballpark as fingerprint. The police can use reasonable force to have you unlock your device with fingerprint, or with your face.
    - Aulig 5y ago
      I wouldnt rely on that personally - too risky for me to have it sporadically misfunction or the police tricking me somehow.
- vbezhenar 5y ago
  There's a difference. Your finger can be used against your will. Your brain can't be scanned for password against your will, you have an ultimate choice to provide password or not.
  - pwdisswordfish0 5y ago
    Your brain can be “brute-forced” and Mossad will do it.
    - brippalcharrid 5y ago
      Your brain has different failure modes to your fingerprints, though, and your brain in itself cannot [yet] be used involuntarily in the way that your finger[-tip] can, and as a result of factors like these it's harder to implement distress protocols in biometric authentication systems.
  - bbarnett 5y ago
    What? Throw someone in an MRI or whatever. Continuously scan their brain, while their eyes are taped open, and display a changing character on the screen. Meanwhile, play a sound file with someone saying "password" in the background constantly, so diversionary mental tactics won't work. Soon, the first character of their pass will appear, a part of their brain will respond, and you have the first char. Continue until the entire pass appears, and "despair" alights in their brain. Success! Drink champagne and rejoice.
    - mercora 5y ago
      has this been tried? sounds interesting on its own :)
    - faeyanpiraat 5y ago
      That is barbaric. Implanting a neuralink should do the job more elegantly.
    - HowTheStoryEnds 5y ago
- Veen 5y ago
  You can quickly disable biometric access on iPhones while the phone is locked by pressing the wake and a volume button simultaneously or pressing the wake button five times, although the latter triggers a call to emergency services too. Of course, that's only useful if you are in position to do so.
  - Fnoord 5y ago
    Every police officer should know this, and try to work around it when the situation arises. My fingerprint reader on my smartphone is so fucked up that if I just quickly move my finger on it, I had to many attempts and its disabled. Then it requires whatever you use else (PIN, password, ...)
teddyh 5y ago
> you’re either dealing with Mossad or not-Mossad. No, you’re leaving out one very important class of actors, which I will call the NSA: The NSA, and others like them, unlike Mossad, are not after you personally, in that they don't want to do anything to you. Not immediately. Not now. They simply want to get to know you better. They are gathering information. All the information. What you do, what you buy, how you vote, what you think. And they want to do this to everybody, all the time. This might or not bite you in the future. You seems to imply that since nothing immediately bad is happening by using slightly bad security, then it’s OK and we shouldn’t worry about it, since Mossad is not after us. I think that we should have a slightly longer view of what allowing NSA (et al.) to know everything about everybody would mean, and who NSA could some day give this information to, and what those people could do with the information. You have to think a few steps ahead to realize the danger. (This has been a partial repost of a comment written a year ago: https://news.ycombinator.com/item?id=23572778 https://news.ycombinator.com/item?id=23572778)
- ohgodplsno 5y ago
  The NSA _is_ Mossad. The NSA has means way beyond what an individual actor has. The NSA splices cables and taps directly into ISPs and large companies to vacuum up all your data. Do they read your encrypted data ? Maybe not. But the moment you truly become interesting to them, they _will_ have a wrench to make you give out the password. Don't kid yourself.
  - teddyh 5y ago
    All that is true. What I was criticizing was the logic of the linked paper, which went, essentially: ‘When I do slightly insecure things, nothing bad observably happens. Therefore, Mossad must not be after me. It follows that it’s OK to not be very secure, since only Mossad could break through my security anyway’. This logic is faulty for the reason I wrote; your slightly bad security can be broken without you necessarily knowing about it, since the reason the entities I termed “the NSA” have for breaking your security is different from the reason which what he termed “Mossad” has.
rocqua 5y ago
James Mickens wrote some of the funniest things I have ever read. I strongly recommend all of his articles.

smnrchrds 5y ago

Whether passwords are considered testimony or not is not quite settled in US and Canada yet. There are instances where the court has determined that the accused can be forced to put their finger on the fingerprint reader of their device, but cannot be forced to give up their password. Although there are cases where the password was forced to be given up as well. Until this is resolved one way or another, passwords remain potentially safer than biometrics.

Aulig 5y ago
It's similar in Germany. Police may just take your finger and put it on the sensor. But you can't be forced to give out your password.
- fastball 5y ago
  FaceID might be useful here? Won't work if your eyes are closed.
  - Thlom 5y ago
    I think you can disable that by disabling "require attention". If "require attention" is enabled FaceID won't work unless you are looking at your phone. I believe it is enabled by default. But pro-tip if you are being apprehended by police is to furiously click on the side button as the phone will require pin code after that.
    - jcla1 5y ago
      > But pro-tip if you are being apprehended by police is to furiously click on the side button as the phone will require pin code after that. Apparently that won't work on Android -- though there's a lockdown feature (that will disable biometric-unlock) that you can access after long pressing the power button.
      - Aulig 5y ago
        Yea, I wish lockdown was easier to access on Android. An alternative would be holding the power button for long enough to turn the phone off. Not great either though.
  - Fnoord 5y ago
    I don't know about Germany but here in The Netherlands Face ID falls in same ballpark as fingerprint. The police can use reasonable force to have you unlock your device with fingerprint, or with your face.
  - Aulig 5y ago
    I wouldnt rely on that personally - too risky for me to have it sporadically misfunction or the police tricking me somehow.
vbezhenar 5y ago
There's a difference. Your finger can be used against your will. Your brain can't be scanned for password against your will, you have an ultimate choice to provide password or not.
- pwdisswordfish0 5y ago
  Your brain can be “brute-forced” and Mossad will do it.
  - brippalcharrid 5y ago
    Your brain has different failure modes to your fingerprints, though, and your brain in itself cannot [yet] be used involuntarily in the way that your finger[-tip] can, and as a result of factors like these it's harder to implement distress protocols in biometric authentication systems.
- bbarnett 5y ago
  What? Throw someone in an MRI or whatever. Continuously scan their brain, while their eyes are taped open, and display a changing character on the screen. Meanwhile, play a sound file with someone saying "password" in the background constantly, so diversionary mental tactics won't work. Soon, the first character of their pass will appear, a part of their brain will respond, and you have the first char. Continue until the entire pass appears, and "despair" alights in their brain. Success! Drink champagne and rejoice.
  - mercora 5y ago
    has this been tried? sounds interesting on its own :)
  - faeyanpiraat 5y ago
    That is barbaric. Implanting a neuralink should do the job more elegantly.
  - HowTheStoryEnds 5y ago
Veen 5y ago
You can quickly disable biometric access on iPhones while the phone is locked by pressing the wake and a volume button simultaneously or pressing the wake button five times, although the latter triggers a call to emergency services too. Of course, that's only useful if you are in position to do so.
- Fnoord 5y ago
  Every police officer should know this, and try to work around it when the situation arises. My fingerprint reader on my smartphone is so fucked up that if I just quickly move my finger on it, I had to many attempts and its disabled. Then it requires whatever you use else (PIN, password, ...)

teddyh 5y ago

> you’re either dealing with Mossad or not-Mossad. No, you’re leaving out one very important class of actors, which I will call the NSA: The NSA, and others like them, unlike Mossad, are not after you personally, in that they don't want to do anything to you. Not immediately. Not now. They simply want to get to know you better. They are gathering information. All the information. What you do, what you buy, how you vote, what you think. And they want to do this to everybody, all the time. This might or not bite you in the future. You seems to imply that since nothing immediately bad is happening by using slightly bad security, then it’s OK and we shouldn’t worry about it, since Mossad is not after us. I think that we should have a slightly longer view of what allowing NSA (et al.) to know everything about everybody would mean, and who NSA could some day give this information to, and what those people could do with the information. You have to think a few steps ahead to realize the danger. (This has been a partial repost of a comment written a year ago: https://news.ycombinator.com/item?id=23572778 https://news.ycombinator.com/item?id=23572778)

ohgodplsno 5y ago
The NSA _is_ Mossad. The NSA has means way beyond what an individual actor has. The NSA splices cables and taps directly into ISPs and large companies to vacuum up all your data. Do they read your encrypted data ? Maybe not. But the moment you truly become interesting to them, they _will_ have a wrench to make you give out the password. Don't kid yourself.
- teddyh 5y ago
  All that is true. What I was criticizing was the logic of the linked paper, which went, essentially: ‘When I do slightly insecure things, nothing bad observably happens. Therefore, Mossad must not be after me. It follows that it’s OK to not be very secure, since only Mossad could break through my security anyway’. This logic is faulty for the reason I wrote; your slightly bad security can be broken without you necessarily knowing about it, since the reason the entities I termed “the NSA” have for breaking your security is different from the reason which what he termed “Mossad” has.

rocqua 5y ago

James Mickens wrote some of the funniest things I have ever read. I strongly recommend all of his articles.