5 ms·

The flaw with this list is that it treats all risks as equally likely and does not distinguish between various threat landscapes. Few people are high value eno

The flaw with this list is that it treats all risks as equally likely and does not distinguish between various threat landscapes. Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine.

schoen 5y ago
More common associated risk: Police detain you and point your phone at your face to unlock it (or unlock your access to some other resource). That is not a very high-tech or high-effort attack and could be relevant if you're concerned about the police. Someone might say that this concern is useless because the police can also coerce you to unlock your phone via a different method, but that depends on the law and culture in your particular environment (I guess ranging from "extremely unlikely" to "almost certain" depending on where you are). Edit: I don't mean to disagree with your overall point that understanding the threat landscape and threat model is very important, just to say that there is a very simple and plausible threat to which the precaution you used as an example can be relevant.
- InitialBP 5y ago
  Definitely a good threat I hadn't considered. I imagine from someone who is less educated about technology in general, having a list of "example threats" that those items might protect against would be beneficial to help offer some more incentive to follow this list other than just "Good Security".
- astockwell 5y ago
  If you press and hold both the lock button + the volume up button long enough to open the power-off screen, it will disable faceID (on iPhone) until you enter your passcode again. Handy to know and easy enough to do discreetly in a pinch.
  - kingcharles 5y ago
    I know I've posted this a lot of times, so I'm sounding like a broken record, but you won't get a chance to do it. When the government came for me they pointed a loaded gun at my head. There was no way I could have moved my hands to start fannying around with my phone. I refused to cooperate when they threatened me, but they soon realized a new tactic and threatened my wife. You're probably tougher than you think. You might be able to take a spanner to your knee caps, but if the government puts a gun to your spouse or children (or even your dog), what are you going to do then? Certainly in the USA at least, I don't think the police are committing any misconduct by telling you they are going to take your wife outside and shoot her in the face if you don't give up your fifth amendment privilege.
  - kdtsh 5y ago
    Pressing the power button five times in quick succession does the same - another handy trick.
    - zrail 5y ago
      On my phone pressing the power button five times quickly starts a 10 second timer and then it auto-calls emergency services and I'm pretty sure this is the default.
  - tomekf 5y ago
    I always feel that this should be promoted more. Simple but effective in sticky situations…
  - suchire 5y ago
    Clicking the side button five times will do the same
- pkingobject 5y ago
  I agree, it very much depends on who is targeting you. If it's the police on the street or at your home, say in russia or another third world country, then they can just lock you up or go as far as torture to get access. If they want to access your phone they will. But someone random on the internet trying to get your google photos? Completely different.
InitialBP 5y ago
Definitely agree with you, there's no need to waste resources on protecting against threats that would never target you - like attempting to capture your face from CCTV and spending real money and resources to get a mask and then stealing your device... etc like you noted. The author does have face unlock listed as "Advanced" priority. The wording is a bit weird but I take it to mean, only someone who has "very advanced" security concerns would need to follow that recommendation. If I were going to recommend this to a friend/family member I would just tell them to stick to the basic priority items and not worry about the higher pieces.
jjulius 5y ago
>Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine. I feel like this point misses the first point you made, about things being a lot more circumstantial and nuanced. It all depends on what you have to hide and on what device. Someone may need to go to the level of effort you mentioned to access someone's iPhone, while someone else may need to just print out a mugshot and hold it in front of a laptop webcam to unlock their computer. Edit: I'll also second schoen's point about someone forcefully holding your own face up to the device.
godmode2019 5y ago
You are missing the legal distinction forcing a password from someone is illegal because of the right to remain silent. But detaining someone and scanning their face is 100% allowed.
- Hnrobert42 5y ago
  Your point only underscores my point. The list doesn’t discuss your threat, so in my initial assessment of the list, I didn’t think of it.
ozim 5y ago
I don't see the flaw as there is obvious "recommended", "optional", "advanced". List is "personal security checklist" so it also gives some context that you can infer "threat landscape", which I understand would be average Joe, not journalist, not a CEO, not a drug dealer, just normal employee having one bank account buying stuff online and going on vacations in his own country. If you want to implement everything that is "optional" in your life it will be security larping.

schoen 5y ago

More common associated risk: Police detain you and point your phone at your face to unlock it (or unlock your access to some other resource). That is not a very high-tech or high-effort attack and could be relevant if you're concerned about the police. Someone might say that this concern is useless because the police can also coerce you to unlock your phone via a different method, but that depends on the law and culture in your particular environment (I guess ranging from "extremely unlikely" to "almost certain" depending on where you are). Edit: I don't mean to disagree with your overall point that understanding the threat landscape and threat model is very important, just to say that there is a very simple and plausible threat to which the precaution you used as an example can be relevant.

InitialBP 5y ago
Definitely a good threat I hadn't considered. I imagine from someone who is less educated about technology in general, having a list of "example threats" that those items might protect against would be beneficial to help offer some more incentive to follow this list other than just "Good Security".
astockwell 5y ago
If you press and hold both the lock button + the volume up button long enough to open the power-off screen, it will disable faceID (on iPhone) until you enter your passcode again. Handy to know and easy enough to do discreetly in a pinch.
- kingcharles 5y ago
  I know I've posted this a lot of times, so I'm sounding like a broken record, but you won't get a chance to do it. When the government came for me they pointed a loaded gun at my head. There was no way I could have moved my hands to start fannying around with my phone. I refused to cooperate when they threatened me, but they soon realized a new tactic and threatened my wife. You're probably tougher than you think. You might be able to take a spanner to your knee caps, but if the government puts a gun to your spouse or children (or even your dog), what are you going to do then? Certainly in the USA at least, I don't think the police are committing any misconduct by telling you they are going to take your wife outside and shoot her in the face if you don't give up your fifth amendment privilege.
- kdtsh 5y ago
  Pressing the power button five times in quick succession does the same - another handy trick.
  - zrail 5y ago
    On my phone pressing the power button five times quickly starts a 10 second timer and then it auto-calls emergency services and I'm pretty sure this is the default.
- tomekf 5y ago
  I always feel that this should be promoted more. Simple but effective in sticky situations…
- suchire 5y ago
  Clicking the side button five times will do the same
pkingobject 5y ago
I agree, it very much depends on who is targeting you. If it's the police on the street or at your home, say in russia or another third world country, then they can just lock you up or go as far as torture to get access. If they want to access your phone they will. But someone random on the internet trying to get your google photos? Completely different.

InitialBP 5y ago

Definitely agree with you, there's no need to waste resources on protecting against threats that would never target you - like attempting to capture your face from CCTV and spending real money and resources to get a mask and then stealing your device... etc like you noted. The author does have face unlock listed as "Advanced" priority. The wording is a bit weird but I take it to mean, only someone who has "very advanced" security concerns would need to follow that recommendation. If I were going to recommend this to a friend/family member I would just tell them to stick to the basic priority items and not worry about the higher pieces.

jjulius 5y ago

>Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine. I feel like this point misses the first point you made, about things being a lot more circumstantial and nuanced. It all depends on what you have to hide and on what device. Someone may need to go to the level of effort you mentioned to access someone's iPhone, while someone else may need to just print out a mugshot and hold it in front of a laptop webcam to unlock their computer. Edit: I'll also second schoen's point about someone forcefully holding your own face up to the device.

godmode2019 5y ago

You are missing the legal distinction forcing a password from someone is illegal because of the right to remain silent. But detaining someone and scanning their face is 100% allowed.

Hnrobert42 5y ago
Your point only underscores my point. The list doesn’t discuss your threat, so in my initial assessment of the list, I didn’t think of it.

ozim 5y ago

I don't see the flaw as there is obvious "recommended", "optional", "advanced". List is "personal security checklist" so it also gives some context that you can infer "threat landscape", which I understand would be average Joe, not journalist, not a CEO, not a drug dealer, just normal employee having one bank account buying stuff online and going on vacations in his own country. If you want to implement everything that is "optional" in your life it will be security larping.