4 ms·

From a practical point of view these kinds of cases are interesting to me, because, coming from an iPhone this seems like it would largely be a non-issue. If m

From a practical point of view these kinds of cases are interesting to me, because, coming from an iPhone this seems like it would largely be a non-issue. If my phone was handed to or taken by an officer, I would either quickly do the 5-tap on the lock button which will require a password (not faceid or touchid) next time, or, simply by them handling it, faceid would be locked out. Is that not a thing with Android? I've seen articles where a suspect is requested or compelled to unlock a phone with biometrics which was held in evidence for months! Does Android (and I know this is a much broader question than with iPhone) just allow touch/face ID in perpetuity with no locks on it?

OkayPhysicist 2y ago
Stock Android doesn't have a shortcut to disable thumbprint, to my knowledge, but it does require passcode on reboot. So a long hold of the power button would avoid this 5th amendment loophole.
- neurostimulant 2y ago
  My android phone would refuse to unlock with biometrics and requires pin unlock every 24h. Is that manufacturer-specific feature?
logicprog 2y ago
On GrapheneOS (what I use) there's this at least: https://grapheneos.org/features#more-secure-fingerprint-unlock https://grapheneos.org/features#more-secure-fingerprint-unlo...
steve_rambo 2y ago
I had a chuckle at this being a "non-issue". Where I am from, you'll get a severe beating (or worse) if you refused to provide the authentication credential, whatever it might be. It's like we're living on different planets. I can only humbly suggest fighting for your rights tooth and nail while you have them.
- askonomm 2y ago
  Where are you from where there are no human rights, if you don't mind me asking?
- dontupvoteme 2y ago
  It always seemed like the 'fake' encrypted data, e.g. hidden volumes on veracrypt[1] seemed like one of the better options for these situations. Obviously phones don't have them and the data has to be believable, but it gives you an out. 1 - (I'm not sure what this is technically called)
  - defrost 2y ago
    One of the older and more entertaining names is Rubber hose encryption. When faceless Zombie thugs of a military junta beat you with a rubberhose you can give up successive passwords to deeper and deeper "secrets" until finally(???) your embarrasing stash of midget donkey necro porn is revealed!! .. and no one can ever establish whether there is yet another password that hides your local contacts in the resistance. The success of this may vary in practice and black site .. but mathematically the theory is sound. Today we have the less evocative name Deniable encryption. Fun Trivia: Rubberhose (also known by its development codename Marutukku) is a deniable encryption program which encrypts data on a storage device and hides the encrypted data. The existence of the encrypted data can only be verified using the appropriate cryptographic key. It was created by Julian Assange, Suelette Dreyfus, and Ralf Weinmann as a tool for human rights workers who needed to protect sensitive data in the field and was initially released in 1997. https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/Deniable_encryption https://theconversation.com/profiles/suelette-dreyfus-1102/articles https://theconversation.com/profiles/suelette-dreyfus-1102/a...
    - deleted 2y ago
      [deleted]
- AdamJacobMuller 2y ago
  Oh, I'm well aware. I've spent 25 years fighting against intrusions in our rights. Admittedly, quietly and sadly, mostly unsuccessfully as every year things are eroded further and further. I don't think the US will ever devolve into a scenario where the police will beat you for refusing to provide your password, I don't even think we will end up in a situation where police can legally compel you to give up your password. I think we will end up where cloud providers will be legally compelled to provide data on request (banning E2E) and consumers will be incentivized (both in unnatural and natural ways) to more deeply rely on cloud services.
adrianmonk 2y ago
On a Pixel phone, you just select "Lockdown" from the same menu that you use to power off or restart.
- NoGravitas 2y ago
  Also on LineageOS, and probably any close-to-AOSP Android. You have to enable "extended power menu" or something like that, though, and I don't remember the setting being super obvious.
  - adrianmonk 2y ago
    Yeah, I just checked my Samsung tablet (also Android), and it required enabling it somewhere in settings. I wish they'd enable it by default. I'm not sure why it wouldn't be that way.
autoexec 2y ago
I don't see why the police couldn't keep an iphone in evidence for months while they attempt exploits to gain access. That's already happened right? I'm guessing that law enforcement will continue to push for companies to install backdoors for them in their devices as well.
- kergonath 2y ago
  I think the point was that after more than a couple of hours you should not be able to unlock a device using biometrics alone. I would tend to agree. Biometrics are a convenience, but also a weakness.
  - AdamJacobMuller 2y ago
    Correct, that was my point, and iOS already does this. I'm surprised Android does not.
    - saagarjha 2y ago
      Android does this too.
Jtsummers 2y ago
The phone in this case was in his car door, he would have had to do that while pulling over or while pulled over for the initial traffic violation.

OkayPhysicist 2y ago

Stock Android doesn't have a shortcut to disable thumbprint, to my knowledge, but it does require passcode on reboot. So a long hold of the power button would avoid this 5th amendment loophole.

neurostimulant 2y ago
My android phone would refuse to unlock with biometrics and requires pin unlock every 24h. Is that manufacturer-specific feature?

logicprog 2y ago

On GrapheneOS (what I use) there's this at least: https://grapheneos.org/features#more-secure-fingerprint-unlock https://grapheneos.org/features#more-secure-fingerprint-unlo...

steve_rambo 2y ago

I had a chuckle at this being a "non-issue". Where I am from, you'll get a severe beating (or worse) if you refused to provide the authentication credential, whatever it might be. It's like we're living on different planets. I can only humbly suggest fighting for your rights tooth and nail while you have them.

askonomm 2y ago
Where are you from where there are no human rights, if you don't mind me asking?
dontupvoteme 2y ago
It always seemed like the 'fake' encrypted data, e.g. hidden volumes on veracrypt[1] seemed like one of the better options for these situations. Obviously phones don't have them and the data has to be believable, but it gives you an out. 1 - (I'm not sure what this is technically called)
- defrost 2y ago
  One of the older and more entertaining names is Rubber hose encryption. When faceless Zombie thugs of a military junta beat you with a rubberhose you can give up successive passwords to deeper and deeper "secrets" until finally(???) your embarrasing stash of midget donkey necro porn is revealed!! .. and no one can ever establish whether there is yet another password that hides your local contacts in the resistance. The success of this may vary in practice and black site .. but mathematically the theory is sound. Today we have the less evocative name Deniable encryption. Fun Trivia: Rubberhose (also known by its development codename Marutukku) is a deniable encryption program which encrypts data on a storage device and hides the encrypted data. The existence of the encrypted data can only be verified using the appropriate cryptographic key. It was created by Julian Assange, Suelette Dreyfus, and Ralf Weinmann as a tool for human rights workers who needed to protect sensitive data in the field and was initially released in 1997. https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/Deniable_encryption https://theconversation.com/profiles/suelette-dreyfus-1102/articles https://theconversation.com/profiles/suelette-dreyfus-1102/a...
  - deleted 2y ago
    [deleted]
AdamJacobMuller 2y ago
Oh, I'm well aware. I've spent 25 years fighting against intrusions in our rights. Admittedly, quietly and sadly, mostly unsuccessfully as every year things are eroded further and further. I don't think the US will ever devolve into a scenario where the police will beat you for refusing to provide your password, I don't even think we will end up in a situation where police can legally compel you to give up your password. I think we will end up where cloud providers will be legally compelled to provide data on request (banning E2E) and consumers will be incentivized (both in unnatural and natural ways) to more deeply rely on cloud services.

adrianmonk 2y ago

On a Pixel phone, you just select "Lockdown" from the same menu that you use to power off or restart.

NoGravitas 2y ago
Also on LineageOS, and probably any close-to-AOSP Android. You have to enable "extended power menu" or something like that, though, and I don't remember the setting being super obvious.
- adrianmonk 2y ago
  Yeah, I just checked my Samsung tablet (also Android), and it required enabling it somewhere in settings. I wish they'd enable it by default. I'm not sure why it wouldn't be that way.

autoexec 2y ago

I don't see why the police couldn't keep an iphone in evidence for months while they attempt exploits to gain access. That's already happened right? I'm guessing that law enforcement will continue to push for companies to install backdoors for them in their devices as well.

kergonath 2y ago
I think the point was that after more than a couple of hours you should not be able to unlock a device using biometrics alone. I would tend to agree. Biometrics are a convenience, but also a weakness.
- AdamJacobMuller 2y ago
  Correct, that was my point, and iOS already does this. I'm surprised Android does not.
  - saagarjha 2y ago
    Android does this too.

Jtsummers 2y ago

The phone in this case was in his car door, he would have had to do that while pulling over or while pulled over for the initial traffic violation.