5 ms·

I suspected that they used Cellebrite for this three days ago: https://x.com/SEJeff/status/1813079033430876433 https://x.com/SEJeff/status/1813079033430876433

by SEJeff 2y ago

I suspected that they used Cellebrite for this three days ago: https://x.com/SEJeff/status/1813079033430876433 https://x.com/SEJeff/status/1813079033430876433 As much as it makes folks reel, this is working as intended. If you don't want them to crack your phones, consider setting a 10+ digit alphanumeric passcode instead of a numeric PIN. Also, do not enable the biometrics such as FaceID. I'm very much of this opinion[1] that biometrics are usernames, not passwords. [1] https://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html https://blog.dustinkirkland.com/2013/10/fingerprints-are-use...

dmix 2y ago
And turn your phone power off before committing a crime… The first thing the police will do is connect it to power battery packs
- millzlane 2y ago
  Don't even bring your phone with you. You need to use old school methods to avoid tracking.
  - azinman2 2y ago
    [flagged]
    - JKCalhoun 2y ago
      I've been using this technique for some time now and it has been working really well.
      - dylan604 2y ago
        Here's a list of people that have strong disagree[0]. What about those that have been falsely identified by facial recognition software? Just because you think you've committed no crime doesn't mean the authorities have the same thought. [0] https://en.wikipedia.org/wiki/List_of_wrongful_convictions_in_the_United_States https://en.wikipedia.org/wiki/List_of_wrongful_convictions_i...
        marginalia_nu 2y ago
        So the updated advice is to not bring the phone when you're not about to commit a crime.
        dylan604 2y ago
        that's also been updated as not being the greatest advice as they can use the lack of activity for that time period as being abnormal for you device which show suspicion as well. just like not having any social media accounts looks suspicious. having a laptop with no data on it what so ever looks suspicious. if they want to find you as a suspect, they will find ways of doing it.
        gruez 2y ago
        >that's also been updated as not being the greatest advice as they can use the lack of activity for that time period as being abnormal for you device which show suspicion as well. If you're a NEET or wfh is it really suspicious that your phone hasn't moved the entire day?
        deleted 2y ago
        [deleted]
    - krapp 2y ago
      “One has not only a legal, but a moral responsibility to obey just laws. Conversely, one has a moral responsibility to disobey unjust laws.” – Martin Luther King, Jr.
      - marginalia_nu 2y ago
        And that's why Socrates didn't drink the hemlock.
        adolph 2y ago
        And the Tootsie Pop Owl didn't bite
        krapp 2y ago
        You're free to interpret your relationship with your government as a suicide pact if it pleases you. Others are not obligated to drink the poison of obsequious virtue.
        mrguyorama 2y ago
        The guy that was upset younger people were reading books instead of memorizing things, and believed that would make people dumb, and literally ruin the next generation of the world? Yeah maybe he wasn't infinitely wise on all things.
      - GeoAtreides 2y ago
        Now, if we only had a test to distinguish between just and unjust laws.
        krapp 2y ago
        Is your argument that we must obey all laws at all times, because a definition of "justice" cannot be given with the rigor of a mathematical proof? How then can law itself exist, without a means of objective interpretation? And why obey laws at all if no test exists by which any law can be determined to be either just or unjust? You can find thousands of years of scholarship, philosophy, religion and legal doctrine on the matter, and most people seem capable of coming to at least a subjective conclusion on what is and isn't just, apart from what is and isn't legal.
    - bitwize 2y ago
      How not to get your ass kicked by the police, step 1: OBEY THE LAW. https://www.youtube.com/watch?v=uj0mtxXEGE8 https://www.youtube.com/watch?v=uj0mtxXEGE8
      - a0123 2y ago
        An argument that could only be made by someone who's never read the news ever. Or dealt with police ever.
      - Volundr 2y ago
        That video probably isn't making the point your trying to make, given that it repeatedly shows people getting beaten by police for things that definitely don't warrant it, and towards the end advises "getting a white friend" as a means of avoiding police brutality.
    - hagbard_c 2y ago
      Qu'on me donne six lignes écrites de la main du plus honnête homme, j'y trouverai de quoi le faire pendre. [1] Richelieu may have said this or he may not have but the fact stands that there are enough laws on the books to convict anyone of a crime no matter how virtuous that person thinks he is. [1] https://en.wikiquote.org/wiki/Cardinal_Richelieu https://en.wikiquote.org/wiki/Cardinal_Richelieu
  - dist-epoch 2y ago
    But if you leave your phone at home only on the days you commit crimes, it's a problem too. This was used in the past to identify people.
    - mingus88 2y ago
      ALPR is the other big one. Your daily habits are in many databases and it’s easier than ever to sort out the outliers
      - lysp 2y ago
        I read this story many years ago where researchers were able to re-identify people using open travel datasets. https://www.unimelb.edu.au/newsroom/news/2019/august/myki-privacy-de-railed-travellers-movements-and-identities-at-risk-by-public-release-of-anonymised-data https://www.unimelb.edu.au/newsroom/news/2019/august/myki-pr...
JKCalhoun 2y ago
Numeric pin? Seems like fingerprints on the glass alone would make a shorter numeric pin trivial to crack. I'm just thinking of all the other weak security systems like garage door keypads where the code is derived from the more worn buttons. Or cleaning/dusting an ATM keypad before someone enters their code and then carefully examining the buttons afterwards. But who knows — perhaps people have completely munged up their displays making fingerprinting useless.
- byproxy 2y ago
  There are some touchscreen input systems that will randomize the configuration of the numbers displayed to mitigate the "finger smudge" attack.
  - mc32 2y ago
    Man that would suck. I rely on muscle memory to recall passwords in everyday usage. Of course I could open a PWD manager elsewhere but it becomes cumbersome.
    - sebastiennight 2y ago
      You would be surprised. After a couple days only, my brain adapted to the random layout well enough that it's the regular layout (on my iPhone, which doesn't seem to have the randomization ability) that throws me for a loop.
- askonomm 2y ago
  Would the ATM thing actually work though? Afaik most European ATM banks issue 4 digit pin codes and will block and eat the card at 3 invalid tries. Not sure how many tries you have total, but I figure it's not that easy to guess it right. Update: ChatGPT says 12 tries total to get it right, so that makes it ~10% success ratio?
  - JKCalhoun 2y ago
    I probably read about this technique in Phrack or something similar .... so that kind of dates it.
officeplant 2y ago
I'm not sure FaceID would have helped them as much in this instance going by pictures of the aftermath.
Zak 2y ago
> Also, do not enable the biometrics such as FaceID I'd really like to see the ability to set a specific fingerprint to lock down the phone, requiring a different, more secure credential from the regular lockscreen to unlock. A long passphrase would probably be the right credential for most people.
- doublepg23 2y ago
  If you hold power and a volume key on an iPhone will disable biometrics and require your password.
  - Zak 2y ago
    That's almost as good, but maybe harder under duress. As far as I can tell, Android requires interaction with the touchscreen.
- eviks 2y ago
  I'd like to have different fingers do different things, including one that prevents fingers from working And have a short extra custom gesture to face to unlock Or a dozen of other simple things we could get with a little more competition in a more open space
sholladay 2y ago
In addition to the problems you mentioned, biometric systems are basically designed to cause hash collisions. And probably to a higher degree than most people realize. After all, it would be annoying if FaceID failed just because I haven’t shaved today. So the algorithm has to account for that. As such, the entropy of the input is reduced.
jjav 2y ago
> As much as it makes folks reel, this is working as intended. If you don't want them to crack your phones, consider setting a 10+ digit alphanumeric passcode instead of a numeric PIN. Can't emphasize this enough. If you're going to use a phone, set a long strong password. Nothing else will do. Yes, it's a bit more inconvenient. There is no workaround.

by SEJeff 2y ago

dmix 2y ago

And turn your phone power off before committing a crime… The first thing the police will do is connect it to power battery packs

millzlane 2y ago
Don't even bring your phone with you. You need to use old school methods to avoid tracking.
- azinman2 2y ago
  [flagged]
  - JKCalhoun 2y ago
    I've been using this technique for some time now and it has been working really well.
    - dylan604 2y ago
      Here's a list of people that have strong disagree[0]. What about those that have been falsely identified by facial recognition software? Just because you think you've committed no crime doesn't mean the authorities have the same thought. [0] https://en.wikipedia.org/wiki/List_of_wrongful_convictions_in_the_United_States https://en.wikipedia.org/wiki/List_of_wrongful_convictions_i...
      - marginalia_nu 2y ago
        So the updated advice is to not bring the phone when you're not about to commit a crime.
        dylan604 2y ago
        that's also been updated as not being the greatest advice as they can use the lack of activity for that time period as being abnormal for you device which show suspicion as well. just like not having any social media accounts looks suspicious. having a laptop with no data on it what so ever looks suspicious. if they want to find you as a suspect, they will find ways of doing it.
        gruez 2y ago
        >that's also been updated as not being the greatest advice as they can use the lack of activity for that time period as being abnormal for you device which show suspicion as well. If you're a NEET or wfh is it really suspicious that your phone hasn't moved the entire day?
        deleted 2y ago
        [deleted]
  - krapp 2y ago
    “One has not only a legal, but a moral responsibility to obey just laws. Conversely, one has a moral responsibility to disobey unjust laws.” – Martin Luther King, Jr.
    - marginalia_nu 2y ago
      And that's why Socrates didn't drink the hemlock.
      - adolph 2y ago
        And the Tootsie Pop Owl didn't bite
      - krapp 2y ago
        You're free to interpret your relationship with your government as a suicide pact if it pleases you. Others are not obligated to drink the poison of obsequious virtue.
      - mrguyorama 2y ago
        The guy that was upset younger people were reading books instead of memorizing things, and believed that would make people dumb, and literally ruin the next generation of the world? Yeah maybe he wasn't infinitely wise on all things.
    - GeoAtreides 2y ago
      Now, if we only had a test to distinguish between just and unjust laws.
      - krapp 2y ago
        Is your argument that we must obey all laws at all times, because a definition of "justice" cannot be given with the rigor of a mathematical proof? How then can law itself exist, without a means of objective interpretation? And why obey laws at all if no test exists by which any law can be determined to be either just or unjust? You can find thousands of years of scholarship, philosophy, religion and legal doctrine on the matter, and most people seem capable of coming to at least a subjective conclusion on what is and isn't just, apart from what is and isn't legal.
  - bitwize 2y ago
    How not to get your ass kicked by the police, step 1: OBEY THE LAW. https://www.youtube.com/watch?v=uj0mtxXEGE8 https://www.youtube.com/watch?v=uj0mtxXEGE8
    - a0123 2y ago
      An argument that could only be made by someone who's never read the news ever. Or dealt with police ever.
    - Volundr 2y ago
      That video probably isn't making the point your trying to make, given that it repeatedly shows people getting beaten by police for things that definitely don't warrant it, and towards the end advises "getting a white friend" as a means of avoiding police brutality.
  - hagbard_c 2y ago
    Qu'on me donne six lignes écrites de la main du plus honnête homme, j'y trouverai de quoi le faire pendre. [1] Richelieu may have said this or he may not have but the fact stands that there are enough laws on the books to convict anyone of a crime no matter how virtuous that person thinks he is. [1] https://en.wikiquote.org/wiki/Cardinal_Richelieu https://en.wikiquote.org/wiki/Cardinal_Richelieu
- dist-epoch 2y ago
  But if you leave your phone at home only on the days you commit crimes, it's a problem too. This was used in the past to identify people.
  - mingus88 2y ago
    ALPR is the other big one. Your daily habits are in many databases and it’s easier than ever to sort out the outliers
    - lysp 2y ago
      I read this story many years ago where researchers were able to re-identify people using open travel datasets. https://www.unimelb.edu.au/newsroom/news/2019/august/myki-privacy-de-railed-travellers-movements-and-identities-at-risk-by-public-release-of-anonymised-data https://www.unimelb.edu.au/newsroom/news/2019/august/myki-pr...

JKCalhoun 2y ago

Numeric pin? Seems like fingerprints on the glass alone would make a shorter numeric pin trivial to crack. I'm just thinking of all the other weak security systems like garage door keypads where the code is derived from the more worn buttons. Or cleaning/dusting an ATM keypad before someone enters their code and then carefully examining the buttons afterwards. But who knows — perhaps people have completely munged up their displays making fingerprinting useless.

byproxy 2y ago
There are some touchscreen input systems that will randomize the configuration of the numbers displayed to mitigate the "finger smudge" attack.
- mc32 2y ago
  Man that would suck. I rely on muscle memory to recall passwords in everyday usage. Of course I could open a PWD manager elsewhere but it becomes cumbersome.
  - sebastiennight 2y ago
    You would be surprised. After a couple days only, my brain adapted to the random layout well enough that it's the regular layout (on my iPhone, which doesn't seem to have the randomization ability) that throws me for a loop.
askonomm 2y ago
Would the ATM thing actually work though? Afaik most European ATM banks issue 4 digit pin codes and will block and eat the card at 3 invalid tries. Not sure how many tries you have total, but I figure it's not that easy to guess it right. Update: ChatGPT says 12 tries total to get it right, so that makes it ~10% success ratio?
- JKCalhoun 2y ago
  I probably read about this technique in Phrack or something similar .... so that kind of dates it.

officeplant 2y ago

I'm not sure FaceID would have helped them as much in this instance going by pictures of the aftermath.

Zak 2y ago

> Also, do not enable the biometrics such as FaceID I'd really like to see the ability to set a specific fingerprint to lock down the phone, requiring a different, more secure credential from the regular lockscreen to unlock. A long passphrase would probably be the right credential for most people.

doublepg23 2y ago
If you hold power and a volume key on an iPhone will disable biometrics and require your password.
- Zak 2y ago
  That's almost as good, but maybe harder under duress. As far as I can tell, Android requires interaction with the touchscreen.
eviks 2y ago
I'd like to have different fingers do different things, including one that prevents fingers from working And have a short extra custom gesture to face to unlock Or a dozen of other simple things we could get with a little more competition in a more open space

sholladay 2y ago

In addition to the problems you mentioned, biometric systems are basically designed to cause hash collisions. And probably to a higher degree than most people realize. After all, it would be annoying if FaceID failed just because I haven’t shaved today. So the algorithm has to account for that. As such, the entropy of the input is reduced.

jjav 2y ago

> As much as it makes folks reel, this is working as intended. If you don't want them to crack your phones, consider setting a 10+ digit alphanumeric passcode instead of a numeric PIN. Can't emphasize this enough. If you're going to use a phone, set a long strong password. Nothing else will do. Yes, it's a bit more inconvenient. There is no workaround.