3 ms·

I am not sure what you are saying. If you use Apple's passkey implementation, you need to unlock your computer and when using a passkey confirm with Touch ID (o

I am not sure what you are saying. If you use Apple's passkey implementation, you need to unlock your computer and when using a passkey confirm with Touch ID (or Face ID on iPhone). So, if you don't need to unlock your phone, computer, or internet accounts for law enforcement, they also can't get your passkeys. Using a USB stick as a passkey without authentication is just a bad idea. Ps. passkeys are end-to-end encrypted on Apple devices using iCloud keychain. Sure, Apple could push a software update that exfiltrates your passkeys, but in the end you need a trust anchor somewhere in the chain.

TeMPOraL 2y ago
I think what they're saying is that when someone wants to use your password-locked device, they can threaten you with jail/obstruction of justice/beating/bullet, depending on where on the Law vs Chaos axis of the alignment chart they fall; you will then give them your password, and escape the extremely dangerous situation you found yourself in. With passkeys, unfortunately, they'll have to keep you around for all their exploits, and may need to regularly re-threaten/beat you into submission. In certain scenarios, there's such thing as too much security.
NewJazz 2y ago
Legally, you may not be compelled to provide a password. But the same is not quite as true for biometric attestations. First, a cop can physically use your face or finger to unlock your device without your consent. Second, legally they are allowed to compel you to unlock devices with these measures. https://reason.com/2024/04/19/appeals-court-rules-that-cops-can-physically-make-you-unlock-your-phone/ https://reason.com/2024/04/19/appeals-court-rules-that-cops-... https://www.eff.org/press/releases/eff-supreme-court-fifth-amendment-protects-people-being-forced-enter-or-hand-over https://www.eff.org/press/releases/eff-supreme-court-fifth-a...
jvanderbot 2y ago
Pointing out one good passkey implementation does not mean we should remove memorized secret non-physical passwords as security. A physical pass key can have all the biometrics in the world and be completely unprotected from law enforcement. Requiring multiple devices is useless if all devices can be unlocked with things I can see you carrying.
withinboredom 2y ago
On iPhones, simply holding the volume up and power button for five seconds disables Face ID just like a reboot. If you have that long, it’s all you need to do.

TeMPOraL 2y ago

I think what they're saying is that when someone wants to use your password-locked device, they can threaten you with jail/obstruction of justice/beating/bullet, depending on where on the Law vs Chaos axis of the alignment chart they fall; you will then give them your password, and escape the extremely dangerous situation you found yourself in. With passkeys, unfortunately, they'll have to keep you around for all their exploits, and may need to regularly re-threaten/beat you into submission. In certain scenarios, there's such thing as too much security.

NewJazz 2y ago

Legally, you may not be compelled to provide a password. But the same is not quite as true for biometric attestations. First, a cop can physically use your face or finger to unlock your device without your consent. Second, legally they are allowed to compel you to unlock devices with these measures. https://reason.com/2024/04/19/appeals-court-rules-that-cops-can-physically-make-you-unlock-your-phone/ https://reason.com/2024/04/19/appeals-court-rules-that-cops-... https://www.eff.org/press/releases/eff-supreme-court-fifth-amendment-protects-people-being-forced-enter-or-hand-over https://www.eff.org/press/releases/eff-supreme-court-fifth-a...

jvanderbot 2y ago

Pointing out one good passkey implementation does not mean we should remove memorized secret non-physical passwords as security. A physical pass key can have all the biometrics in the world and be completely unprotected from law enforcement. Requiring multiple devices is useless if all devices can be unlocked with things I can see you carrying.

withinboredom 2y ago

On iPhones, simply holding the volume up and power button for five seconds disables Face ID just like a reboot. If you have that long, it’s all you need to do.