3 ms·

Knowledge-based access (something only stored in your head) has Constitutional protection in the United States. The same is probably not true for physical thing

Knowledge-based access (something only stored in your head) has Constitutional protection in the United States. The same is probably not true for physical things such as phones and YubiKeys stored in your pocket. Not that I worry about that, but it is worth pointing out that you may lose some legal protections when you use physical things rather than your knowledge.

acdha 2y ago
I have the most amazing coincidence to report about what protects my phone and Yubikeys.
- seethishat 2y ago
  Unfortunately, the forensic devices that easily extract data from your phone, can't be plugged into your head.
  - acdha 2y ago
    According to the manufacturers, those forensic devices also don’t work on my iPhone unless it’s unlocked with a password, but this is also irrelevant because they can get the stored passwords from the same phone in any scenario where they can access the passkey. More to the point, this is also not what the average computer user is worried about. It assumes that they’re targeted by police, have something they need to keep secret, and that those police can compel physical access but scrupulously obey civil rights protections.
nijave 2y ago
Do you have a source for this? As far as I know, it's at best a legal gray area. I believe in most cases you'll still be held in contempt of court for not producing secrets needed to access information which the authorities have a warrant for. Additionally, it's a bit silly in the context of email since the authorities will obtain it from the service provider anyway. That said, you can still add an encryption key to your phone and you're back to "knowledge based" with the additional caveat a thief would also need the hardware as well.
- Sayrus 2y ago
  That's heavily dependent on which country you're in. In France[1] it can go up to 5 years in jail for refusing to provide a password. In the US[2], it seems that passcode are protected since you may be self-incriminating but FaceID, passkeys and fingerprints are not. UK seems to allow police to require you to give your password under their anti-terror laws. [1] https://news.ycombinator.com/item?id=33550824 https://news.ycombinator.com/item?id=33550824 [2] https://www.selectlawpartners.com/faqs/do-you-have-to-give-police-your-phone-password https://www.selectlawpartners.com/faqs/do-you-have-to-give-p...
  - n144q 2y ago
    [2] is the "constitutional protection" grandparent comment is talking about, since it is ruled by the US Supreme Court.
- connicpu 2y ago
  The real answer is you shouldn't tell law enforcement anything without an attorney present, and the best advice would be to heed your attorney's advice on the matter for whether you personally should give up your passwords or not.
binkHN 2y ago
> The same is probably not true for physical things such as ... YubiKeys stored in your pocket. There's nothing preventing you from password-protecting your YubiKeys.
- connicpu 2y ago
  Right, they can seize my yubikey but the 5th amendment protects me from being compelled to hand over the pincode protecting it.
jf 2y ago
You can get passkeys with knowledge-based access if you use 1Password, or if you set a PIN on your YubiKey: https://support.yubico.com/hc/en-us/articles/4402836718866-Understanding-YubiKey-PINs https://support.yubico.com/hc/en-us/articles/4402836718866-U...
lxgr 2y ago
On the other hand, passkeys are almost exclusively used to authenticate to some service that can just as well be subpoenaed directly. Exceptions do exist; two I can think of are passkey-based cryptocurrency wallets and the so-called "PRF extension" that allows using a passkey as a source of entropy for e.g. locally encrypting a password manager's database.

acdha 2y ago

I have the most amazing coincidence to report about what protects my phone and Yubikeys.

seethishat 2y ago
Unfortunately, the forensic devices that easily extract data from your phone, can't be plugged into your head.
- acdha 2y ago
  According to the manufacturers, those forensic devices also don’t work on my iPhone unless it’s unlocked with a password, but this is also irrelevant because they can get the stored passwords from the same phone in any scenario where they can access the passkey. More to the point, this is also not what the average computer user is worried about. It assumes that they’re targeted by police, have something they need to keep secret, and that those police can compel physical access but scrupulously obey civil rights protections.

nijave 2y ago

Do you have a source for this? As far as I know, it's at best a legal gray area. I believe in most cases you'll still be held in contempt of court for not producing secrets needed to access information which the authorities have a warrant for. Additionally, it's a bit silly in the context of email since the authorities will obtain it from the service provider anyway. That said, you can still add an encryption key to your phone and you're back to "knowledge based" with the additional caveat a thief would also need the hardware as well.

Sayrus 2y ago
That's heavily dependent on which country you're in. In France[1] it can go up to 5 years in jail for refusing to provide a password. In the US[2], it seems that passcode are protected since you may be self-incriminating but FaceID, passkeys and fingerprints are not. UK seems to allow police to require you to give your password under their anti-terror laws. [1] https://news.ycombinator.com/item?id=33550824 https://news.ycombinator.com/item?id=33550824 [2] https://www.selectlawpartners.com/faqs/do-you-have-to-give-police-your-phone-password https://www.selectlawpartners.com/faqs/do-you-have-to-give-p...
- n144q 2y ago
  [2] is the "constitutional protection" grandparent comment is talking about, since it is ruled by the US Supreme Court.
connicpu 2y ago
The real answer is you shouldn't tell law enforcement anything without an attorney present, and the best advice would be to heed your attorney's advice on the matter for whether you personally should give up your passwords or not.

binkHN 2y ago

> The same is probably not true for physical things such as ... YubiKeys stored in your pocket. There's nothing preventing you from password-protecting your YubiKeys.

connicpu 2y ago
Right, they can seize my yubikey but the 5th amendment protects me from being compelled to hand over the pincode protecting it.

jf 2y ago

You can get passkeys with knowledge-based access if you use 1Password, or if you set a PIN on your YubiKey: https://support.yubico.com/hc/en-us/articles/4402836718866-Understanding-YubiKey-PINs https://support.yubico.com/hc/en-us/articles/4402836718866-U...

lxgr 2y ago

On the other hand, passkeys are almost exclusively used to authenticate to some service that can just as well be subpoenaed directly. Exceptions do exist; two I can think of are passkey-based cryptocurrency wallets and the so-called "PRF extension" that allows using a passkey as a source of entropy for e.g. locally encrypting a password manager's database.