10 ms·

It's good to have an option like that, even being a default, but there definitively need a switch to disable that if it is your own will. It's not even necessa

It's good to have an option like that, even being a default, but there definitively need a switch to disable that if it is your own will. It's not even necessarily that good enough against cops, because in a lot of shitty countries, even some pretending to be democratics, not disclosing or at least inputting your password might be a crime severely punished. If I'm not wrong, there was a guy that had to stay years in jail until he would comply with the judge order to unlock his device.

epolanski 2y ago
Stories about airport security and officers demanding access your phone is one of the reasons I will never come to the US. An (Italian) friend of mine was stuck in Newark for 8 hours after he refused access to his phone, dragged in some room and questioned for hours along his wife while split from him own kids, even though he later gave them the password (he initially said no because he thought it was out of the line, he had nothing to hide). He left livid for Italy 16 hours later despite being free to go on with his vacation. Land of the free my ass.
- SoftTalker 2y ago
  Ok, but try refusing the requests of border authorities in any country and see how far you get before you find yourself escorted to a back room.
  - epolanski 2y ago
    I've visited 45 countries in my life and I've never ever been even asked once to even show the contents of my bag, let alone access to my phone.
    - izacus 2y ago
      That doesn't change the fact that once you will be asked about that, your refusal will mean a flight back home at best.
      - jajko 2y ago
        The point is, no normal country globally asks those from any normal tourist. Adding ever for those in the back.
      - epolanski 2y ago
        Not if it's against the local laws. It's extremely dangerous to condone and think that police officers are entitled to write the rules.
        izacus 2y ago
        The border officials have wide discretion to deny non-citizen entry in most countries for whatever reason they choose.
        deleted 2y ago
        [deleted]
  - 7bit 2y ago
    Talking out of your ass
- Spooky23 2y ago
  The Italians do the same thing. If your name matches some name or you’ve travelled to some naughty place, you’ll get picked for this sort of thing. That said, the last time I went to Italy the customs guy looked annoyed at being awake. He asked my son’s age (he is huge but too young to use the electronic gate), then shrugged and stamped my passport with all of his strength.
  - 7bit 2y ago
    Don't spread misinformation. The difference is that in Italy it is not against the law to not hand out the password to your phone -- or anything else for that matter.
    - izacus 2y ago
      You're mistaking laws that hold for citizens and rules that hold for immigration and thus spreading misinformation. Even on Schengen borders they can ask you for your phone and deny your entry if you don't comply as a non-citizen.
    - Spooky23 2y ago
      In the United States, you have a fundamental right to not testify against yourself, including providing a password. You can be compelled to provide a biometric. The UK has taken a different approach and my understanding is that you can be jailed for refusing to provide a password. Most countries recognize very different limits at a customs boundary. Is this appropriate in an age where a tiny device gives you access to all of your "papers" in many cases? I don't think so, but international law doesn't recognize our concerns with respect to that.
      - genewitch 2y ago
        > Most countries recognize very different limits at a customs boundary. In the US I've heard that boundary (the "border") encompasses ~75% of everyone living inside. It's like "within X miles of a border" and includes rivers and airports as well as the entire coastline. I'm not up to date on these rules and who's been caught out by them, but I have repeatedly heard the claim above.
- matheusmoreira 2y ago
  Buy a travel phone specifically meant to be opened by them.
  - 7bit 2y ago
    There's enough places in the world where this isn't necessary, so no, thank you.
    - Marsymars 2y ago
      Is there any country in the world that has an explicit policy saying that non-citizens don’t need to provide phone passwords on entry? I’d consider a burner phone necessary to visit any country that doesn’t have such a policy.
scarface_74 2y ago
There is nothing any technology company can do to protect against rubber hose decryption.
- 14 2y ago
  There is always something that can be done. Like if phone is not actually powered on for x time set by the user it automatically factory resets all data. Or if phone is out of cell service for x time like as in a faraday bag in evidence then it resets itself. Or make it so that after a reboot it can only be opened if on a certain wifi hotspot or geolocation. Ultimately I am not a security expert or know if any of those ideas would actually work but it seems like you could add a few steps making it harder. Maybe it can be locked out and you can set a specific apple store which would require your ID before they can send a release code allowing it to be unlocked. All of that is probably way to complicated to be worth it for a typical user but I do think there can be a way if it was truly critical.
deleted 2y ago
[deleted]
redbell 2y ago
> but there definitively need a switch to disable that if it is your own will Sure! Otherwise we won't be able to smoothly run our own servers on our phones: https://news.ycombinator.com/item?id=31841051 https://news.ycombinator.com/item?id=31841051
closewith 2y ago
> a lot of shitty countries, even some pretending to be democratics, I think you're basically calling out all the democracies, then.
- hbrav 2y ago
  Yeh, the quoted commentary is hyperbole. My homeland (the UK) has such a law. I do think that law isn't great. But my country isn't shitty, and it's certainly a democracy. If we start being perfectionist, we pretend there's no difference between most nations in the rights their citizens have. And that's not even remotely true.
andylynch 2y ago
This isn’t unusual, the USA is a an exception; commonly the view is that electronically unlocking a phone or laptop is much like any other legal search, e.g. opening a garage or a locked room.
deleted 2y ago
[deleted]
nickslaughter02 2y ago
> in a lot of shitty countries In December 2024 all UN member countries voted in favor of "UN Cybercrime Treaty" which binds signatories to adopt a legislation to force you to give cops your passwords and other credentials. https://documents.un.org/doc/undoc/gen/n24/426/74/pdf/n2442674.pdf https://documents.un.org/doc/undoc/gen/n24/426/74/pdf/n24426...
- Spoom 2y ago
  Eh, I see the language "urges" in there regarding putting it into force. It would still need to pass Congress etc. and my guess is that such a provision would face massive domestic pushback.
- vkou 2y ago
  The UN isn't a world government, it has no power to affect your nation's laws. If your legislature legislates this into existence, it's on them.
SXX 2y ago
This is super annoying on newer iOS for device that I use purely for development. Before it was possible just keep iPhone unlocked indefenitely, but now it reboots and boom I have to use TouchID again. This is again Apple being Apple making things harder without option to disable it even when development mode is on. Has anyone found a way to bypass it?
- saagarjha 2y ago
  Keep an app running?
  - SXX 2y ago
    Might be I did something wrong, but even with YouTube video running via iPhone Mirroring device still went to reboot.
    - saagarjha 2y ago
      Hmm, yeah that seems wrong. I don't get reboots on devices I use frequently; I think it is only supposed to kick in when the device is not in use for a long time (it is meant to stop police who have a locked device they will try to brute force into).
      - SXX 2y ago
        Are you on latest iOS? Are you stilllocking / unlocking the phone once in 3 days at least? 7 days timeout on was introduced in iOS 18, but then decreased to 3 days. I dont use this device physically - it's just a phone that always connected to power and sit on top of mac mini for debugging and running some ios exclusive apps. And I honestly dont do anything remotely interested to the police to worry about it. Yet it all just worked and now it doesnt.
        cameroncairns 2y ago
        My physical ios device test harness has no pin numbers/touch id activated for any of the connected phones. I noticed early on in testing that it would require physical access to reinput the pin code even when the device was already unlocked when I would restart an XCUI test. If you're able to have fully unlocked devices at your test setup I'd suggest giving that a shot to see if it fixes your issue around device restart.
gcanyon 2y ago
For this use case there needs to be a reasonably quick way to erase/permanently lock a phone. Or maybe it needs to be something that is both 1. Less severe than that 2. Secure against personal inducements 3. More automatic. So maybe something like a paired app with a friend/someone who is beyond the reach of the authorities, and if the phone isn't unlocked in a given definable period (or it can be triggered immediately), it then can't be unlocked without that person's active cooperation. That's off the top of my head, so I'm sure there are optimizations.
- LWIRVoltage 2y ago
  A Veracrypt style hidden OS profile that is forensically invisible would be a better option - This would allow one to enter a password and give another "profile" or OS- that unlike current alternate profile stuff- would be solid against Cellebrite and GreyKey snooping into the device, and it'd be impossible to tell there was a hidden user/etc on it
- dsr_ 2y ago
  GrapheneOS offers hardening before first unlock, and an optional distress code that wipes the storage rather than unlocking. Currently only available for Pixel phones, 6 and later. Offers many other security-related features.
  - dominojab 2y ago
    [dead]
- hypeatei 2y ago
  You might get even more charges for doing that, though. Destroying evidence, obstruction or some made up charge.
  - gcanyon 2y ago
    Sure, I'm just saying there's a way to put unlocking the phone in the hands of someone who at least is not under the control of a hostile authority.
rvnx 2y ago
Interestingly, it could also be seen the other way around; it's a potential way for Google to force deployments of system updates (potentially at the request of law enforcement). With an automatic reboot, then the update can automatically be applied without user action.
- rtpg 2y ago
  At least on iOS an update requires an explicit unlock, is this not the case on Android? There could be secret pathways but I don’t know them.
- dheera 2y ago
  They should really implement a dual user / dual password system to combat those countries. If you enter password 1 it goes into your normal account, if you enter password 2 it goes into another user account with a burner environment where you can install a few token commonly used apps for plausible deniability. The existence of password 2 should be optional and you should not be able to tell if the system has one or two passwords configured.
  - dataflow 2y ago
    > install a few token commonly used apps for plausible deniability It's gonna be seen as pretty implausible when you don't have constant & recent messages with your loved ones in there.
    - Marsymars 2y ago
      I dunno, my elderly and non-tech-savvy in-laws travelled to the US (from Canada) last week and wiped their phones of social media apps and stored messages before crossing the border based on media reports around the US CBP’s handling of border crossers’ devices, so I’d say an empty phone is pretty plausible for anyone in that situation.
  - mjmas 2y ago
    it would be better for plausible deniability if it just had all your apps minus a few hidden ones, but keeping the rest with all their data.
kwanbix 2y ago
I don't get the difference. Today after 72 hours (3 days) my phone asks me for my password and won't accept biometrics. Also, this is a problem for all the people that use them as alarm clocks. I use Alarm Clock Xtreme for example.
- deleted 2y ago
  [deleted]
- h4x0rr 2y ago
  The phone doesn't accept biometrics but is still in AFU state. Encryption keys are in memory.
- xrisk 2y ago
  (At least on iOS) shutting down the phone has something to do with wiping credentials/keys from RAM from where they can potentially be dumped. A just-booted phone is fully encrypted with no keys in memory.
- krisoft 2y ago
  > Also, this is a problem for all the people that use them as alarm clocks. Yes. But quite honestly the right solution for that would be Apple providing an alarm clock API. The alarm clock application could call it with the next scheduled alarm’s time and the os would just wake up at that time and let the application do the sound / alarm thing.
xg15 2y ago
I was thinking this would be the final death knell to using an (unrooted) Android phone as a cheap home server. But then again, not sure if that was even possible before with all the "battery protection" logic built into Android.
joak 2y ago
It's good to be able to disable this option: I use old Android phones as servers and don't want them to reboot every 3 days.
- blackoil 2y ago
  https://xkcd.com/1172/ https://xkcd.com/1172/ Don't think old Androids will get this update.
  - Lammy 2y ago
    Why so dismissive of how somebody wants to re-use an old phone that you would compare them to the absurd fictitious behavior in that comic? Would you rather they become e-waste? If it fits their needs then it fits their needs regardless of the use-case that was marketed.
  - MiddleEndian 2y ago
    I generally like XKCD but dislike the message in this comic. If that's that guy's workflow, they don't have to actively support it, but he should be given the option to disable updates so he can continue to use his tools in the way he sees fit.
    - simonh 2y ago
      The comic doesn’t say anything about mandatory updates, and it’s EMACS. The user can install whatever version they like.
      - MiddleEndian 2y ago
        Yeah that's fair lol. But I guess in the context of this discussion, Google can push stuff onto your phone with Google Play whether you want it or not.
  - xethos 2y ago
    It's a Google Play Services update, likely explicitly to be able to push it to all (Google-using) Android phones immediately, without waiting for OS updates. This will not be a "Guess I'll get it in a few years" update.
glenstein 2y ago
>not disclosing or at least inputting your password might be a crime severely punished And to your point, I believe it's now the case in the U.S. that you can be legally compelled to unlock a fingerprint lock, but not a pin for whatever reason.
- sneak 2y ago
  Biometrics aren’t testimony. You don’t have to do anything for someone to hold a phone to your fingertip, or a camera to your face.
  - glenstein 2y ago
    You have to be actively physically cooperative for both of those things. An argument against being compelled to provide biometrics does not necessarily hinge on it being analogous to testimony.
    - 542354234235 2y ago
      But it has already been argued successfully that giving biometrics is analogous to giving blood, hair, fingerprints, standing in a lineup, providing a writing sample, or wearing certain clothes, all of which you can be compelled to do. To argue against being compelled to do or provide biometrics without using testimonial arguments would be going against a lot of case law and precedent. There is a specific precedent where you being compelled into providing biometrics can be inadmissible, and that is where you are compelled to unlock the phone, since doing so, even with biometrics is akin to providing testimony that the phone is yours, you know how to unlock it, which finger to use, etc. (see United States v. Brown, No. 17-30191 [1]). But that doesn’t actually prevent them using your biometrics to unlock the phone, so its pretty niche. [1] https://law.justia.com/cases/federal/appellate-courts/ca9/17-30191/17-30191-2019-06-05.html https://law.justia.com/cases/federal/appellate-courts/ca9/17...
      - glenstein 2y ago
        This is a bizarre response. My comment was not a denial of legal history on biology-as-testimony, it was instead opening space for other legal or philosophical objections: autonomy, bodily integrity, possibly Fourth Amendment concerns about unreasonable searches. But you're replying as if my comment was claiming courts haven’t treated biometrics like physical evidence. That's not what I was doing. The reference to Brown here appears to be massively misleading: far from being niche, it complicates the biology != testimony in a way that cuts to the heart of the most common real-world application of biometric compulsion which is smartphone access; from chatgpt'ing about it it appears that it's not the only court to rule on this and it probably awaits a SCOTUS decision to resolve an existing split.
crazygringo 2y ago
> because in a lot of shitty countries, even some pretending to be democratics, not disclosing or at least inputting your password might be a crime severely punished What's your point? That because it isn't useful in every country, it's not worth making available to any countries? It's not preventing you from providing your password. You started by saying it's a good option to have, so I don't understand the point of your second paragraph.
oarsinsync 2y ago
> in a lot of shitty countries, even some pretending to be democratics, not disclosing or at least inputting your password might be a crime severely punished. If I'm not wrong, there was a guy that had to stay years in jail until he would comply with the judge order to unlock his device. This sounds a lot like the Regulation of Investigatory Powers Act 2000 in the United Kingdom, where several people have been prosecuted and imprisoned for failing to provide encryption keys.
- chgs 2y ago
  USA https://arstechnica.com/tech-policy/2017/08/man-in-jail-2-years-for-refusing-to-decrypt-drives-will-he-ever-get-out/ https://arstechnica.com/tech-policy/2017/08/man-in-jail-2-ye...
- londons_explore 2y ago
  > imprisoned for failing to provide encryption keys This scares me, because I have plenty of old devices I no longer know the passwords for. I don't think I'm alone - plenty of people forget passwords they don't use in years. If the police came and searched my house, they could probably find some ancient laptop or phone from a decade ago, demand I unlock it, and then put me in prison forever when I cannot do do so.
  - seabass-labrax 2y ago
    Do SMART records contain enough information to prove that the laptop had not been used in years (assuming you had a suitably effective barrister to make use of this information)? RTC (clock) drift could also give a hint that the laptop had not been connected to a time server in a while. Also (this may be of limited consolation) the officer who compels you to disclose the key must have some idea of what data it is protecting in order to satisfy RIPA 2000 s 51(5)(a): > The matters to be taken into account in considering whether the requirement [for proportionality] of subsection (4)(b) is satisfied in the case of any direction shall include... the extent and nature of any protected information, in addition to the protected information in respect of which the disclosure requirement is imposed, to which the key is also a key
  - 2y ago
ololobus 2y ago
I can only second this. I have an old iPhone with a second sim-card, because I need it from time to time. And Apple introduced this auto-reboot a bit earlier, iirc last year. The problem is that after rebooting it also disconnects from wifi, so e.g. SMS/handoff synchronization stops working until you enter a passcode. This is very annoying because it was very convenient for me to receive calls/SMS to my main iPhone. It’s a good and reasonable feature, especially if for some reason you are afraid of state or security agencies in a place where you live, or maybe during travel. It’s still questionable, because in some states you can indeed go to jail if you don’t unlock. Yet, I really want to be able to turn it off for use-cases like mine.
- Talanes 2y ago
  >It’s still questionable, because in some states you can indeed go to jail if you don’t unlock. Yet, I really want to be able to turn it off for use-cases like mine. Even if the end result is the same, anything that forces authorities to use official power over informal power is a net win.
- sneak 2y ago
  Apple doesn’t like supporting the use case of multiple phones for one person. They even encourage their employees to use their personal devices and accounts.
  - Spooky23 2y ago
    That is very reasonable advice for the vast majority of people. I have to have 3 devices: mine, work and a shared one for travel that crosses customs boundaries. It’s a massive pain in the ass.

epolanski 2y ago

Stories about airport security and officers demanding access your phone is one of the reasons I will never come to the US. An (Italian) friend of mine was stuck in Newark for 8 hours after he refused access to his phone, dragged in some room and questioned for hours along his wife while split from him own kids, even though he later gave them the password (he initially said no because he thought it was out of the line, he had nothing to hide). He left livid for Italy 16 hours later despite being free to go on with his vacation. Land of the free my ass.

SoftTalker 2y ago
Ok, but try refusing the requests of border authorities in any country and see how far you get before you find yourself escorted to a back room.
- epolanski 2y ago
  I've visited 45 countries in my life and I've never ever been even asked once to even show the contents of my bag, let alone access to my phone.
  - izacus 2y ago
    That doesn't change the fact that once you will be asked about that, your refusal will mean a flight back home at best.
    - jajko 2y ago
      The point is, no normal country globally asks those from any normal tourist. Adding ever for those in the back.
    - epolanski 2y ago
      Not if it's against the local laws. It's extremely dangerous to condone and think that police officers are entitled to write the rules.
      - izacus 2y ago
        The border officials have wide discretion to deny non-citizen entry in most countries for whatever reason they choose.
        deleted 2y ago
        [deleted]
- 7bit 2y ago
  Talking out of your ass
Spooky23 2y ago
The Italians do the same thing. If your name matches some name or you’ve travelled to some naughty place, you’ll get picked for this sort of thing. That said, the last time I went to Italy the customs guy looked annoyed at being awake. He asked my son’s age (he is huge but too young to use the electronic gate), then shrugged and stamped my passport with all of his strength.
- 7bit 2y ago
  Don't spread misinformation. The difference is that in Italy it is not against the law to not hand out the password to your phone -- or anything else for that matter.
  - izacus 2y ago
    You're mistaking laws that hold for citizens and rules that hold for immigration and thus spreading misinformation. Even on Schengen borders they can ask you for your phone and deny your entry if you don't comply as a non-citizen.
  - Spooky23 2y ago
    In the United States, you have a fundamental right to not testify against yourself, including providing a password. You can be compelled to provide a biometric. The UK has taken a different approach and my understanding is that you can be jailed for refusing to provide a password. Most countries recognize very different limits at a customs boundary. Is this appropriate in an age where a tiny device gives you access to all of your "papers" in many cases? I don't think so, but international law doesn't recognize our concerns with respect to that.
    - genewitch 2y ago
      > Most countries recognize very different limits at a customs boundary. In the US I've heard that boundary (the "border") encompasses ~75% of everyone living inside. It's like "within X miles of a border" and includes rivers and airports as well as the entire coastline. I'm not up to date on these rules and who's been caught out by them, but I have repeatedly heard the claim above.
matheusmoreira 2y ago
Buy a travel phone specifically meant to be opened by them.
- 7bit 2y ago
  There's enough places in the world where this isn't necessary, so no, thank you.
  - Marsymars 2y ago
    Is there any country in the world that has an explicit policy saying that non-citizens don’t need to provide phone passwords on entry? I’d consider a burner phone necessary to visit any country that doesn’t have such a policy.

scarface_74 2y ago

There is nothing any technology company can do to protect against rubber hose decryption.

14 2y ago
There is always something that can be done. Like if phone is not actually powered on for x time set by the user it automatically factory resets all data. Or if phone is out of cell service for x time like as in a faraday bag in evidence then it resets itself. Or make it so that after a reboot it can only be opened if on a certain wifi hotspot or geolocation. Ultimately I am not a security expert or know if any of those ideas would actually work but it seems like you could add a few steps making it harder. Maybe it can be locked out and you can set a specific apple store which would require your ID before they can send a release code allowing it to be unlocked. All of that is probably way to complicated to be worth it for a typical user but I do think there can be a way if it was truly critical.

deleted 2y ago

[deleted]

redbell 2y ago

> but there definitively need a switch to disable that if it is your own will Sure! Otherwise we won't be able to smoothly run our own servers on our phones: https://news.ycombinator.com/item?id=31841051 https://news.ycombinator.com/item?id=31841051

closewith 2y ago

> a lot of shitty countries, even some pretending to be democratics, I think you're basically calling out all the democracies, then.

hbrav 2y ago
Yeh, the quoted commentary is hyperbole. My homeland (the UK) has such a law. I do think that law isn't great. But my country isn't shitty, and it's certainly a democracy. If we start being perfectionist, we pretend there's no difference between most nations in the rights their citizens have. And that's not even remotely true.

andylynch 2y ago

This isn’t unusual, the USA is a an exception; commonly the view is that electronically unlocking a phone or laptop is much like any other legal search, e.g. opening a garage or a locked room.

deleted 2y ago

[deleted]

nickslaughter02 2y ago

> in a lot of shitty countries In December 2024 all UN member countries voted in favor of "UN Cybercrime Treaty" which binds signatories to adopt a legislation to force you to give cops your passwords and other credentials. https://documents.un.org/doc/undoc/gen/n24/426/74/pdf/n2442674.pdf https://documents.un.org/doc/undoc/gen/n24/426/74/pdf/n24426...

Spoom 2y ago
Eh, I see the language "urges" in there regarding putting it into force. It would still need to pass Congress etc. and my guess is that such a provision would face massive domestic pushback.
vkou 2y ago
The UN isn't a world government, it has no power to affect your nation's laws. If your legislature legislates this into existence, it's on them.

SXX 2y ago

This is super annoying on newer iOS for device that I use purely for development. Before it was possible just keep iPhone unlocked indefenitely, but now it reboots and boom I have to use TouchID again. This is again Apple being Apple making things harder without option to disable it even when development mode is on. Has anyone found a way to bypass it?

saagarjha 2y ago
Keep an app running?
- SXX 2y ago
  Might be I did something wrong, but even with YouTube video running via iPhone Mirroring device still went to reboot.
  - saagarjha 2y ago
    Hmm, yeah that seems wrong. I don't get reboots on devices I use frequently; I think it is only supposed to kick in when the device is not in use for a long time (it is meant to stop police who have a locked device they will try to brute force into).
    - SXX 2y ago
      Are you on latest iOS? Are you stilllocking / unlocking the phone once in 3 days at least? 7 days timeout on was introduced in iOS 18, but then decreased to 3 days. I dont use this device physically - it's just a phone that always connected to power and sit on top of mac mini for debugging and running some ios exclusive apps. And I honestly dont do anything remotely interested to the police to worry about it. Yet it all just worked and now it doesnt.
      - cameroncairns 2y ago
        My physical ios device test harness has no pin numbers/touch id activated for any of the connected phones. I noticed early on in testing that it would require physical access to reinput the pin code even when the device was already unlocked when I would restart an XCUI test. If you're able to have fully unlocked devices at your test setup I'd suggest giving that a shot to see if it fixes your issue around device restart.

gcanyon 2y ago

For this use case there needs to be a reasonably quick way to erase/permanently lock a phone. Or maybe it needs to be something that is both 1. Less severe than that 2. Secure against personal inducements 3. More automatic. So maybe something like a paired app with a friend/someone who is beyond the reach of the authorities, and if the phone isn't unlocked in a given definable period (or it can be triggered immediately), it then can't be unlocked without that person's active cooperation. That's off the top of my head, so I'm sure there are optimizations.

LWIRVoltage 2y ago
A Veracrypt style hidden OS profile that is forensically invisible would be a better option - This would allow one to enter a password and give another "profile" or OS- that unlike current alternate profile stuff- would be solid against Cellebrite and GreyKey snooping into the device, and it'd be impossible to tell there was a hidden user/etc on it
dsr_ 2y ago
GrapheneOS offers hardening before first unlock, and an optional distress code that wipes the storage rather than unlocking. Currently only available for Pixel phones, 6 and later. Offers many other security-related features.
- dominojab 2y ago
  [dead]
hypeatei 2y ago
You might get even more charges for doing that, though. Destroying evidence, obstruction or some made up charge.
- gcanyon 2y ago
  Sure, I'm just saying there's a way to put unlocking the phone in the hands of someone who at least is not under the control of a hostile authority.

rvnx 2y ago

Interestingly, it could also be seen the other way around; it's a potential way for Google to force deployments of system updates (potentially at the request of law enforcement). With an automatic reboot, then the update can automatically be applied without user action.

rtpg 2y ago
At least on iOS an update requires an explicit unlock, is this not the case on Android? There could be secret pathways but I don’t know them.
dheera 2y ago
They should really implement a dual user / dual password system to combat those countries. If you enter password 1 it goes into your normal account, if you enter password 2 it goes into another user account with a burner environment where you can install a few token commonly used apps for plausible deniability. The existence of password 2 should be optional and you should not be able to tell if the system has one or two passwords configured.
- dataflow 2y ago
  > install a few token commonly used apps for plausible deniability It's gonna be seen as pretty implausible when you don't have constant & recent messages with your loved ones in there.
  - Marsymars 2y ago
    I dunno, my elderly and non-tech-savvy in-laws travelled to the US (from Canada) last week and wiped their phones of social media apps and stored messages before crossing the border based on media reports around the US CBP’s handling of border crossers’ devices, so I’d say an empty phone is pretty plausible for anyone in that situation.
- mjmas 2y ago
  it would be better for plausible deniability if it just had all your apps minus a few hidden ones, but keeping the rest with all their data.

kwanbix 2y ago

I don't get the difference. Today after 72 hours (3 days) my phone asks me for my password and won't accept biometrics. Also, this is a problem for all the people that use them as alarm clocks. I use Alarm Clock Xtreme for example.

deleted 2y ago
[deleted]
h4x0rr 2y ago
The phone doesn't accept biometrics but is still in AFU state. Encryption keys are in memory.
xrisk 2y ago
(At least on iOS) shutting down the phone has something to do with wiping credentials/keys from RAM from where they can potentially be dumped. A just-booted phone is fully encrypted with no keys in memory.
krisoft 2y ago
> Also, this is a problem for all the people that use them as alarm clocks. Yes. But quite honestly the right solution for that would be Apple providing an alarm clock API. The alarm clock application could call it with the next scheduled alarm’s time and the os would just wake up at that time and let the application do the sound / alarm thing.

xg15 2y ago

I was thinking this would be the final death knell to using an (unrooted) Android phone as a cheap home server. But then again, not sure if that was even possible before with all the "battery protection" logic built into Android.

joak 2y ago

It's good to be able to disable this option: I use old Android phones as servers and don't want them to reboot every 3 days.

blackoil 2y ago
https://xkcd.com/1172/ https://xkcd.com/1172/ Don't think old Androids will get this update.
- Lammy 2y ago
  Why so dismissive of how somebody wants to re-use an old phone that you would compare them to the absurd fictitious behavior in that comic? Would you rather they become e-waste? If it fits their needs then it fits their needs regardless of the use-case that was marketed.
- MiddleEndian 2y ago
  I generally like XKCD but dislike the message in this comic. If that's that guy's workflow, they don't have to actively support it, but he should be given the option to disable updates so he can continue to use his tools in the way he sees fit.
  - simonh 2y ago
    The comic doesn’t say anything about mandatory updates, and it’s EMACS. The user can install whatever version they like.
    - MiddleEndian 2y ago
      Yeah that's fair lol. But I guess in the context of this discussion, Google can push stuff onto your phone with Google Play whether you want it or not.
- xethos 2y ago
  It's a Google Play Services update, likely explicitly to be able to push it to all (Google-using) Android phones immediately, without waiting for OS updates. This will not be a "Guess I'll get it in a few years" update.

glenstein 2y ago

>not disclosing or at least inputting your password might be a crime severely punished And to your point, I believe it's now the case in the U.S. that you can be legally compelled to unlock a fingerprint lock, but not a pin for whatever reason.

sneak 2y ago
Biometrics aren’t testimony. You don’t have to do anything for someone to hold a phone to your fingertip, or a camera to your face.
- glenstein 2y ago
  You have to be actively physically cooperative for both of those things. An argument against being compelled to provide biometrics does not necessarily hinge on it being analogous to testimony.
  - 542354234235 2y ago
    But it has already been argued successfully that giving biometrics is analogous to giving blood, hair, fingerprints, standing in a lineup, providing a writing sample, or wearing certain clothes, all of which you can be compelled to do. To argue against being compelled to do or provide biometrics without using testimonial arguments would be going against a lot of case law and precedent. There is a specific precedent where you being compelled into providing biometrics can be inadmissible, and that is where you are compelled to unlock the phone, since doing so, even with biometrics is akin to providing testimony that the phone is yours, you know how to unlock it, which finger to use, etc. (see United States v. Brown, No. 17-30191 [1]). But that doesn’t actually prevent them using your biometrics to unlock the phone, so its pretty niche. [1] https://law.justia.com/cases/federal/appellate-courts/ca9/17-30191/17-30191-2019-06-05.html https://law.justia.com/cases/federal/appellate-courts/ca9/17...
    - glenstein 2y ago
      This is a bizarre response. My comment was not a denial of legal history on biology-as-testimony, it was instead opening space for other legal or philosophical objections: autonomy, bodily integrity, possibly Fourth Amendment concerns about unreasonable searches. But you're replying as if my comment was claiming courts haven’t treated biometrics like physical evidence. That's not what I was doing. The reference to Brown here appears to be massively misleading: far from being niche, it complicates the biology != testimony in a way that cuts to the heart of the most common real-world application of biometric compulsion which is smartphone access; from chatgpt'ing about it it appears that it's not the only court to rule on this and it probably awaits a SCOTUS decision to resolve an existing split.

crazygringo 2y ago

> because in a lot of shitty countries, even some pretending to be democratics, not disclosing or at least inputting your password might be a crime severely punished What's your point? That because it isn't useful in every country, it's not worth making available to any countries? It's not preventing you from providing your password. You started by saying it's a good option to have, so I don't understand the point of your second paragraph.

oarsinsync 2y ago

> in a lot of shitty countries, even some pretending to be democratics, not disclosing or at least inputting your password might be a crime severely punished. If I'm not wrong, there was a guy that had to stay years in jail until he would comply with the judge order to unlock his device. This sounds a lot like the Regulation of Investigatory Powers Act 2000 in the United Kingdom, where several people have been prosecuted and imprisoned for failing to provide encryption keys.

chgs 2y ago
USA https://arstechnica.com/tech-policy/2017/08/man-in-jail-2-years-for-refusing-to-decrypt-drives-will-he-ever-get-out/ https://arstechnica.com/tech-policy/2017/08/man-in-jail-2-ye...
londons_explore 2y ago
> imprisoned for failing to provide encryption keys This scares me, because I have plenty of old devices I no longer know the passwords for. I don't think I'm alone - plenty of people forget passwords they don't use in years. If the police came and searched my house, they could probably find some ancient laptop or phone from a decade ago, demand I unlock it, and then put me in prison forever when I cannot do do so.
- seabass-labrax 2y ago
  Do SMART records contain enough information to prove that the laptop had not been used in years (assuming you had a suitably effective barrister to make use of this information)? RTC (clock) drift could also give a hint that the laptop had not been connected to a time server in a while. Also (this may be of limited consolation) the officer who compels you to disclose the key must have some idea of what data it is protecting in order to satisfy RIPA 2000 s 51(5)(a): > The matters to be taken into account in considering whether the requirement [for proportionality] of subsection (4)(b) is satisfied in the case of any direction shall include... the extent and nature of any protected information, in addition to the protected information in respect of which the disclosure requirement is imposed, to which the key is also a key
- 2y ago

ololobus 2y ago

I can only second this. I have an old iPhone with a second sim-card, because I need it from time to time. And Apple introduced this auto-reboot a bit earlier, iirc last year. The problem is that after rebooting it also disconnects from wifi, so e.g. SMS/handoff synchronization stops working until you enter a passcode. This is very annoying because it was very convenient for me to receive calls/SMS to my main iPhone. It’s a good and reasonable feature, especially if for some reason you are afraid of state or security agencies in a place where you live, or maybe during travel. It’s still questionable, because in some states you can indeed go to jail if you don’t unlock. Yet, I really want to be able to turn it off for use-cases like mine.

Talanes 2y ago
>It’s still questionable, because in some states you can indeed go to jail if you don’t unlock. Yet, I really want to be able to turn it off for use-cases like mine. Even if the end result is the same, anything that forces authorities to use official power over informal power is a net win.
sneak 2y ago
Apple doesn’t like supporting the use case of multiple phones for one person. They even encourage their employees to use their personal devices and accounts.
- Spooky23 2y ago
  That is very reasonable advice for the vast majority of people. I have to have 3 devices: mine, work and a shared one for travel that crosses customs boundaries. It’s a massive pain in the ass.