4 ms·
A judge gave the FBI permission to attempt to bypass biometrics
https://archive.is/NEjHU https://archive.is/NEjHU
- badc0ffee 9mo agoSomething that could come in handy: You can put iPhones into passcode mode by holding down a volume button + the lock button (the poweroff/emergency mode sequence), and then cancelling.
- sturges 9mo agoFive presses of the power button works too.
- doubletwoyou 9mo agojust tested it and it seems to be a bit finicky if i dont click those 5 presses fast enough it instead opens apple cash or whatever it’s called i’m assuming that in a stressful situation it’d be much more consistent to hold down power and volume rather than clicking quickly
- aftbit 9mo ago5 clicks on power button is auto-911 on my Graphene/Android device
- michaelmior 9mo agoFor Android, you can hold down the power button and press the Lockdown option that appears. (I think this may need to be enabled in settings.)
- ranger_danger 9mo agoProbably a much better idea to just go ahead and hit shutdown if you're on that screen anyway, since many phones are more susceptible to gear like Greykey or Cellebrite if they have ever been unlocked since the last power-on.
- rimunroe 9mo agoMy understanding is that this and similar techniques don't get you back into the before first unlock (BFU) state. To do that as far as I know you have to shut down the device. Otherwise--even if locked--your phone will be in the after first unlock (AFU) state. I believe that in the AFU state considerably more of the system is decrypted and accessible than in the much more limited BFU state. Maybe someone with more knowledge can chime in here.
- fragmede 9mo agoYou used to be able to ask Siri "who am I", and it would lock out biometrics, but they removed that feature and I don't know why.
- retsl 9mo agoThis is true but there's automatic restart which will automatically restart the phone to get it back into BFU state: > Automatic Restart is a security mechanism in iOS 18.1 iPadOS 18.1 and or later that leverages the Secure Enclave to monitor device unlock events. If a device remains locked for a prolonged period, it automatically restarts, transitioning from an After First Unlock state to a Before First Unlock state. During the restart, the device purges sensitive security keys and transient data from memory. https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf https://help.apple.com/pdf/security/en_US/apple-platform-sec... > [...] inactivity reboot triggers exactly after 3 days (72 hours). [...] https://naehrdine.blogspot.com/2024/11/reverse-engineering-ios-18-inactivity.html https://naehrdine.blogspot.com/2024/11/reverse-engineering-i... GrapheneOS also has this (https://grapheneos.org/features#auto-reboot https://grapheneos.org/features#auto-reboot) with a default of 18 hours. Maybe one could try to force restart (https://support.apple.com/en-gb/guide/iphone/iph8903c3ee6/ios https://support.apple.com/en-gb/guide/iphone/iph8903c3ee6/io...) to quickly get to BFU. But I could imagine that it'd be hard to remember and then execute the right steps in a stressful situation.
- gurjeet 9mo agoOn iPhone SE (and I'm guessing any iPhones with a home button) just a long-press of the power button is sufficient to trigger the passcode input.
- deleted 9mo ago[deleted]
- deleted 9mo ago[deleted]
- Aaargh20318 9mo agoI wish phones supported continuous re-authentication. Like an in-screen fingerprint reader that authenticates every single touch (even better if you could also use it to assign different actions to different fingers), or to have FaceID immediately lock the phone if someone other than the owner is using it.
- rolph 9mo agodont just turn it off, physically disable it so the hardware aspect is unusable.
- digiown 9mo agoGrapheneOS has a nice feature where you can use both the fingerprint and a short passcode to avoid having to type out your longer/more valuable password all the time. Seems like a good solution to the problem. Also, iirc iphones have this feature where if you appear to be under duress, it will refuse to unlock and disable face id. Is this true?
- dostick 9mo agoThe iPhone Lockdown feature- press power button 5 time to activate.
- mcherm 9mo agoNice solution! Google, can we get that on Android by default to reach the masses? Apple... you too: you built a reputation for protecting privacy.
- digiown 9mo agoIt's not quite settled whether the FBI is able to demand you to decrypt data for now. If this becomes widespread enough, they might try to get SCOTUS to decide this, which may or may not end privacy once and for all.
- fragmede 9mo agoI thought it was. I thought passcodes can't be demanded but biometrics could.
- drnick1 9mo agoIf you want privacy, Google and Apple are not the answer. And Apple's claims about privacy are mostly unverifiable and should not be trusted.
- EA-3167 9mo agoPrivacy from what? From a determined government and court system? Nothing is going to keep you private from that. From your peers and family? Apple and Google keep you private in that regard. As for the world of privacy in between those extremes: it depends.
- robotburrito 9mo agoThese phones need a kill expression or finger. If you touch a sensor with your left pinky or wink at the camera it nukes the phone.
- smashed 9mo agoThat would be destruction of evidence. A solution that can seem like plausible deniability could be interesting.
- ranger_danger 9mo agoUnless one has been ordered to preserve evidence already for a pending court case... proving that someone knew said information was valuable as evidence, and willfully destroyed it knowing so, might be extremely difficult.
- NoImmatureAdHom 9mo agoPerhaps a lawyer can chime in here. My impression is deliberately doing this would be illegal. It would have to be convincingly deniable somehow. Is there a way to do that?
- rolph 9mo agoif something made them decide to force a particular finger into a sensor, what happens next is a result of thier own actions.
- NoImmatureAdHom 9mo agoMaybe, maybe not. I'm sure there's some legal mechanism for punishing you for setting a boobytrap. You'd also have to rely on this unnamed other to force that particular finger, rather than the others...
- rolph 9mo agobrer rabbit: "no brer fox dont throw me in the briar patch!" suspect: "no you cant force me to put my pinky there", attempts to make pinky inaccessible. other: "we will charge you with obstruction if you resist placing the pinky" Re: https://en.wikipedia.org/wiki/Br%27er_Rabbit https://en.wikipedia.org/wiki/Br%27er_Rabbit
- jp191919 9mo agoAnyone in journalism should know not to be using biometrics. I use it, but know how to quickly disable it. If using fingerprint, you can always offer up the wrong digit, a few fails should make it fallback to pin.
- craftkiller 9mo agoSo all an adversary/the police need to do is watch you unlock your phone once to know which finger to use? Trivial considering how often we unlock our phones and how many cameras exist.
- NoImmatureAdHom 9mo agohttps://archive.is/NEjHU https://archive.is/NEjHU
- neonate 9mo agoHow is this different, legally speaking, from forcing someone to reveal their password? or at least to type it in?
- rimunroe 9mo agoI don't know about that exactly, but my understanding was that this is similar in justification to compelling a person to be fingerprinted or give a DNA sample. To me there does seem to be a fairly major difference between forcing someone to disclose information held in their mind and forcing them to provide a biometric. The former seems equivalent to compelling testimony against oneself. I have a hard time seeing the latter as compelling testimony against oneself, especially if giving fingerprints or DNA isn't.
- whaleofatw2022 9mo agoPart of it is that compelling information can be problematic, in that other circumstances can happen where the information may not easily be obtainable. Extreme example, imagine a stroke or head injury causing memory loss. OTOH DNA/Face/Fingerprints, usually can't be 'forgotten'.
- atestu 9mo agoIANAL but I think legally speaking that would be forcing speech. Biometrics are not speech.
- nine_zeros 9mo ago[dead]
- qingcharles 9mo agoThe constitution has been interpreted to allow the police to force your finger onto an inkpad for fingerprints. That decision was extended to allow the police to force your finger onto a biometric reader. The 5th Amendment has been (so far) interpreted to only limit things that require conscious thought, such as remembering a password and speaking it or typing it.
- throw1771 9mo ago[dead]
- ChrisArchitect 9mo agoOrig title was fine: Washington Post Raid Is a Frightening Reminder: Turn Off Your Phone's Biometrics
- qingcharles 9mo agoThat's the title I gave it when I submitted it, I thought you or dang changed it o_O
- guelo 9mo agoI've been genuinely depressed about how fast the country is descending into strong man rule while half the country cheers it on. Which I think is their point, they want their political opponents to suffer at all costs.
- gtowey 9mo ago"political opponents to suffer at all costs" is just the smokescreen to cover up the real goals which is "oligarchs steal everything."
- deleted 9mo ago[deleted]
- hollow-moe 9mo agoCould you get charged with destroying evidence if you provided the duress password wiping the device when asked for a password ? You technically followed orders and didn't even touch the device.
- yxuc77 9mo agoYou can get charged with and convicted of anything, even wrongfully. Welcome to life in the human realm.
- nerdsniper 9mo agoYes, that would be "spoliation of evidence" and probably "obstruction of justice". Also, I believe duress passwords are only a "thing" on GrapheneOS, not iOS or stock Android.
- cyberax 9mo agoNope. It's not your duty as an accused to care about evidence in a criminal case. And unlike a witness, you can legally lie and mislead officers.
- refurb 9mo agoYou may not think it’s your duty but the courts do and will happy lock you for it.
- 15155 9mo agoFederal ones, no: https://www.law.cornell.edu/uscode/text/18/1001 https://www.law.cornell.edu/uscode/text/18/1001
- Ms-J 9mo agoThis. If what you are being charged with carries a larger penalty than simple perjury or destruction of evidence, it makes complete sense to do techniques such as this. Perjury is one of the harder and least prosecuted charges in the USA. An example from people that I know who have gone through the corrupt courts more than once said the feedback from the last case was the prosecutor felt like a fish flopping outside of water. The court stands no chance when someone uses techniques that require the government agencies to use their secret programs and tactics. They will rather drop and lose the case. Most of the time they are also extremely incompetent when it comes to technology and have to hire many outside consultants, which gives you more chances to fight. An easy win for the citizen.
- buckle8017 9mo ago[flagged]
- majorchord 9mo ago> Can the author even read? Why do you think it's appropriate to talk to people like this?
- duskwuff 9mo agoFunctionally there's very little distinction - a question asked by a law enforcement officer during a search and seizure will inevitably be understood as a demand, no matter how it's worded. (And doubly so when it's in the context of e.g. choosing which of the person's fingers to grab and press to their phone.) I'm surprised that the warrant even acknowledged the possibility of a "voluntary" disclosure.
- fortranfiend 9mo agoDon't use biometrics a pin has been shown to have more 5th amendment protections. Have your phone automatically reboot at a regular time every day. When your phone reboots a lot of the exploits that can get into your phone are locked out because they rely on reading the active memory.
- 1vuio0pswjnm7 9mo agoI have always thought biometrics on phones is just another way so-called "tech" companies perform data collection ultimately to be used for commercial purposes or any purposes deemed appropriate by the companies or their business partners The companies are secretive so who knows what they are up to that we dont know about. What we do know is that these companies do not tell the whole truth when explaining their publicly visible conduct, including their data collection practices For example, a so-called "tech" company might claim they need a user's phone number for "security" purposes while the data actually serves other purposes for the company that the user might find objectionable if they knew about them (This actually happened) The mobile phone has become a computer that the user cannot truly control. Companies can remotely install and run code on these computers at any time for any reason.^1 If the user stores data on the phone, the company tries to get the user to sync it to the company's computers If there are promises, e.g., about "privacy", made by the companies, then these promises are unlikely to be enforceable. It's rather difficult if not impossible to verify such promises are kept, or to discover they have been breached. Unfortunately, when the promises are broken then there is no adequate remedy. It's too late 1. This unfettered access can be blocked but there's been a culture that has emerged around actively doing the opposite. That the so-called "tech" companies are the primary beneficiaries is surely a fortuitous coincidence
- Nevermark 9mo agoThe only secure data is secure data. Anything else is insecure in principle, and getting less and less secure in practice, as acquisition, collation, sharing, and leveraging unpermissioned information use becomes cheaper, easier, and more profitable by the day. Cryptography provides a long menu of ways entities can exchange information and interact, without sharing information that is not functionally relevant. Making those capabilities the basis for digital inter-entity trade is the only way we will get real privacy and avoid the massive predatory surveillance-manipulation-for-hire economy from continuing to metastasize. With AI driving the value and opportunity of its leverage against us ever upward. Strict laws might have been a practical solution a couple decades ago when information based services began hyperscaling the surveillance-manipulation economy. It wouldn't be a bad thing now. But those laws seem unlikely, so the technical solution is the only path forward. I don't think people really absorb how much of the value of the economy is parasitically skimmed off by the 2-sided centralized S-M business model. From consumers and ad buyers/producers. The colossal revenues of Google and Facebook to start. And how effectively that is incentivizing and funding continued growth in addictive, manipulative and dominant (through pervasiveness) "personalized" content, that will make things much worse.
- 15155 9mo agoFace ID doesn't work with eyes closed, the warrant wasn't clear whether or not A Clockwork Orange-style setup would be allowed.
- UltraSane 9mo agoSamsung phones have the Secure Folder where you can use a different, more secure password. If you have the data encrypted it is very secure as the actual encryption key is stored in a secure element.
- Ms-J 9mo agoThis is a reason to always use passwords instead of biometrics (fingers, face, palm, etc). A corrupt court cannot force a password to be revealed by the citizen. Never speak with or offer any assistance to the police or government. It will come back to hurt you.
- wbshaw 9mo agoI have heard for years that this is a common tactic used by TSA when you get selected for special screening. Basically, they couldn't force you to divulge your unlock code. However, if you left your phone in a vulnerable state w/r/t biometrics, they could unlock your phone on your behalf without permission. Mine gets a quick reboot for going into a checkpoint. This disables biometrics until I enter a passcode.