4 ms·

Neat idea. I remember way back in the day, there was some question as to the legality of compelled unlocking of devices; IIRC, it’s been deemed legal to compel

Neat idea. I remember way back in the day, there was some question as to the legality of compelled unlocking of devices; IIRC, it’s been deemed legal to compel a fingerprint, but illegal (under the first amendment?) to compel entry of a password—IIRC, as long as that password hasn’t been written down anywhere. I gather this is written to that end primarily? Or is there some other goal as well?

seanieb 6mo ago
I wrote this after the case of a Washington Post reporter, Hannah Natanson, was compelled to unlock her computer with her fingerprint. This resulted in access to her Desktop Signal on her computer, revealing sources and their conversations. https://www.yahoo.com/news/articles/washington-post-raid-proves-face-153402560.html https://www.yahoo.com/news/articles/washington-post-raid-pro... Edit: I've a lot more details about the legality and precedence on the apps landing page https://paniclock.github.io/ https://paniclock.github.io/
- mrdomino- 6mo ago
  Cool, thank you.
- dang 6mo ago
  (I've put a copy of this text at the top of the thread, since it's standard for Show HNs to have some intro/background up there. I hope that's ok with you!)
  - seanieb 6mo ago
    Thank you!
- mrheosuper 6mo ago
  Can you intentionally use the wrong finger so that it will force to enter password
  - euroderf 6mo ago
    Hypothesis: If you can assign different fingers to different accounts, you could use (for example) your middle finger to switch to a "panic account" whose automatic login procedure includes disabling Touch ID. Or, to avoid arousing suspicion, link the most common "login finger" (pointer finger?) to the account that locks down, and use your middle finger for your normal account day in and day out.
xoxxala 6mo ago
The website has some more info on the biometric vs. password debate and legal situation: https://paniclock.github.io/ https://paniclock.github.io/
420official 6mo ago
While it's true that the legality of law enforcement forcing passwords in unclear, courts can absolutely force you to enter a password even if it's not written down by holding you in contempt indefinitely.
- xoa 6mo ago
  >courts can absolutely force you to enter a password even if it's not written down by holding you in contempt indefinitely. This is not true outside of a narrow exception. Indeed this is the core point of the 5th Amendment, to protect you from having to be witness against yourself. It's just as binding on the judicial branch as it is on the executive. Ordinarily, a court may not compel a defendant to testify or say something that could incriminate them. The narrow exception is the "foregone conclusion doctrine", which allows compelling testimony about specific evidence the government legally knows exists, knows the defendant controls access to, and knows is authentic. All of which has a bunch of caselaw around it. The textbook example is somebody has a device open, and an officer directly witnesses illegal material on it, but before they can seize it the person manages to turn it off and now it cannot be accessed without a password. So the government can say "we witnessed this specific illegal material, and this device is owned by the defendant and we can prove from video that they have accessed the device, and we want access to that specific material". But if you're just crossing the border with a locked device, they cannot compel the password just to search through it, or even if they're suspicious of something specific. They need actual knowledge, either through their own evidence or because the person foolishly talks and confesses something. Otherwise they can definitely physically seize the device for a time (which could be very inconvenient/expensive depending) but that's it.
  - deleted 6mo ago
    [deleted]
  - ezconnect 6mo ago
    There are lot cases where it is proven that you don't have any legal protection on border crossings.
whalesalad 6mo ago
Take it to the logical end - you can tie up / handcuff / sedate / restrain an individual in order to get their fingerprint (or, ahem, way worse) but you cannot extract a password from someones brain.
- stavros 6mo ago
  If it's in scope to "way worse" someone to get their fingerprint, I'm sure I can be very persuasive in getting their passwords.
  - whalesalad 6mo ago
    You can get the fingerprint of a dead person... you cannot extract a password from a dead person.
    - stavros 6mo ago
      Of course not. You extract it right before.
- vunderba 6mo ago
  > cannot extract a password from someones brain. May I introduce you to XKCD Number 538. https://xkcd.com/538 https://xkcd.com/538
deleted 6mo ago
[deleted]
Nexxxeh 6mo ago
There's also the issue that the device is covered in fingerprints, and if you can build a clean image of the print, you can likely manufacture a gelatin copy of that fingerprint that will work on most fingerprint scanners. I can't speak to the current generation of Apple fingerprint scanners, but historically iirc you can grab a print, clean it up in Photoshop, print it on OHP transparency using a laser printer and use it like a mould to copy a fingerprint.
- disillusioned 6mo ago
  Aren't the current fingerprint scanners ultrasonic rather than optical? I think they rely on the actual physical ridges
  - Nexxxeh 6mo ago
    The process uses the depth of the toner layer to make a mould of the physical ridges, which you use to generate a a gelatine cast of them. It's like a single-layer depth 3D print where the medium is fused toner from the laser printer.
iamcalledrob 6mo ago
I wonder if the US is the only place where this applies? The UK, I believe, can compel you to provide passwords that you would be reasonably expected to know.
- FerretFred 6mo ago
  Sadly yes. IANAL but under the Ripa Act they can issue a section 49 notice and you risk imprisonment for not complying. However, they need proper authorisation to do so, and the notice must be lawfully issued, so presumably a magistrate. This is all part of our famous British Justice!
  - threiw 6mo ago
    There are several exceptions. Like border crossing or when hate crime is investigated. Arguing about legality, while interacting with police, is always losing move. Just carry burner devices, and store sensitive stuff somewhere safe!
    - FerretFred 6mo ago
      I agree! Having seen how some of the police operate in parts of Europe I wouldn't want to upset them especially if I don't speak the language. I have a burner tablet and can always keep stuff I need in the Cloud.
- elcritch 6mo ago
  As I understand it, the US is one of the few countries where police can’t force you to give a password and is protected by the constitution. Looks like in the EU it varies depending on the law. But unless it’s in their constitution the laws could be changed. For example, see the current UK government trying to get rid of trial by jury for some crimes since it’s inconvenient.
  - traceroute66 6mo ago
    > the current UK government trying to get rid of trial by jury for some crimes since it’s inconvenient Remove that tin-foil hat. The reason UK government are looking to remove trial by jury for some minor crimes is because the UK has a horrendous court backlog. It is not uncommon to have to wait a year or more for your day in court. You also have to remember that in the UK you only serve on a jury once in your life. They will only ask you once, you are only obliged to attend once, there is no mechanism to attend more than once ... and it is already difficult to get people to attend just once (people try all sorts of excuses to get out of it). Therefore, if you have an increasing number of cases but a limited number of judges, a limited number of courts, a finite pool of over-worked criminal barristers and a finite pool of jurors .... Eventually you're going to have to start making hard decisions. Of course its not ideal. Of course in an ideal world everyone would have trial by jury. But it is what it is.

seanieb 6mo ago

I wrote this after the case of a Washington Post reporter, Hannah Natanson, was compelled to unlock her computer with her fingerprint. This resulted in access to her Desktop Signal on her computer, revealing sources and their conversations. https://www.yahoo.com/news/articles/washington-post-raid-proves-face-153402560.html https://www.yahoo.com/news/articles/washington-post-raid-pro... Edit: I've a lot more details about the legality and precedence on the apps landing page https://paniclock.github.io/ https://paniclock.github.io/

mrdomino- 6mo ago
Cool, thank you.
dang 6mo ago
(I've put a copy of this text at the top of the thread, since it's standard for Show HNs to have some intro/background up there. I hope that's ok with you!)
- seanieb 6mo ago
  Thank you!
mrheosuper 6mo ago
Can you intentionally use the wrong finger so that it will force to enter password
- euroderf 6mo ago
  Hypothesis: If you can assign different fingers to different accounts, you could use (for example) your middle finger to switch to a "panic account" whose automatic login procedure includes disabling Touch ID. Or, to avoid arousing suspicion, link the most common "login finger" (pointer finger?) to the account that locks down, and use your middle finger for your normal account day in and day out.

xoxxala 6mo ago

The website has some more info on the biometric vs. password debate and legal situation: https://paniclock.github.io/ https://paniclock.github.io/

420official 6mo ago

While it's true that the legality of law enforcement forcing passwords in unclear, courts can absolutely force you to enter a password even if it's not written down by holding you in contempt indefinitely.

xoa 6mo ago
>courts can absolutely force you to enter a password even if it's not written down by holding you in contempt indefinitely. This is not true outside of a narrow exception. Indeed this is the core point of the 5th Amendment, to protect you from having to be witness against yourself. It's just as binding on the judicial branch as it is on the executive. Ordinarily, a court may not compel a defendant to testify or say something that could incriminate them. The narrow exception is the "foregone conclusion doctrine", which allows compelling testimony about specific evidence the government legally knows exists, knows the defendant controls access to, and knows is authentic. All of which has a bunch of caselaw around it. The textbook example is somebody has a device open, and an officer directly witnesses illegal material on it, but before they can seize it the person manages to turn it off and now it cannot be accessed without a password. So the government can say "we witnessed this specific illegal material, and this device is owned by the defendant and we can prove from video that they have accessed the device, and we want access to that specific material". But if you're just crossing the border with a locked device, they cannot compel the password just to search through it, or even if they're suspicious of something specific. They need actual knowledge, either through their own evidence or because the person foolishly talks and confesses something. Otherwise they can definitely physically seize the device for a time (which could be very inconvenient/expensive depending) but that's it.
- deleted 6mo ago
  [deleted]
- ezconnect 6mo ago
  There are lot cases where it is proven that you don't have any legal protection on border crossings.

whalesalad 6mo ago

Take it to the logical end - you can tie up / handcuff / sedate / restrain an individual in order to get their fingerprint (or, ahem, way worse) but you cannot extract a password from someones brain.

stavros 6mo ago
If it's in scope to "way worse" someone to get their fingerprint, I'm sure I can be very persuasive in getting their passwords.
- whalesalad 6mo ago
  You can get the fingerprint of a dead person... you cannot extract a password from a dead person.
  - stavros 6mo ago
    Of course not. You extract it right before.
vunderba 6mo ago
> cannot extract a password from someones brain. May I introduce you to XKCD Number 538. https://xkcd.com/538 https://xkcd.com/538

deleted 6mo ago

[deleted]

Nexxxeh 6mo ago

There's also the issue that the device is covered in fingerprints, and if you can build a clean image of the print, you can likely manufacture a gelatin copy of that fingerprint that will work on most fingerprint scanners. I can't speak to the current generation of Apple fingerprint scanners, but historically iirc you can grab a print, clean it up in Photoshop, print it on OHP transparency using a laser printer and use it like a mould to copy a fingerprint.

disillusioned 6mo ago
Aren't the current fingerprint scanners ultrasonic rather than optical? I think they rely on the actual physical ridges
- Nexxxeh 6mo ago
  The process uses the depth of the toner layer to make a mould of the physical ridges, which you use to generate a a gelatine cast of them. It's like a single-layer depth 3D print where the medium is fused toner from the laser printer.

iamcalledrob 6mo ago

I wonder if the US is the only place where this applies? The UK, I believe, can compel you to provide passwords that you would be reasonably expected to know.

FerretFred 6mo ago
Sadly yes. IANAL but under the Ripa Act they can issue a section 49 notice and you risk imprisonment for not complying. However, they need proper authorisation to do so, and the notice must be lawfully issued, so presumably a magistrate. This is all part of our famous British Justice!
- threiw 6mo ago
  There are several exceptions. Like border crossing or when hate crime is investigated. Arguing about legality, while interacting with police, is always losing move. Just carry burner devices, and store sensitive stuff somewhere safe!
  - FerretFred 6mo ago
    I agree! Having seen how some of the police operate in parts of Europe I wouldn't want to upset them especially if I don't speak the language. I have a burner tablet and can always keep stuff I need in the Cloud.
elcritch 6mo ago
As I understand it, the US is one of the few countries where police can’t force you to give a password and is protected by the constitution. Looks like in the EU it varies depending on the law. But unless it’s in their constitution the laws could be changed. For example, see the current UK government trying to get rid of trial by jury for some crimes since it’s inconvenient.
- traceroute66 6mo ago
  > the current UK government trying to get rid of trial by jury for some crimes since it’s inconvenient Remove that tin-foil hat. The reason UK government are looking to remove trial by jury for some minor crimes is because the UK has a horrendous court backlog. It is not uncommon to have to wait a year or more for your day in court. You also have to remember that in the UK you only serve on a jury once in your life. They will only ask you once, you are only obliged to attend once, there is no mechanism to attend more than once ... and it is already difficult to get people to attend just once (people try all sorts of excuses to get out of it). Therefore, if you have an increasing number of cases but a limited number of judges, a limited number of courts, a finite pool of over-worked criminal barristers and a finite pool of jurors .... Eventually you're going to have to start making hard decisions. Of course its not ideal. Of course in an ideal world everyone would have trial by jury. But it is what it is.