3 ms·

> (Apple pegs such cracking attempts at 5 1/2 years for a random 6-character password consisting of lowercase letters and numbers. PINs will obviously take much

> (Apple pegs such cracking attempts at 5 1/2 years for a random 6-character password consisting of lowercase letters and numbers. PINs will obviously take much less time, sometimes as little as half an hour. Choose a good passphrase!) Do not use simple pin passwords on your phone. In particular, if you use fingerprint access, there is no reason not to have a long, complex password.

jsmeaton 12y ago
Your advise is good, I'm not trying to dismiss or counter it. > In particular, if you use fingerprint access, there is no reason not to have a long, complex password. Very, very often my fingerprint isn't recognised properly and I have to type in my password. It has been getting better as of the last few updates, but I still need to input my password multiple times per day.
- giovannibajo1 12y ago
  Try training it for a few minutes for each finger (go to Touch ID setting, tap with your finger, see the background flash, repeat ad libitum slowly rotating your finger in any direction; be patient; eventually it should recognize each finger even if rotated almost 90 degrees). It should get much better afterwards
  - krrrh 12y ago
    Or use multiple slots for the one or two fingers that you actually use to unlock. One doesn't need to have every finger's fingerprint stored.
rietta 12y ago
There is an argument against using the fingerprint access and that is that a user gives up the right of consent while in custody. If law enforcement gets a judicial order to forcibly press the prisoner's finger to the sensor to unlock the device, then he or she has little recourse as the right to remain silent is not implicated. One cannot be similarly physically compelled to disclose a code only held in his or her memory.
- girvo 12y ago
  > One cannot be similarly physically compelled to disclose a code only held in his or her memory. Are you sure? In the UK and I'm pretty sure in my native Australia, they definitely can, under pain of "contempt of court".
  - rhino369 12y ago
    In the US it depends. If they know you had child porn on your phone they can force it. If they just suspect you have child porn, they can't.
  - rietta 12y ago
    That gets into key disclosure law and it does vary by jurisdiction. Though I am not a lawyer, it is my understanding that this is an area of dispute in the United States with respect to the 5th amendment, which forbids the government the power to compel one to ever testify against him or herself. Even under a mandatory key disclosure regime, it's still a choice to remain silent even if that means one remains jailed. That situation sure seems like a form of torture to extract information from the incarcerated individual. This 2012 Forbes article is a good read on the matter: http://www.forbes.com/sites/jonmatonis/2012/09/12/key-disclosure-laws-can-be-used-to-confiscate-bitcoin-assets/ http://www.forbes.com/sites/jonmatonis/2012/09/12/key-disclo...
- SoftwareMaven 12y ago
  If you have the ability to lawyer it enough, I think you'd have a few layers of court required to sort out whether this is allowed (assuming they don't have proof you have something on the phone). You are basically forcing self-incrimination, a violation of the Fifth Amendment. I totally agree that, if you are really concerned about this, fingerprint is a bad idea, but the legal ramifications are interesting. Not quite relatedly, does anybody know if there is a heat sensor? Or can I just cut somebody's finger off to use it? (We are obviously well outside of judicial channels here! :)
  - moe 12y ago
    Or can I just cut somebody's finger off to use it? You don't need a finger to circumvent touchid. You can just obtain your victim's fingerprint from anywhere (e.g. a glass that they used) and create a fake "finger" using household items: http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid
_asummers 12y ago
Fingerprints should not be treated as a substitute for a password. A password is "what you know", and a fingerprint is "what you have". If you also throw in "who you are" (retina sensors, blood biometrics, etc.), you have to combine at least two to have a proper system. By allowing the fingerprint scanners to become ubiquitous, they (Apple and Samsung) are training their users poorly. Now one could make the argument that the fingerprint is more secure than a poor password, for most use cases. I'd tend to agree with that, with the caveat that it is no longer your decision (read: subject to your interrogation resistance) to open your phone if you are captured.

jsmeaton 12y ago

Your advise is good, I'm not trying to dismiss or counter it. > In particular, if you use fingerprint access, there is no reason not to have a long, complex password. Very, very often my fingerprint isn't recognised properly and I have to type in my password. It has been getting better as of the last few updates, but I still need to input my password multiple times per day.

giovannibajo1 12y ago
Try training it for a few minutes for each finger (go to Touch ID setting, tap with your finger, see the background flash, repeat ad libitum slowly rotating your finger in any direction; be patient; eventually it should recognize each finger even if rotated almost 90 degrees). It should get much better afterwards
- krrrh 12y ago
  Or use multiple slots for the one or two fingers that you actually use to unlock. One doesn't need to have every finger's fingerprint stored.

rietta 12y ago

There is an argument against using the fingerprint access and that is that a user gives up the right of consent while in custody. If law enforcement gets a judicial order to forcibly press the prisoner's finger to the sensor to unlock the device, then he or she has little recourse as the right to remain silent is not implicated. One cannot be similarly physically compelled to disclose a code only held in his or her memory.

girvo 12y ago
> One cannot be similarly physically compelled to disclose a code only held in his or her memory. Are you sure? In the UK and I'm pretty sure in my native Australia, they definitely can, under pain of "contempt of court".
- rhino369 12y ago
  In the US it depends. If they know you had child porn on your phone they can force it. If they just suspect you have child porn, they can't.
- rietta 12y ago
  That gets into key disclosure law and it does vary by jurisdiction. Though I am not a lawyer, it is my understanding that this is an area of dispute in the United States with respect to the 5th amendment, which forbids the government the power to compel one to ever testify against him or herself. Even under a mandatory key disclosure regime, it's still a choice to remain silent even if that means one remains jailed. That situation sure seems like a form of torture to extract information from the incarcerated individual. This 2012 Forbes article is a good read on the matter: http://www.forbes.com/sites/jonmatonis/2012/09/12/key-disclosure-laws-can-be-used-to-confiscate-bitcoin-assets/ http://www.forbes.com/sites/jonmatonis/2012/09/12/key-disclo...
SoftwareMaven 12y ago
If you have the ability to lawyer it enough, I think you'd have a few layers of court required to sort out whether this is allowed (assuming they don't have proof you have something on the phone). You are basically forcing self-incrimination, a violation of the Fifth Amendment. I totally agree that, if you are really concerned about this, fingerprint is a bad idea, but the legal ramifications are interesting. Not quite relatedly, does anybody know if there is a heat sensor? Or can I just cut somebody's finger off to use it? (We are obviously well outside of judicial channels here! :)
- moe 12y ago
  Or can I just cut somebody's finger off to use it? You don't need a finger to circumvent touchid. You can just obtain your victim's fingerprint from anywhere (e.g. a glass that they used) and create a fake "finger" using household items: http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid

_asummers 12y ago

Fingerprints should not be treated as a substitute for a password. A password is "what you know", and a fingerprint is "what you have". If you also throw in "who you are" (retina sensors, blood biometrics, etc.), you have to combine at least two to have a proper system. By allowing the fingerprint scanners to become ubiquitous, they (Apple and Samsung) are training their users poorly. Now one could make the argument that the fingerprint is more secure than a poor password, for most use cases. I'd tend to agree with that, with the caveat that it is no longer your decision (read: subject to your interrogation resistance) to open your phone if you are captured.