Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Securing a travel iPhone

blog.filippo.io

Post reply on HN
Print view View original

21–30 of 113 posts

Re: Securing a travel iPhone

#21

Post by ericabiz »

joshavant wrote: post #2

I thought I once read that, since Touch ID relies on fingerprints, a US court order can compel you to provide those, thus forcing you to unlock an iPhone in question. This, as opposed to a passcode-only configuration, which a court order cannot compel you to give (I believe since this would fall in the category of 'forcing you to testify against yourself'). If that is indeed the case, I imagine it would make better s…

If you never want Touch ID to work, you can just replace the home button in the phone. It's a security feature from Apple--a new home button will never work with Touch ID again.

It's not too difficult to swap a home button yourself with the right tools, or most stores will do it for ~$49 to $59 (depending on your iPhone model.)

If you have a store do it, definitely ask for your original home button back in case you change your mind later or sell your phone.

Re: Securing a travel iPhone

#22

Post by JonathonW »

ape4 wrote: post #12

I would have thought a rooted Android or Ubuntu phone would more secure (done right).

Given that rooting an Android phone frequently involves turning off security features (for example, rooting a Nexus device entails unlocking the bootloader to accept an unsigned boot image), you're probably better off running a stock, unrooted firmware to make it easier to tell if things have been modified.

That's in addition to the added attack surface that the root itself provides once the phone's up and running. Yes, the SU app on the phone (whatever that is nowadays) is supposed to prompt for permission before granting an app root access, but are you sure that code's bug free? Or free of intentional backdoors?

Re: Securing a travel iPhone

#23

Post by toomuchtodo »

ThatGeoGuy wrote: post #11
Jtsummers wrote: post #4

Earlier quoted context omitted.

http://blogs.wsj.com/digits/2014/10/31/judge-rules-suspect-c... Court decision from 2014. http://www.theatlantic.com/technology/archive/2016/05/iphone... First known application since then.

Keep in mind this is strictly relevant to US jurisdiction. In Canada, I recall that you can be compelled by a court to give up a password, or be held in contempt. That being said, something like TouchID is irrelevant if the password is going to be forced out of you anyways.

I would like two passwords. One that unlocks the phone, and one that wipes the entire device immediately.

Re: Securing a travel iPhone

#24

Post by ericabiz »

Razengan wrote: post #14

As someone in a country with a serious mugging problem and having lost an iPhone already, one of the biggest security flaws I see is being able to power it off without providing any authentication. What is even the point of Find my Phone and all that if anyone can just instantly switch off all the tracking?? You can't even ring your own number after that, and even law enforcement cannot look up the cell tower logs to…

Even if Apple added that, it's trivially easy to pop the SIM. A phone without a network connection won't ping, so that won't help.

You have to think about it from the attacker's point of view. Anyone they sell it to is going to power it on to test it. Once it's powered on, it'll ping back.

Any black-market buyer knows to pop the SIM anyway before powering it on, and turn on the phone without any publicly-accessible Wifi access points available. But then they still have to restore it in order to see if it's iCloud locked, and the restore pings, too (it requires an Internet connection to Apple's servers to download a signed OS.)

What it comes down to is that stolen iPhones just aren't worth that much, since there's no easy way to remove an iCloud lock and the parts themselves aren't worth a lot. The good news is that far fewer iPhones are stolen these days (source: http://www.cbsnews.com/news/iphone-thefts-down-thanks-to-app... ), and thieves are pretty quickly learning that.

Re: Securing a travel iPhone

#26

Post by ape4 »

JonathonW wrote: post #22
ape4 wrote: post #12

I would have thought a rooted Android or Ubuntu phone would more secure (done right).

Given that rooting an Android phone frequently involves turning off security features (for example, rooting a Nexus device entails unlocking the bootloader to accept an unsigned boot image), you're probably better off running a stock, unrooted firmware to make it easier to tell if things have been modified. That's in addition to the added attack surface that the root itself provides once the phone's up and running. Y…

You'd use your root access to make the changes you want. eg uninstall factory apps. Then, day-to-day, run as a non-privileged user.

Re: Securing a travel iPhone

#27

Post by ThatGeoGuy »

toomuchtodo wrote: post #23
ThatGeoGuy wrote: post #11

Earlier quoted context omitted.

Keep in mind this is strictly relevant to US jurisdiction. In Canada, I recall that you can be compelled by a court to give up a password, or be held in contempt. That being said, something like TouchID is irrelevant if the password is going to be forced out of you anyways.

I would like two passwords. One that unlocks the phone, and one that wipes the entire device immediately.

This would be useful if you had information that would put you in jail for the rest of your life, and certainly should be something offered for users who need it. However, being put in contempt of the court is not joke, and I can't imagine this would go over well if you tried it when compelled to unlock the phone.

Hidden containers similar to what TrueCrypt could do might take you farther in this regard. Self-destructing a hidden container should ideally not expose what you wish to protect and at least provide plausible deniability.

Re: Securing a travel iPhone

#28

Post by JosephBrown »

Razengan wrote: post #14

As someone in a country with a serious mugging problem and having lost an iPhone already, one of the biggest security flaws I see is being able to power it off without providing any authentication. What is even the point of Find my Phone and all that if anyone can just instantly switch off all the tracking?? You can't even ring your own number after that, and even law enforcement cannot look up the cell tower logs to…

The ability to quickly turn off the phone is useful when you need to activate a long password so that you cannot be forced to use your fingerprint to unlock it.

Re: Securing a travel iPhone

#29

Post by ivank »

ericabiz wrote: post #24
Razengan wrote: post #14

As someone in a country with a serious mugging problem and having lost an iPhone already, one of the biggest security flaws I see is being able to power it off without providing any authentication. What is even the point of Find my Phone and all that if anyone can just instantly switch off all the tracking?? You can't even ring your own number after that, and even law enforcement cannot look up the cell tower logs to…

Even if Apple added that, it's trivially easy to pop the SIM. A phone without a network connection won't ping, so that won't help. You have to think about it from the attacker's point of view. Anyone they sell it to is going to power it on to test it. Once it's powered on, it'll ping back. Any black-market buyer knows to pop the SIM anyway before powering it on, and turn on the phone without any publicly-accessible W…

Going by eBay, a lot of people are still managing to sell stolen iPhones for $100-$300: http://www.ebay.com/sch/i.html?_nkw=icl0ud%20locked&LH_Compl...
Post reply on HN