Live data from Hacker News

Feds Walk into a Building and Demand Everyone's Fingerprints to Open Phones

forbes.com

21–30 of 190 posts

Re: Feds Walk into a Building and Demand Everyone's Fingerprints to Open Phones

#21
post #2

Just another reason to forgo the convenience of biometrics in favor of a password/phrase that exists only in your mind. At least for now, that's something you can't be compelled to produce. Really though, this descent into a police state is such a pathetic outcome for this country. Dangerous, scary, and tragic, but also... pathetic. This is what happens when a sizeable majority don't even participate in the electoral…

> a sizeable majority don't even participate

That might be your best hope.

(Respectfully submitted, etc, etc.)

Re: Feds Walk into a Building and Demand Everyone's Fingerprints to Open Phones

#23

I have to wonder what sort of technical measures could be implemented to make biometric systems as legally secure as passwords while still retaining something like the same convenience. The first thing that comes to mind for me is the Apple patent on recognizing a fingerprint anywhere on the phone's surface, and using that in combination with Android-style lock screen patterns. A lock screen pattern isn't nearly as s…

While I'm all for the idea that sometimes you have to make do with what tools you have available, why are we looking for technical solutions to a legal (or perhaps even philosophical) problem?

Philosophically and legally I am firmly convinced that we should treat information, and therefore data, as an extension of consciousness. Information is only meaningful because we have the conscious capacity to interpret it; digital data is a "memory aid", a tool we use to expand our everyday capacity to interact with information. Data is not analogous to a physical object; any discussion about ownership, or transfer rights (and so forth) is inherently based on a flawed premise.

Directly descendant from that argument is that privacy is irrelevant, that instead, individual agency is what matters. Privacy is a decision not to share information, but that means privacy is only possible given the agency to make that decision. Any serviceable definition of information agency implies, at the very least, having control over the creation, retention, and sharing of data, which is so much more than privacy. And when you start looking at it that way, it becomes clear that our conversations around incidents like OP's link should happen around the fifth amendment, and not the fourth.

When I talk to tech people about this, they (typically) emphatically agree. When I talk to lawyers about it, their response is much less enthusiastic: "That's an interesting perspective, but it's not really supported by existing case law." If all we're doing is piling technical circumventions on top of bad policy, we're stuck in an arms race. What we need is a shift in legal attitudes towards information; that's the only sustainable outcome here. We need a cogent legal and philosophical argument, one rooted in existing, accepted principles, that makes a solid case for a new paradigm surrounding data.

Re: Feds Walk into a Building and Demand Everyone's Fingerprints to Open Phones

#24
post #13
post #10

This is why my unlock is not tied to biometrics. Once I realized the government can compel you to unlock your phone without a warrant using your fingerprint it became a much less compelling feature. The same for facial recognition.

Yep. I got into a little argument with my brother over this last week, as he is a "I don't care, I have nothing to hide."

I find that convenience is a perfectly acceptable reason to surrender personal safety/privacy.

I'm not saying I personally agree, I'm saying I can respect it.

Re: Feds Walk into a Building and Demand Everyone's Fingerprints to Open Phones

#25
post #13
post #10

This is why my unlock is not tied to biometrics. Once I realized the government can compel you to unlock your phone without a warrant using your fingerprint it became a much less compelling feature. The same for facial recognition.

Yep. I got into a little argument with my brother over this last week, as he is a "I don't care, I have nothing to hide."

Then they will use your unlocked phone and plant the evidence they need.

At least, if they can't unlock the phone, then they even have to worry about the evidence they fabricate as you might have something that counters it on the phone.

Re: Feds Walk into a Building and Demand Everyone's Fingerprints to Open Phones

#27
post #4

Not a fan of solely using fingerprints for authentication. Good systems allow you to rotate keys. I only got 10 fingerprints.

Good passkeys also should only exist to be checked on the device. Fingerprints can be in databases and on the device itself. Not sure how fingerprint scanners react to replicated fingerprints, but the right people can probably replicate them pretty well. I would only consider a fingerprint a more secure authentication measure because it can't be recorded by cameras.

Finger prints can be (and have been) recorded by cameras.

Re: Feds Walk into a Building and Demand Everyone's Fingerprints to Open Phones

#28
post #16
post #2

Just another reason to forgo the convenience of biometrics in favor of a password/phrase that exists only in your mind. At least for now, that's something you can't be compelled to produce. Really though, this descent into a police state is such a pathetic outcome for this country. Dangerous, scary, and tragic, but also... pathetic. This is what happens when a sizeable majority don't even participate in the electoral…

Biometrics could be used as a username, but should not be used as a password...

Exactly. It is a form of identification not authentication.

Re: Feds Walk into a Building and Demand Everyone's Fingerprints to Open Phones

#29
post #4

Not a fan of solely using fingerprints for authentication. Good systems allow you to rotate keys. I only got 10 fingerprints.

Good passkeys also should only exist to be checked on the device. Fingerprints can be in databases and on the device itself. Not sure how fingerprint scanners react to replicated fingerprints, but the right people can probably replicate them pretty well. I would only consider a fingerprint a more secure authentication measure because it can't be recorded by cameras.

Plus many countries demand fingerprints to enter. (Japan, for example)

Re: Feds Walk into a Building and Demand Everyone's Fingerprints to Open Phones

#30
Duress fingerprints. 'nuff said.

Or a configurable timeout, rather than the apparently hard-coded 48 hours.

Or ask for a PIN if the phone's radio detects many more other radios in the vicinity than a few minutes ago ("Because you might be under duress, please enter a PIN now.")

Or if a phone has been sitting on a flat surface for a while, require a PIN.

Or require a PIN if the phone is tapped with a duress code ("Shave-and-a-hair-cut"). Could be pretty subtle.

Countermeasures like this are useful both against thieves (who might want to unlock your phone and get access to your accounts) as well as against state actors (ditto).

Post reply on HN