Live data from Hacker News

Face ID, Touch ID, No ID, PINs and Pragmatic Security

troyhunt.com

231–240 of 314 posts

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#231

What I want to know is what face data is shared with 3rd parties like snapchat. That seems like the bigger threat, and no one is really discussing that.

Unless Apple provides only an API to interact with the model, not actually use it. Which, considering it’s Apple, I’m sure they did.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#233
post #177

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN This is what has been missing from every discussion of this issue that I've seen so far. The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get i…

In addition, most customs/immigration lines have signs requiring you to turn off your phone.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#234
post #74

Earlier quoted context omitted.

TouchID was removed because it took up space on the front of the phone and Apple wanted the screen to be bigger. There's no deeper reason than that. > Will Apple continue progress and built in PinchID - a tiny needle that sting you to test if you are you based on your blood/DNA? I struggle to believe you when you say that's a serious question... > Im also concerned about the data Apple will collect. The FaceID data w…

> TouchID was removed because it took up space on the front of the phone and Apple wanted the screen to be bigger. There's no deeper reason than that. The Pixel handset has the fingerprint sensor on the back of the phone. It appears to work quite well. Much of this needless outrage could be obviated by allowing multiple simultaneous biometrics for auth; while taking the phone out of your pocket, place your finger on…

> The Pixel handset has the fingerprint sensor on the back of the phone.

How would I use my phone on a desk without lifting it up? I can do that with TouchID, but if the sensor is on the back, I can’t.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#235

Earlier quoted context omitted.

TouchID was removed because it took up space on the front of the phone and Apple wanted the screen to be bigger. There's no deeper reason than that. > Will Apple continue progress and built in PinchID - a tiny needle that sting you to test if you are you based on your blood/DNA? I struggle to believe you when you say that's a serious question... > Im also concerned about the data Apple will collect. The FaceID data w…

TouchID is trivially defeated by a 6-year-old: https://www.usatoday.com/story/news/nation/2016/12/28/girl-u...

All the more reason for FaceID

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#236

Repeat after me. iPhone X is less secure than the iPhone 8. Why? iPhone X: Chances of someone unlocking while you are asleep is 1 in 1 iPhone 8: Chances of someone unlocking while you are asleep is 1 in 200,000 I certainly prefer the latter odds.

Your eyes need to be open for it to unlock. Also someone can't touch your fingertips when you are asleep?

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#237
post #225
post #180

Earlier quoted context omitted.

On top of this, iOS 11 introduced an emergency mode that is enabled by tapping the standby button five times rapidly. It is easy to do discretely in your pocket, and it locks your phone by requiring your passcode to be entered again.

It's also worth pointing out that iOS already has an option to erase your phone when the PIN is entered incorrectly a certain number of times. A lot of companies enforce this if you receive your work email on your device (eight times in my case). So if you are in a situation where a PIN is being demanded there's still a way to keep secure. Your phone can be easily restored from an iCloud backup once you've got access…

I'm not sure how I feel about storing 100+ GB in icloud and restoring it via my data plan.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#238
post #217
post #177

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN This is what has been missing from every discussion of this issue that I've seen so far. The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get i…

I don't want to be that 'if you've got nothing to hide then' guy but why are people so worried about what border agents in particular will see on their cell phone? I am not saying that I wouldn't mind at all if my phone was searched. But I can't think of anything in particular that I would be concerned about if it was. Sure in theory the agent could remember some personal information and come back later and use that…

This was a particularly concerning case: https://www.theverge.com/2017/2/12/14583124/nasa-sidd-bikkan...

    Bikkannavar says he was detained by US Customs and Border Patrol and
    pressured to give the CBP agents his phone and access PIN. Since the phone
    was issued by NASA, it may have contained sensitive material that wasn’t
    supposed to be shared. Bikkannavar’s phone was returned to him after it was
    searched by CBP, but he doesn’t know exactly what information officials
    might have taken from the device.
Once he unlocked his phone, they were gone with it for 40 minutes. Plenty of time to copy the device contents and peruse at their leisure.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#239

Earlier quoted context omitted.

I'm not sure, but I know with my spouse and I, we always put each others Biometrics into each other's devices (I add her fingerprints to my phone and vice versa), share a lastpass account so we know each other's passwords, add our email accounts to each other's devices so we can always look at each others email, etc. If you are married to someone and don't trust them enough to do the same I have to question the found…

Not trying to tell you how to live your life, but being an open book to the other isn‘t very trusting. If your trust is build around being able to spy on the other, maybe you aren‘t trusting each other that much. My wife and I both have our own separate phones and computers without each other being able to access it and I trust her not to do anything that goes against our interests and vice versa. That‘s what trust i…

Its kind of perverse to jump to spying, don't you think? I'm not spying on my wife or she on me. Even though I have her email on my phone, in the past year I think I've only been in there twice, both times when she asked me to look for something for her. I know she doesn't look at mine either because she just doesn't care.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#240
post #205

Earlier quoted context omitted.

> The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get in the security line! Pin will be required on start. As far as border searches go, border officers have the authority to request your PIN just as they have the authority to request your thumbprint/faceprint/etc. If you don't give it to them, you can be detained and/or your phone confiscated [1]. Reboot…

They can request your PIN all they want, but you are not obligated to provide it. They can temporarily detain you but not indefinitely, and the EFF is challenging their authority to even do that. [0] Personally, I would refuse to unlock my phone. My privacy and upholding civil liberties is worth being detained for a few hours (or even days). [0] https://www.eff.org/press/releases/eff-aclu-media-conference...

Amen!
Post reply on HN