Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID, Touch ID, No ID, PINs and Pragmatic Security

troyhunt.com

Post reply on HN
Print view View original

251–260 of 314 posts

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#251

Post by kibwen »

colejohnson66 wrote: post #234
kibwen wrote: post #74

Earlier quoted context omitted.

> TouchID was removed because it took up space on the front of the phone and Apple wanted the screen to be bigger. There's no deeper reason than that. The Pixel handset has the fingerprint sensor on the back of the phone. It appears to work quite well. Much of this needless outrage could be obviated by allowing multiple simultaneous biometrics for auth; while taking the phone out of your pocket, place your finger on…

> The Pixel handset has the fingerprint sensor on the back of the phone. How would I use my phone on a desk without lifting it up? I can do that with TouchID, but if the sensor is on the back, I can’t.

I confess, never in my years of phone ownership have I had that specific use case, or considered that it might be important for others. Do you find yourself doing that often? If so, can I ask what for?

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#252

Post by apeace »

gist wrote: post #217
apeace wrote: post #177

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN This is what has been missing from every discussion of this issue that I've seen so far. The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get i…

I don't want to be that 'if you've got nothing to hide then' guy but why are people so worried about what border agents in particular will see on their cell phone? I am not saying that I wouldn't mind at all if my phone was searched. But I can't think of anything in particular that I would be concerned about if it was. Sure in theory the agent could remember some personal information and come back later and use that…

Not sure why you have been downvoted, since it is a valid question and you phrased it in a productive way.

I think the reason people focus on border searching so much is that it's presumed to be one of the easiest entry points for the government to spy on you.

Many security researchers, such as people who work on Tor and related technologies, have had their electronics searched and sometimes seized at the border. That makes it particularly relevant to the HN crowd.

For me, I seriously doubt the government would ever be interested in my data. But imagine that the CEO of my company is suspected of some kind of crime. Perhaps when I am at the border they try to image my phone, in order to get access to things which may allow them to control other company assets (servers, etc), which would get them closer to their target.

I doubt it would ever happen to me, but I'd rather take precautions. Being searched at the border seems much more likely to me than, say, the NSA/FBI targeting me remotely with malware.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#253

Post by ianmiers »

jfoutz wrote: post #222
bodz wrote: post #205

Earlier quoted context omitted.

> The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get in the security line! Pin will be required on start. As far as border searches go, border officers have the authority to request your PIN just as they have the authority to request your thumbprint/faceprint/etc. If you don't give it to them, you can be detained and/or your phone confiscated [1]. Reboot…

Also, the border is 100 miles from the Mexico/Canada borders and 100 miles from the shore. So, if you're concerned it's not when you're entering or leaving the country. It's any time you're in LA, NY, DC, SF, Huston or Detroit. Or any of the other thousands of miles of border.

Common misconception: If you have crossed the boarder, then within 100 miles of it they can search you.

Of course, how you prove you didn't cross the boarder is an open question. But you can in fact refuse the search on that claim. I suppose they may detain you then.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#254

Post by jcrawfordor »

justsid wrote: post #213
irrational wrote: post #206

Earlier quoted context omitted.

I'm not sure, but I know with my spouse and I, we always put each others Biometrics into each other's devices (I add her fingerprints to my phone and vice versa), share a lastpass account so we know each other's passwords, add our email accounts to each other's devices so we can always look at each others email, etc. If you are married to someone and don't trust them enough to do the same I have to question the found…

Not trying to tell you how to live your life, but being an open book to the other isn‘t very trusting. If your trust is build around being able to spy on the other, maybe you aren‘t trusting each other that much. My wife and I both have our own separate phones and computers without each other being able to access it and I trust her not to do anything that goes against our interests and vice versa. That‘s what trust i…

I just got tired of having to unlock my phone every time I asked my boyfriend to send a message while I was driving, change what music was playing, etc., so I enrolled his fingerprint. I imagine most people that do this are thinking on the same lines... I would say that this is an indication of trust, as I trust him not to go snooping around on my phone.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#255

Post by tastythrowaway »

morgante wrote: post #230
bodz wrote: post #205

Earlier quoted context omitted.

> The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get in the security line! Pin will be required on start. As far as border searches go, border officers have the authority to request your PIN just as they have the authority to request your thumbprint/faceprint/etc. If you don't give it to them, you can be detained and/or your phone confiscated [1]. Reboot…

They can request your PIN all they want, but you are not obligated to provide it. They can temporarily detain you but not indefinitely, and the EFF is challenging their authority to even do that. [0] Personally, I would refuse to unlock my phone. My privacy and upholding civil liberties is worth being detained for a few hours (or even days). [0] https://www.eff.org/press/releases/eff-aclu-media-conference...

An important point: the would likely confiscate any devices you refuse to unlock. Is it worth that?

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#256

Post by nemothekid »

irq-1 wrote: post #200
smelterdemon wrote: post #150

Re: the pushback the author got on Twitter; I believe in skepticism towards corporations and marketing claims, but the level of cynicism online towards any new tech idea or product seems a bit out of hand. There's a certain trend, on Twitter especially, of people racing to prove they're either more woke or smarter than the teams of people behind things that are yet to even be released. I mean a "wait and see" attitud…

"attention awareness" is Apples own description. How long before it's turned against the user to confirm "Advertisement Awareness" or EULA Awareness, etc..?

>Advertisement Awareness

Fortunately Sony already has a patent for this exact scenario. Maybe that will deter Apple from building such a feature (lol).

http://fortune.com/2013/04/30/sony-patent-is-hilarious-terri...

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#257

Post by morgante »

tastythrowaway wrote: post #255
morgante wrote: post #230

Earlier quoted context omitted.

They can request your PIN all they want, but you are not obligated to provide it. They can temporarily detain you but not indefinitely, and the EFF is challenging their authority to even do that. [0] Personally, I would refuse to unlock my phone. My privacy and upholding civil liberties is worth being detained for a few hours (or even days). [0] https://www.eff.org/press/releases/eff-aclu-media-conference...

An important point: the would likely confiscate any devices you refuse to unlock. Is it worth that?

Yes. They are supposed to return it eventually, and even if they don't I'm willing to pay $1,000 to protect civil liberties.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#258

Post by tastythrowaway »

Jeremy1026 wrote: post #248
eanzenberg wrote: post #218

Earlier quoted context omitted.

That's the point, "constitutionally" while they lock you up for hours/days on end to obtain the warrant needed to give up your password unless you are willing to stay locked up.

Get that sweet settlement for wrongful imprisonment.

How many times has this actually happened though?

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#259

Post by [deleted] »

bodz wrote: post #205
apeace wrote: post #177

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN This is what has been missing from every discussion of this issue that I've seen so far. The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get i…

> The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get in the security line! Pin will be required on start. As far as border searches go, border officers have the authority to request your PIN just as they have the authority to request your thumbprint/faceprint/etc. If you don't give it to them, you can be detained and/or your phone confiscated [1]. Reboot…

[deleted]

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#260

Post by giobox »

andrei_says_ wrote: post #237
knolan wrote: post #225

Earlier quoted context omitted.

It's also worth pointing out that iOS already has an option to erase your phone when the PIN is entered incorrectly a certain number of times. A lot of companies enforce this if you receive your work email on your device (eight times in my case). So if you are in a situation where a PIN is being demanded there's still a way to keep secure. Your phone can be easily restored from an iCloud backup once you've got access…

I'm not sure how I feel about storing 100+ GB in icloud and restoring it via my data plan.

Local encrypted backups via itunes are an option too, if you are traveling with a laptop.
Post reply on HN