Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Securing a travel iPhone

blog.filippo.io

Post reply on HN
Print view View original

11–20 of 113 posts

Re: Securing a travel iPhone

#11

Post by ThatGeoGuy »

Jtsummers wrote: post #4
joshavant wrote: post #2

I thought I once read that, since Touch ID relies on fingerprints, a US court order can compel you to provide those, thus forcing you to unlock an iPhone in question. This, as opposed to a passcode-only configuration, which a court order cannot compel you to give (I believe since this would fall in the category of 'forcing you to testify against yourself'). If that is indeed the case, I imagine it would make better s…

http://blogs.wsj.com/digits/2014/10/31/judge-rules-suspect-c... Court decision from 2014. http://www.theatlantic.com/technology/archive/2016/05/iphone... First known application since then.

Keep in mind this is strictly relevant to US jurisdiction. In Canada, I recall that you can be compelled by a court to give up a password, or be held in contempt. That being said, something like TouchID is irrelevant if the password is going to be forced out of you anyways.

Re: Securing a travel iPhone

#13

Post by robotmlg »

lostlogin wrote: post #7
mikeash wrote: post #5

Earlier quoted context omitted.

I leave it enabled, then power the phone off before interacting with The Man, like when going through customs. Touch ID is disabled on a fresh boot until you enter your passcode, so that basically turns it off temporarily. This is briefly mentioned in the article. Another thing you could do is set it up with an unusual finger, like the middle-finger of your non-dominant hand. After five failed tries, Touch ID is disa…

Having got sick of damp fingers blocking Touch ID I added my nose as one of the options. No more lockout during dish washing.

Can a US court order compel you to provide your nose print?

Re: Securing a travel iPhone

#14

Post by Razengan »

As someone in a country with a serious mugging problem and having lost an iPhone already, one of the biggest security flaws I see is being able to power it off without providing any authentication.

What is even the point of Find my Phone and all that if anyone can just instantly switch off all the tracking?? You can't even ring your own number after that, and even law enforcement cannot look up the cell tower logs to see where it's been.

There should be an option to require a passcode for power-off, and another option to periodically send Find my Phone tracking even when "powered off," via any available network, until the battery dies.

EDIT: I agree they can just take out the SIM and we need to be able to force-power-off anyway.. but what can be done to increase the recoverability of these expensive items?

Re: Securing a travel iPhone

#15

Post by pavel_lishin »

Razengan wrote: post #14

As someone in a country with a serious mugging problem and having lost an iPhone already, one of the biggest security flaws I see is being able to power it off without providing any authentication. What is even the point of Find my Phone and all that if anyone can just instantly switch off all the tracking?? You can't even ring your own number after that, and even law enforcement cannot look up the cell tower logs to…

Wouldn't that be trivially defeated with a small packet of tin foil?

Re: Securing a travel iPhone

#16

Post by elithrar »

joshavant wrote: post #2

I thought I once read that, since Touch ID relies on fingerprints, a US court order can compel you to provide those, thus forcing you to unlock an iPhone in question. This, as opposed to a passcode-only configuration, which a court order cannot compel you to give (I believe since this would fall in the category of 'forcing you to testify against yourself'). If that is indeed the case, I imagine it would make better s…

> If that is indeed the case, I imagine it would make better sense to leave Touch ID disabled, unlike what this article suggests.

It entirely depends on your threat model. If you are at hacker or tech conferences, TouchID is far better as it can't be shoulder surfed. If your threat model is nation-states, then you would take a different approach. As TFA says:

> Turn the phone off before entering any situation that might lead to you being coerced to use your fingerprint to unlock the phone.

Re: Securing a travel iPhone

#17

Post by Jtsummers »

pavel_lishin wrote: post #15
Razengan wrote: post #14

As someone in a country with a serious mugging problem and having lost an iPhone already, one of the biggest security flaws I see is being able to power it off without providing any authentication. What is even the point of Find my Phone and all that if anyone can just instantly switch off all the tracking?? You can't even ring your own number after that, and even law enforcement cannot look up the cell tower logs to…

Wouldn't that be trivially defeated with a small packet of tin foil?

And removing the SIM card.

Re: Securing a travel iPhone

#19

Post by rolodato »

Razengan wrote: post #14

As someone in a country with a serious mugging problem and having lost an iPhone already, one of the biggest security flaws I see is being able to power it off without providing any authentication. What is even the point of Find my Phone and all that if anyone can just instantly switch off all the tracking?? You can't even ring your own number after that, and even law enforcement cannot look up the cell tower logs to…

The problem is that there has to be a way to forcefully power off the phone in case it freezes. If the OS depends on software to power off and the software is not reponsive, there's no way to shut it down without exhausting/removing the battery.

Re: Securing a travel iPhone

#20

Post by wyager »

Razengan wrote: post #14

As someone in a country with a serious mugging problem and having lost an iPhone already, one of the biggest security flaws I see is being able to power it off without providing any authentication. What is even the point of Find my Phone and all that if anyone can just instantly switch off all the tracking?? You can't even ring your own number after that, and even law enforcement cannot look up the cell tower logs to…

If the phone is locked, they can't do anything but part it out anyway. They might as well remove the battery.
Post reply on HN