21–30 of 141 posts
Something you have: fingerprint Something you know: PIN
Combine the two and you can be fairly sure only the owner has access to whatever's being protected.
In practice, it might have the opposite effect. Currently, 4-digit PINs are (presumably) brute-forceable and the alternative of entering a longer, cryptographically-secure password every time you want to use your phone is impractical, so it doesn't really matter whether you can be legally compelled to divulge your PIN or not. However, with a fingerprint ID, you can now use a cryptographically strong password to encry…
In practice, it might have the opposite effect. Currently, 4-digit PINs are (presumably) brute-forceable and the alternative of entering a longer, cryptographically-secure password every time you want to use your phone is impractical, so it doesn't really matter whether you can be legally compelled to divulge your PIN or not. However, with a fingerprint ID, you can now use a cryptographically strong password to encry…
1. If the prosecutor can prove that incriminating evidence is encrypted, you can be compelled.
2. If you ever divulged your passphrase to the government or provided the plaintext, you can be compelled.
3. If you have not divulged the passphrase and the government has no proof that incriminating evidence is encrypted, you cannot be compelled.
If I remember correctly, the prosecutor cannot both compel you to give up a passphrase and use your knowledge of the passphrase as evidence against you (e.g. to prove that you controlled the computer in question).
And now wired is added to my list of fear mongering link baited blogospam.
[deleted]
To reclaim your freedom, just switch to open-source solutions.
In practice, it might have the opposite effect. Currently, 4-digit PINs are (presumably) brute-forceable and the alternative of entering a longer, cryptographically-secure password every time you want to use your phone is impractical, so it doesn't really matter whether you can be legally compelled to divulge your PIN or not. However, with a fingerprint ID, you can now use a cryptographically strong password to encry…
Are you sure you can brute force the PIN? I thought the iPhone will enforce a waiting period after too many bad entries.
My son has verified this personally...
I feel like the author of this article is missing the whole point of Fingerprint ID. The feature is meant to make using an iPhone more secure for those of us who tend to leave our phones unlocked and PIN-free. If you're storing anything of value on your phone, the existing password-based and PIN-based lock mechanisms aren't going away any time soon. If nothing else, it'd break too many organizations' Active Directory…
No, you're missing his point. You're in court. You refuse to admit/verify the accusation that you were in the vicinity of the deceased's home. Cell phone records, dutifully recorded and reported under warrant from NSA...er...ATT, show your phone - which you are known to carry pretty much everywhere - was in that vicinity at the crime's time. You contend that does not constitute evidence. The phone is acquired, bailif…
Wouldn't you be able to CHOOSE what you apply a fingerprint lock to? Ideally you would only allow it for payments and not other things.
For instance, I recently heard of an older couple who allowed the husband's brother to visit them to talk about a new business he was in. Essentially he wanted to visit the couple with his "mentor" because he needed to "practice". At the end of their visit the couple had been persuaded to: join the "business" as members, for a monthly fee, which was going to be charged to their credit card. THIS WAS OBVIOUSLY A PYRAMID SCHEME! Anyways, after the visit, the terrified the woman immediately called the bank and had them cancel the card, so everything ended up being okay. Imagine if they had handed over their fingerprints! You won't be able to call the bank to tell them to send you a new fingerprint.
I feel like the author of this article is missing the whole point of Fingerprint ID. The feature is meant to make using an iPhone more secure for those of us who tend to leave our phones unlocked and PIN-free. If you're storing anything of value on your phone, the existing password-based and PIN-based lock mechanisms aren't going away any time soon. If nothing else, it'd break too many organizations' Active Directory…
No, you're missing his point. You're in court. You refuse to admit/verify the accusation that you were in the vicinity of the deceased's home. Cell phone records, dutifully recorded and reported under warrant from NSA...er...ATT, show your phone - which you are known to carry pretty much everywhere - was in that vicinity at the crime's time. You contend that does not constitute evidence. The phone is acquired, bailif…
Touch ID is optional, if a user feels particularly concerned, about legal implications of this, it is perfectly valid to revert to a passcode. I am glad that this article/discussion exists though, it is good to know what risks may exists using new security systems.
[Edited to add: just read somewhere else that after 48 hours of inactivity or a reboot, user must re-enter passcode before fingerprint will unlock the device. This would seem to protect from the case stated in the article.]