Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID, Touch ID, No ID, PINs and Pragmatic Security

troyhunt.com

Post reply on HN
Print view View original

261–270 of 314 posts

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#261

Post by CocaKoala »

colejohnson66 wrote: post #234
kibwen wrote: post #74

Earlier quoted context omitted.

> TouchID was removed because it took up space on the front of the phone and Apple wanted the screen to be bigger. There's no deeper reason than that. The Pixel handset has the fingerprint sensor on the back of the phone. It appears to work quite well. Much of this needless outrage could be obviated by allowing multiple simultaneous biometrics for auth; while taking the phone out of your pocket, place your finger on…

> The Pixel handset has the fingerprint sensor on the back of the phone. How would I use my phone on a desk without lifting it up? I can do that with TouchID, but if the sensor is on the back, I can’t.

You can't really do that with the face id either, unless you loom over your desk in an awkward way.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#262

Post by giobox »

gist wrote: post #217
apeace wrote: post #177

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN This is what has been missing from every discussion of this issue that I've seen so far. The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get i…

I don't want to be that 'if you've got nothing to hide then' guy but why are people so worried about what border agents in particular will see on their cell phone? I am not saying that I wouldn't mind at all if my phone was searched. But I can't think of anything in particular that I would be concerned about if it was. Sure in theory the agent could remember some personal information and come back later and use that…

What's on your cellphone today; who knows what it will be tomorrow.

I'd personally much rather the State fundamentally respected a right to private and family life, much like article 8 of the ECHR, but fat chance of seeing that in the USA any time soon.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#263

Post by danjoc »

pertymcpert wrote: post #190
danjoc wrote: post #183

Earlier quoted context omitted.

>All biometric security mechanisms are bad They are though, if bad == insecure. Customs can make you unlock with fingerprint or face. If you can't lock yourself out, it's not secure.

Customs can do that anyway if you have a password.

> Customs can do that anyway if you have a password.

Allow me to repeat myself,

If you can't lock yourself out, it's not secure.

For example, some banks have time locks. Nobody gets into the vault, unless it is in a certain window of time.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#264

Post by CocaKoala »

heartbreak wrote: post #110
thisone wrote: post #43

Earlier quoted context omitted.

my phone is currently sat on my desk, about 10 inches from my right arm. I can, and do, check messages on it, by only repositioning my arm to unlock it. I easily read any messages by glancing at the phone, never coming into any decent imaging range.

Turn on the front camera, lay the phone on your desk. Can you see your face in the image? Then you can unlock your phone by glancing over at it.

My phone is on my desk next to my laptop in the same place where I've been texting my wife for the past five minutes. I have turned on the front facing camera.

My phone can see the very corner of my head and about half of my eyebrow. I do not want that to be enough to unlock my phone.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#265

Post by kccqzy »

giobox wrote: post #260
andrei_says_ wrote: post #237

Earlier quoted context omitted.

I'm not sure how I feel about storing 100+ GB in icloud and restoring it via my data plan.

Local encrypted backups via itunes are an option too, if you are traveling with a laptop.

Is that still going to work? I have the impression that Apple is simplifying iTunes and removing everything but audio and video.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#267

Post by colejohnson66 »

CocaKoala wrote: post #261
colejohnson66 wrote: post #234

Earlier quoted context omitted.

> The Pixel handset has the fingerprint sensor on the back of the phone. How would I use my phone on a desk without lifting it up? I can do that with TouchID, but if the sensor is on the back, I can’t.

You can't really do that with the face id either, unless you loom over your desk in an awkward way.

From their promo video of iPhone X, FaceID works at angles over 45° (see the swimmer portion)

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#268

Post by jfoutz »

ianmiers wrote: post #253
jfoutz wrote: post #222

Earlier quoted context omitted.

Also, the border is 100 miles from the Mexico/Canada borders and 100 miles from the shore. So, if you're concerned it's not when you're entering or leaving the country. It's any time you're in LA, NY, DC, SF, Huston or Detroit. Or any of the other thousands of miles of border.

Common misconception: If you have crossed the boarder, then within 100 miles of it they can search you. Of course, how you prove you didn't cross the boarder is an open question. But you can in fact refuse the search on that claim. I suppose they may detain you then.

I think you're looking for the phrase `probable cause`. If the officer has probable cause to think you crossed the border, they can search you. I'm not a lawyer, but i think they can search you anyway. It just won't be admissible in court.

edit

to clarify, US law pushes police right up to the edge. there is a preference for false positives rather than false negatives. it's more important to catch all of the criminals than it is to inconvenience some innocent people. The risk of letting one criminal go is much more than cost of detaining a doctor for a couple of hours.

Now, we're in this weird time where that doctor can have 20 years of hippa protected medical records in their pocket that they might be forced to disclose. Historically, that doctor may have some records in a briefcase, but not tens of thousands.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#269

Post by dpkonofa »

apeace wrote: post #177

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN This is what has been missing from every discussion of this issue that I've seen so far. The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get i…

You don't even have to do that anymore. With the new OS that will be standard on the new iPhones, you can just tap the power button 5 times to put it into a forced-lock mode. It'll require the use of your passcode before Face ID or Touch ID can be activated.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#270

Post by dpkonofa »

gist wrote: post #217
apeace wrote: post #177

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN This is what has been missing from every discussion of this issue that I've seen so far. The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get i…

I don't want to be that 'if you've got nothing to hide then' guy but why are people so worried about what border agents in particular will see on their cell phone? I am not saying that I wouldn't mind at all if my phone was searched. But I can't think of anything in particular that I would be concerned about if it was. Sure in theory the agent could remember some personal information and come back later and use that…

The issue is that they can compel you to unlock the phone and then make an image of the phone's contents which would allow them to clone it to another phone. They would then have full access to everything on your phone including any linked accounts and cloud services.
Post reply on HN