Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

wired.com

Post reply on HN
Print view View original

41–50 of 141 posts

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#41

Post by malandrew »

At least with fingerprints, you can effectively destroy the "password" irreversibly before being compelled, since you can always cut off the tip of your finger and destroy it.

Sounds messed up, but it's certainly a possibility. Since the finger is not the evidence itself, I don't think this would constitute destruction of evidence, and so long as it is done before the court asks you to unlock the device, it should not result in contempt of court. However, this is all uncharted territory and IANAL.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#42

Post by malandrew »

ejdyksen wrote: post #35
Osmium wrote: post #4

In practice, it might have the opposite effect. Currently, 4-digit PINs are (presumably) brute-forceable and the alternative of entering a longer, cryptographically-secure password every time you want to use your phone is impractical, so it doesn't really matter whether you can be legally compelled to divulge your PIN or not. However, with a fingerprint ID, you can now use a cryptographically strong password to encry…

> 4-digit PINs are (presumably) brute-forceable True, but iOS does have an option to wipe the phone after 10 unsuccessful PIN attempts. Given that iCloud backup is pretty simple to setup, there's no reason not to configure this option, IMO.

Yeah, but the court can still get a warrant for the iCloud data, which I am almost certain isn't store in encrypted form or at least in an encrypted form for which Apple does not have the keys.

You really need to use iTunes and an app like PhoneView for backing up all your data locally and storing that data in encrypted form outside the jurisdiction of your country.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#43

Post by chrislomax »

danso wrote: post #36

A little off-topic, but can someone tell me why fingerprint-access is even a needed feature? With PIN access, you get good enough security when you also enable the lock-after-10-mistypes. And 4-digits is only about a few seconds slower than fingerprint access...and since you already have instant access to incoming calls and to the camera, in what situations do we need insta-touch access to our phones? Phones are gett…

If I were to take a massive guess on this (and this is a massive guess). I would say that for the lifetime of the phone being unlocked with your fingerprint you could do things like pay for items etc.

They may be lining up for banks or other authorities to start allowing finger print recognition in their systems and apps to make bank transfers or pay for items in general and that your finger print would be the authorisation.

It may be one level more secure when they implement NFC.

I don't know though, I doubt they have done it simply because people want to unlock their phones 1 second faster.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#44

Post by tedunangst »

ctdonath wrote: post #12
cbhl wrote: post #7

I feel like the author of this article is missing the whole point of Fingerprint ID. The feature is meant to make using an iPhone more secure for those of us who tend to leave our phones unlocked and PIN-free. If you're storing anything of value on your phone, the existing password-based and PIN-based lock mechanisms aren't going away any time soon. If nothing else, it'd break too many organizations' Active Directory…

No, you're missing his point. You're in court. You refuse to admit/verify the accusation that you were in the vicinity of the deceased's home. Cell phone records, dutifully recorded and reported under warrant from NSA...er...ATT, show your phone - which you are known to carry pretty much everywhere - was in that vicinity at the crime's time. You contend that does not constitute evidence. The phone is acquired, bailif…

You can still contend that the fact your finger unlocks the phone today doesn't prove you were the one using the phone in the deceased's home. Maybe the phone was unlocked via passcode at the time of the murder.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#45

Post by djdj123 »

danso wrote: post #36

A little off-topic, but can someone tell me why fingerprint-access is even a needed feature? With PIN access, you get good enough security when you also enable the lock-after-10-mistypes. And 4-digits is only about a few seconds slower than fingerprint access...and since you already have instant access to incoming calls and to the camera, in what situations do we need insta-touch access to our phones? Phones are gett…

Er, iphones and other fancy smartphones are being stolen because they fetch hundreds of dollars from black-market wholesalers and unwitting craigslist buyers. Not because people don't use a PIN. Of course, using a PIN is a good idea in the event that the person who eventually gets possession is an identity thief.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#46

Post by tedunangst »

jlgreco wrote: post #40
haberman wrote: post #28

Earlier quoted context omitted.

If the phone wasn't password-protected (or fingerprint-protected) at all, the story would be the same except you could skip the "bailiff places your finger..." step.

You would be missing the key "the phone is, beyond doubt, yours" step.

"I just bought it yesterday."

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#47

Post by falcolas »

crazygringo wrote: post #37

The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not... The fingerprint ID is just another option , which you don't have to use . So titles like this are just incorrect. Fingerprint ID isn't taking away any of your rights, because you can still use the PIN just like you always have . I mean seriously, what the heck is going on here? Why on earth are people getting worked u…

> The fingerprint ID is just another option, which you don't have to use.

It's still important to let people know the potential pitfalls of such a method, even if it's one option amongst many, so they can make an informed choice between the options.

> Why on earth are people getting worked up about this?

Because it has serious implications on your security, both from other people, and from the government (or its actors), implications which are not immediately obvious.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#48

Post by rayiner »

This article actually gets the law right, as it stands today. I'm not sure if it's super relevant information, but it's correct. The 5th amendment says: "No person... shall be compelled in any criminal case to be a witness against himself..." Witness is a legal term of art, which refers to someone who gives oral testimony recounting their own experiences. Handing over a key or touching a button is not testamentary and therefore not protected.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#49

Post by [deleted] »

crazygringo wrote: post #37

The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not... The fingerprint ID is just another option , which you don't have to use . So titles like this are just incorrect. Fingerprint ID isn't taking away any of your rights, because you can still use the PIN just like you always have . I mean seriously, what the heck is going on here? Why on earth are people getting worked u…

[deleted]

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#50

Post by objclxt »

miles wrote: post #32
tocomment wrote: post #16

Earlier quoted context omitted.

Are you sure you can brute force the PIN? I thought the iPhone will enforce a waiting period after too many bad entries.

Are you sure you can brute force the PIN? Yep: Elcomsoft iOS Forensic Toolkit[1] * Instant passcode recovery for all iOS versions up to iOS 3 * Simple 4-digit iOS 4/5/6 passcodes recovered in 10-40 minutes [1] http://www.elcomsoft.com/eift.html

> Yep: Elcomsoft iOS Forensic Toolkit[1]

I think you missed the fairly huge disclaimer hidden away at the bottom of the page:

> iPhone 4S, iPhone 5, iPad 2+, iPad Mini and iPod Touch 5th gen support is limited to jailbroken devices only (iOS 5 and 6).

The chances of a target device being jailbroken are not particularly large. This should, of course, serve as a reminder that if you are running a jailbroken device you should probably have a passcode a little more complex than four digits!

Post reply on HN