Live data from Hacker News

Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

wired.com

61–70 of 141 posts

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#61

The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not... The fingerprint ID is just another option , which you don't have to use . So titles like this are just incorrect. Fingerprint ID isn't taking away any of your rights, because you can still use the PIN just like you always have . I mean seriously, what the heck is going on here? Why on earth are people getting worked u…

Honestly, I think it's because attacking Apple seems to be in vogue nowadays. Thus, if you have an article attacking Apple, you can guarantee higher click-thru rates.

It really makes no sense. Fingerprint sensors have been built into Android phones (Atrix 4G comes to mind) since 2011 and in Windows laptops for many, many years. The sheer amount of articles discussing the Touch ID is actually astounding when you remember that Google's Face Unlock was cracked originally by a _photo_ of the user and then cracked with _two_ photos of the person. There are real, actually implemented cracks for Android's lock screen but that's been grossly overshadowed by the conceptual idea of possibly cracking Apple's Touch ID.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#62
post #50
post #32

Earlier quoted context omitted.

Are you sure you can brute force the PIN? Yep: Elcomsoft iOS Forensic Toolkit[1] * Instant passcode recovery for all iOS versions up to iOS 3 * Simple 4-digit iOS 4/5/6 passcodes recovered in 10-40 minutes [1] http://www.elcomsoft.com/eift.html

> Yep: Elcomsoft iOS Forensic Toolkit[1] I think you missed the fairly huge disclaimer hidden away at the bottom of the page: > iPhone 4S, iPhone 5, iPad 2+, iPad Mini and iPod Touch 5th gen support is limited to jailbroken devices only (iOS 5 and 6). The chances of a target device being jailbroken are not particularly large. This should, of course, serve as a reminder that if you are running a jailbroken device you…

There are many other forensic acquisition products for iOS[1] as well as a number available to law enforcement only; I think it's safe to say that relying on your iPhone's PIN code for protection is probably not a good idea.

[1] http://www.appleexaminer.com/iPhoneiPad/iOSAnalysisTools/iOS...

EDIT: This device was found on the AppleExaminer page:

http://www.cellebrite.com/forensic-solutions/ios-forensics.h...

"Using UFED Physical Analyzer, physical and file system extractions, decoding and analysis can be performed on locked iOS devices with a simple or complex passcode. Simple passcodes will be recovered during the physical extraction process and enable access to emails and keychain passwords. If a complex password is set on the device, physical extraction can be performed without access to emails and keychain. However, if the complex password is known, emails and keychain passwords will be available."

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#63
post #60

It will be interesting to see how difficult or how easy it is to fool Apple's fingerprint scanner. I suspect the security will not be high given the constraints of putting it in a button on a mobile phone and the preference for letting marginal scans authenticate the user so as not to frustrate or inconvenience them. Personally, I'd trust a 4-digit pin with a lockout timer to stand up better than fingerprint authenti…

Since the phone is covered in the password anyway, it would be interesting to see if it stands up to a gummi bear attack: http://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_f...

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#64
post #48

This article actually gets the law right, as it stands today. I'm not sure if it's super relevant information, but it's correct. The 5th amendment says: "No person... shall be compelled in any criminal case to be a witness against himself..." Witness is a legal term of art, which refers to someone who gives oral testimony recounting their own experiences. Handing over a key or touching a button is not testamentary an…

Not quite.

> When a person has a valid privilege against self-incrimination, nobody — not even a judge — can force the witness to give that information to the government.

The Fifth Amendment explicitly outlines that you cannot successfully "plead the fifth" in response to a grand jury compelling you to testify.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#65
post #40

Earlier quoted context omitted.

If the phone wasn't password-protected (or fingerprint-protected) at all, the story would be the same except you could skip the "bailiff places your finger..." step.

You would be missing the key "the phone is, beyond doubt, yours" step.

I have been a juror on a criminal case that relied heavily on phone records. There was no fingerprint system involved, and yet it was clear beyond reasonable doubt that the phone belonged to the defendant.

The phone company can testify that the phone corresponds to a given cell number. Other people can testify that they spoke to the defendant on that number. No one piece of evidence exists in a vacuum; all the pieces of evidence combine to paint a picture.

Sure you could try to lie by making up stories about how the phone wasn't really yours, but it's hard to get all the other evidence to line up with a lie. This is a GOOD thing; the protection against self-incrimination isn't intended to help people get away with murder, it's intended to protect the accused from being compelled to help the government prosecute them.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#66
post #54

Earlier quoted context omitted.

"I just bought it yesterday."

Since it's trivial to show whether or not that is true, I would not advise making such a thing. It is highly inadvisable to lie to the police or courts.

The evidence used to prove when you bought the phone would also likely be used to demonstrate that you own the phone. I don't think the fact that your fingerprint unlocks the phone found in your pocket at the time of arrest is likely to be the jury's determining factor in deciding whether that phone belongs to you.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#67
post #57

The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not... The fingerprint ID is just another option , which you don't have to use . So titles like this are just incorrect. Fingerprint ID isn't taking away any of your rights, because you can still use the PIN just like you always have . I mean seriously, what the heck is going on here? Why on earth are people getting worked u…

> The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not... The fingerprint ID is just another option, which you don't have to use. That's never how it works. Today it's "just another option", a few years down the line it's mandatory. And "not having to use" does not equal "people will not use it unless they are fully aware of possible consequences" anyway.

> a few years down the line it's mandatory

That's just FUD. And saying baseless things like "that's never how it works", that's just fearmongering, not contributing to the conversation. It doesn't even make sense.

There are millions (hundreds of thousands? you get my point) of fingerprint readers out there. Suddenly Apple builds one in, an additional feature, and people start inventing conspiracy theories. People are completely confusing real issues (recent NSA disclosures) with totally imaginary ones. It's getting tiring.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#68
post #36

A little off-topic, but can someone tell me why fingerprint-access is even a needed feature? With PIN access, you get good enough security when you also enable the lock-after-10-mistypes. And 4-digits is only about a few seconds slower than fingerprint access...and since you already have instant access to incoming calls and to the camera, in what situations do we need insta-touch access to our phones? Phones are gett…

I don't use a pin because I don't want to have to enter one every single time I want to quickly check something on my phone. Those extra few seconds would be a many-times-a-day annoyance, and I try to keep my day annoyance-free.

Since a fingerprint scan is faster, it is security I would probably use. (And the hyperventilation about hypothetical 5th amendment issues doesn't bother me one iota.)

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#69

The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not... The fingerprint ID is just another option , which you don't have to use . So titles like this are just incorrect. Fingerprint ID isn't taking away any of your rights, because you can still use the PIN just like you always have . I mean seriously, what the heck is going on here? Why on earth are people getting worked u…

Flashnews from a whisteblower 2016: in joint cooperation with DEA, NSA and FBI, Apple had updated their software to capture users fingerprints while they touch the screen and send those to The National Anti-Terrorism and Happiness Database, guarded by the NSA.

For years Apple has been denying direct access to finger-print reader, built-in behind your device's screen, but recent revelation shows that the backdoor is being widely used by the US government.

- "I didn't know they can do that, but hey if it keeps us safe then why not?" - says Jennifer Stone, Apple products fan. - "You know after we put the boots on Syrian grounds there has been so much terror retaliation on our soil that probably at some point they would require to finger-print every American, but this way thanks to my Apple device, the government has actually saved me a trip to the local police department for a full finger-print read. Its all good, you know. yolo!".

EDIT: breaking news September 11, 2020. A North Korean terrorist organization successfully hacked into NSA mainframe and downloaded over 25 terrabytes of data related to american's social security records and credit card information. they also obtained driver's license database as well as DNA and fingerprinting records for over 300 million americans. The US government is going into full shut down; starting tomorrow everyone will start receiving new credit cards, new social security numbers as well as new drivers license. Since DNA and fingerprinting information can be reproduced and faked quite cheaply, starting tomorrow no criminal case in the US legal system will be tried based on the evidence introduced from said sources.

- When 911 happened, we had terrorist using our infrastructure, our planes, our airports and our buildings to cause terror. Who would have known that 20 years later storing detailed information on 300 million Americans under one roof in one building would be so hazardous to the National Security. - said independent security contractor.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#70
post #57

Earlier quoted context omitted.

> The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not... The fingerprint ID is just another option, which you don't have to use. That's never how it works. Today it's "just another option", a few years down the line it's mandatory. And "not having to use" does not equal "people will not use it unless they are fully aware of possible consequences" anyway.

> a few years down the line it's mandatory That's just FUD. And saying baseless things like "that's never how it works", that's just fearmongering, not contributing to the conversation. It doesn't even make sense. There are millions (hundreds of thousands? you get my point) of fingerprint readers out there. Suddenly Apple builds one in, an additional feature , and people start inventing conspiracy theories. People ar…

when was the last time u saw people walking down the street playing w their fingerprint readers? readers are not as ubiquitous as iphones.
Post reply on HN