71–80 of 113 posts
Earlier quoted context omitted.
Just don't setup Touch ID?
Obviously, but if you're as security-minded as this article author is, I'd trust a hardware solution over a software solution. It's the difference between turning off your camera and actually unplugging your camera (for instance.)
As someone in a country with a serious mugging problem and having lost an iPhone already, one of the biggest security flaws I see is being able to power it off without providing any authentication. What is even the point of Find my Phone and all that if anyone can just instantly switch off all the tracking?? You can't even ring your own number after that, and even law enforcement cannot look up the cell tower logs to…
>and even law enforcement cannot look up the cell tower logs to see where it's been. I'm not so sure about that... I worked at a TV news station in a major city where police told us they could track cell phones that were turned off. IIRC, it came up during an interview after they apprehended a suspect in a big rape/murder case. The suspect's phone was off, but they were able to track him. They told us they didn't rea…
Earlier quoted context omitted.
on older phones like late 90's very early 2000's there was enough power leaking from from the antenna into the modem part that you could ping turned off phones remotely even if the battery was removed I've seen this in action I don't see how that could work - even if power through the antenna did cause the phone to transmit something, more than the radio would have to be powered up to get the phone to return any kind…
It wasn't transmitting a proper cell signal, it was transmitting something that they could detect. I would assume that you would profile phones (of a certain make and model) and based on the return signal identify them. This was used in the early days of in places where there wasn't high cellphone density to begin with.
Earlier quoted context omitted.
I did this so I can unlock my phone with my snowboarding gloves on. I can unlock with the nose and then press the texting app button with my nose to read tests.
Do we know if nose-prints are particularly unique? Or even unique in the context of how fingerprints are typically analysed?
Earlier quoted context omitted.
Perfect for parts. New screens aren't cheap. Battery, camera modules, etc.
New screens are a lot cheaper than $200, which appears to be the price of iCloud locked phone.
You can always use a call relay. So you can give people one phone number that relays to your own real number (for voice calls) - although an voice call is obviously more vulnerable than Signal call etc.
Ditto, AFAIK there is the ability to setup a relay for SMS through an Android. I can't remember the app but basically people could SMS that number and it relays to you real number.
Before people jump on me, yes I am aware of the weaknesses of both of the above but sometimes a specific type of threat model requires these two tricks. I recommend it unless you are aware of the trade offs.
Earlier quoted context omitted.
Having got sick of damp fingers blocking Touch ID I added my nose as one of the options. No more lockout during dish washing.
Can a US court order compel you to provide your nose print?
Hey, author here. Happy to answer questions. There's also a big Twitter thread here https://twitter.com/FiloSottile/status/750273921568485377 To frame the post and the conversation, I am targeting a loose but not universal threat model. If threat of deadly force is higher up in your risk scale than shoulder-surfing, or Apple cooperation is a given, then you might want to make very different choices, but more importan…
I'd avoid using TouchID to unlock your phone for legal reasons. Once the phone is unlocked, you can use TouchID as the phone is already open and you would not gain/lose anything from using TouchID in that scenario. But until the courts rule that you cannot be compelled to TouchID unlock your phone like a PIN, I think that is the safer route to take for now.
It's all about the threat model.
I would have thought a rooted Android or Ubuntu phone would more secure (done right).
Given that rooting an Android phone frequently involves turning off security features (for example, rooting a Nexus device entails unlocking the bootloader to accept an unsigned boot image), you're probably better off running a stock, unrooted firmware to make it easier to tell if things have been modified. That's in addition to the added attack surface that the root itself provides once the phone's up and running. Y…
You can always lock the bootloader again after installing your ROM. Unlocking it will wipe the device again which is inconvenient for ROM updates etc, but if you're a trooper, you can do it. This inconvenience was pretty easily fixed with the open source bootunlocker[0] apk which allowed to you unlock and relock the bootloader once in rooted userspace, but sadly it doesn't work on anything newer than the original Nexus 5 due to security features in newer Android hardware. Manual unlocking, re-installation and boot re-locking is still possible.
The decryption password can be beefed up with adb from the terminal as well. There isn't a pretty gui for it, but that way you can get a strong safe encryption password and a short screen unlock pin. Unfortunately the two are tied iirc normally. Some would argue that having an organically strong password is safer than allowing the hardware to help beef up weak pins.
I'm sure there are other problems, sadly Google seems to look at privacy and security on Android as issues for later. And running anything besides a nexus device is entirely less safe due to the toxic OEM/Google update environment.
Earlier quoted context omitted.
Yeah, fuck Touch ID. In my opinion, a computer security feature that works when you are unconscious is not a computer security feature.
Talk about throwing out the baby with bathwater. Being unconscious ir a very rare use case for iPhone. In other cases having protection provided by Touch ID beats passcode which is to inconvenient so many would skip and left without ANY protection. Touch ID is basically transparent and provides adequate protection for common scenarios.