Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

wired.com

Post reply on HN
Print view View original

81–90 of 141 posts

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#81

Post by marvin »

nodata wrote: post #63
beloch wrote: post #60

It will be interesting to see how difficult or how easy it is to fool Apple's fingerprint scanner. I suspect the security will not be high given the constraints of putting it in a button on a mobile phone and the preference for letting marginal scans authenticate the user so as not to frustrate or inconvenience them. Personally, I'd trust a 4-digit pin with a lockout timer to stand up better than fingerprint authenti…

Since the phone is covered in the password anyway, it would be interesting to see if it stands up to a gummi bear attack: http://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_f...

Have we seen this fingerprint reader yet? IBM/Lenovo ThinkPads use a reader that's just a tiny strip, so you actually have to swipe your finger instead of just planting it on the reader. This at the very least defends against simple attacks.

But I mean, a fingerprint is a physical thing which can be cloned, just like a key. And you also leave prints everywhere you go. It's not a silver bullet in authentication. All else being equal, passwords are safer against a determined attack, if we can assume correct usage.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#82

Post by Symmetry »

chrismcb wrote: post #76
rayiner wrote: post #48

This article actually gets the law right, as it stands today. I'm not sure if it's super relevant information, but it's correct. The 5th amendment says: "No person... shall be compelled in any criminal case to be a witness against himself..." Witness is a legal term of art, which refers to someone who gives oral testimony recounting their own experiences. Handing over a key or touching a button is not testamentary an…

Actually they got the law exactly wrong. "If the police demand that you give them the key to a lockbox that happens to contain incriminating evidence" you don't have to turn the key over without a warrant. The police have to have good knowledge that the incriminating evidence in the lockbox. And passwords are just a key. This has already gone through the courts, the courts can impel you to turn over your password, if…

Probably cause isn't hard to manufacture, though. I believe there was a court decision recently that said that a state's drug sniffing dogs still provided valid probably cause even though they would bark whenever their owner wanted them to bark.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#83

Post by r00fus »

coldtea wrote: post #57
crazygringo wrote: post #37

The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not... The fingerprint ID is just another option , which you don't have to use . So titles like this are just incorrect. Fingerprint ID isn't taking away any of your rights, because you can still use the PIN just like you always have . I mean seriously, what the heck is going on here? Why on earth are people getting worked u…

> The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not... The fingerprint ID is just another option, which you don't have to use. That's never how it works. Today it's "just another option", a few years down the line it's mandatory. And "not having to use" does not equal "people will not use it unless they are fully aware of possible consequences" anyway.

Save your vitriol for when it finally happens then (my guess: highly unlikely).

There is no slippery slope here. You think Android manufacturers blindly follow where Apple leads? At the very worst Apple will sign iOS's death warrant at that point.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#84

Post by matthewmcg »

rayiner wrote: post #48

This article actually gets the law right, as it stands today. I'm not sure if it's super relevant information, but it's correct. The 5th amendment says: "No person... shall be compelled in any criminal case to be a witness against himself..." Witness is a legal term of art, which refers to someone who gives oral testimony recounting their own experiences. Handing over a key or touching a button is not testamentary an…

No surprise. The author, Marcia Hoffman, used to be a Staff Attorney at the EFF and litigated some of their most important civil liberties cases.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#85

Post by adamconroy »

crazygringo wrote: post #37

The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not... The fingerprint ID is just another option , which you don't have to use . So titles like this are just incorrect. Fingerprint ID isn't taking away any of your rights, because you can still use the PIN just like you always have . I mean seriously, what the heck is going on here? Why on earth are people getting worked u…

I think the problem might be that you are secretly 'forced' to use it. What if NSA / govt tells apple to start harvesting all fingerprints of all users

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#86

Post by ars »

Osmium wrote: post #4

In practice, it might have the opposite effect. Currently, 4-digit PINs are (presumably) brute-forceable and the alternative of entering a longer, cryptographically-secure password every time you want to use your phone is impractical, so it doesn't really matter whether you can be legally compelled to divulge your PIN or not. However, with a fingerprint ID, you can now use a cryptographically strong password to encry…

Um, why do you think you can't brute force a fingerprint?

The phone is covered with them, just copy one and use it.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#87

Post by adamconroy »

smith7018 wrote: post #61
crazygringo wrote: post #37

The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not... The fingerprint ID is just another option , which you don't have to use . So titles like this are just incorrect. Fingerprint ID isn't taking away any of your rights, because you can still use the PIN just like you always have . I mean seriously, what the heck is going on here? Why on earth are people getting worked u…

Honestly, I think it's because attacking Apple seems to be in vogue nowadays. Thus, if you have an article attacking Apple, you can guarantee higher click-thru rates. It really makes no sense. Fingerprint sensors have been built into Android phones (Atrix 4G comes to mind) since 2011 and in Windows laptops for many, many years. The sheer amount of articles discussing the Touch ID is actually astounding when you remem…

Attacking apple is still dwarfed by drivel praising apple. It also goes with the territory for any successful entity.

I have been annoyed by people complaining about Microsoft since the 90s. Close to 2 decades of criticising. Turns out they were right.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#88

Post by coldtea »

crazygringo wrote: post #67
coldtea wrote: post #57

Earlier quoted context omitted.

> The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not... The fingerprint ID is just another option, which you don't have to use. That's never how it works. Today it's "just another option", a few years down the line it's mandatory. And "not having to use" does not equal "people will not use it unless they are fully aware of possible consequences" anyway.

> a few years down the line it's mandatory That's just FUD. And saying baseless things like "that's never how it works", that's just fearmongering, not contributing to the conversation. It doesn't even make sense. There are millions (hundreds of thousands? you get my point) of fingerprint readers out there. Suddenly Apple builds one in, an additional feature , and people start inventing conspiracy theories. People ar…

>That's just FUD. And saying baseless things like "that's never how it works", that's just fearmongering, not contributing to the conversation. It doesn't even make sense.

It makes perfect sense -- you just need to follow the historical precedents, instead of looking for some inevitable logical reason why that would happen.

Technologies introduced with the potential to control and restrict people (or users) have always expanded their scope and reach.

CCTV was something banks used. Now it's all around modern cities. GPS tracking was once something exotic. Then millions could be tracked through their mobile phone. Then you even get people voluntarily participating in "location aware" services, transmitting their location 24/7. Walled garden software was few and far between all through 1980-2010. Now it's the sole standard on iOS, de facto on Android, and has crept in desktop OS too. There are tons of similar examples.

>There are millions (hundreds of thousands? you get my point) of fingerprint readers out there.

There were also "tens of thousands" of tablets before the iPad. Still noone cared about them. Mass sales are an enabler. It's another thing for "hundrends of thousands" (far fewer, I'd say) fingerprint readers to be out there in places and devices noone sees excepts when he travels or if he works in some special places that use them for security, and another thing to have fingerprint readers on 1 out of 3 or 4 americans (the iPhone market share IIRC).

>Suddenly Apple builds one in, an additional feature, and people start inventing conspiracy theories.

I don't care much about conspiracy theories (and I dislike the use of the term to ridicule legitimate concerns, as if we were talking about fake moon landings or UFOs). This comment thread was about some not far-fetched potential implications.

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#89

Post by DanBC »

crazygringo wrote: post #67
coldtea wrote: post #57

Earlier quoted context omitted.

> The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not... The fingerprint ID is just another option, which you don't have to use. That's never how it works. Today it's "just another option", a few years down the line it's mandatory. And "not having to use" does not equal "people will not use it unless they are fully aware of possible consequences" anyway.

> a few years down the line it's mandatory That's just FUD. And saying baseless things like "that's never how it works", that's just fearmongering, not contributing to the conversation. It doesn't even make sense. There are millions (hundreds of thousands? you get my point) of fingerprint readers out there. Suddenly Apple builds one in, an additional feature , and people start inventing conspiracy theories. People ar…

I agree that people are making idiotic claims

But did you know how many fingerprints are currently being gathered and kept by US government?

Here's a 2008 article. (http://www.reuters.com/article/2008/03/25/us-security-finger...)

They take a lot of fingerprints, but don't seem to catch many people.

> The U.S. government has been collecting digital fingerprints and photographs of nearly all non-citizens aged 14 and up entering the country since 2004, officials said, in a Homeland Security program called US-VISIT, at a cost of $1.7 billion.

> [...] On an average day, almost 14,400 international visitors undergo the fingerprinting process at Kennedy, officials said.

> More than 2,000 criminal and visa fraud cases have been detected by the screening process, introduced in response to security concerns following the attacks of September 11, 2001, U.S. officials said. Roughly they've scanned fingerprints for 36,792,000 visitors (who may be repeat visitors), and caught more than 2,000 people. (Between 2001/9/11 and 2008/9/11.)

Re: Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’

#90

Post by rralian »

Seems like simply combining the fingerprint with some sort of quick gesture could get around this. They couldn't force you to try all possible gestures any more than they could force you to try all possible combinations of a lock (example taken from the article).
Post reply on HN