Further advice regarding civil disobedience:
LEAVE YOUR PHONES AT HOME. Write down some numbers in case you get arrested—or better yet, memorize them. There are journalists there for documenting. And there will be plenty of other people that don’t follow this advice. Leave anything they could use as leverage over you and your cohorts away. Don’t bring ID. Don’t bring anything except what you need for the action. It’s not worth the risk.
ETA: also, any of you with a new car? DONT DRIVE THAT SHIT TO ANY MEETING OR PROTEST. They’re spying on you. Don’t post about it. Don’t use any unencrypted messaging service to coordinate it—WhatsApp is not safe. Signal and probably some other less common ones are the only ones safe enough. Ride a bike there, stash it in a conveniently hidden spot. Bring a change of clothes, plan escape routes, plant the change of clothes either hidden on your escape route or wear them under your plain clothes. Cover tattoos. Leftist activists are not safe. And literally the rest of your life could depend upon how well protected you have made yourself.
https://www.theguardian.com/us-news/2022/feb/10/felony-charges-pipeline-protesters-line-3
So many states have pretty quietly passed laws to make you a felon for protesting. Even peacefully. And to make you a fuckin corpse. In the south especially, a few states were writing “go ahead, run over any protester in the road” laws.
Be smart. Be safe. Have a plan. Have a contingency plan. This isn’t “fuck around with the blunt end of the justice system and find out” territory, in 2024 US, it’s time to be as safe as you can while doing what’s right. Because doing what’s right is criminalized. Heavily.
If you’re going somewhere where you think you might be at risk, IMHO, it’s probably just easier to turn your phone off. Android and iOS both require a non-biometric passcode after boot.
Or, if you want to keep your phone on, enable lockdown mode on Android, or tap power 5 times on iOS to require a non-biometric password at the next unlock.
It’s never a good idea to bring your phone with you. It can be used, even while powered off, to track and surveil you. The BLM protests were just the tip of the iceberg. The apps you have on your phone track you. The government is buying that tracking data. Your phone is a massive privacy weak point. It’s basically a bug you carry on you willingly. It’s not safe. Period.
https://www.vox.com/recode/22565926/police-law-enforcement-data-warrant
Leave your phone at home. It’s not worth it. It may not bite you in the ass the day of, but could very easily come back to haunt you after they investigate, in case anything goes “wrong” in their eyes. It’s just not worth it.
IMHO, as someone that works in security / privacy, I tend not to view it as a binary thing. It depends on where you live, what you’re protesting, what you look like, who you are, etc.
Are you in Russia or China and are protesting the government? Yeah, I might leave that thing at home. Are you a white lady in San Francisco marching with a pink knit cat hat during brunch hours, then you’re probably well on the other side of the risk spectrum. You might actually be introducing more risk by having less immediate access to communication or a camera.
IMHO, it’s nuanced.
The problem is that the people doing the surveillance are hardly going around honestly telling people what’s their surveillance profile.
For example in the UK that “pink knit cat hat white lady” would very likely be under surveillance if she was a member of the Green Party and participated in demonstrations. In fact, recently a number of cases came out where in the 80s and 90s the police had infiltrated Ecologist groups and even left some of the women in those groups pregnant with the children of men they late found out were undercover agents.
Further, the lower the barrier to entry to surveillance the lower the “threat profile” needed to end up under surveillance: if the authorities have already have well established and commonly used processes backed by ultra-broad surveillance court (or whatever those courts are called in your country) orders to just get from the mobile network providers all the phone numbers that connect to specific cell towers during a specific time period (such as the ones nearer a demonstration during that demonstratiom), pink knit cat lady is going to end up in the list just as easilly as baclava-wearing hard-core anarchist looking to break stuff.
They might not hack the pink knit cat hat lady’s mobile to install eavesdropping software, but she’s still in the list for every demonstration she attended carrying her phone and for the authorities finding out those who were at multiple demonstration and cross-searching with other databases to resolve those numbers to actual identities is pretty easy unless those people jumped through hops to keep those things disconnected (which, funny enough, smart anarchists are more likely to have done than your average pink knit cat hat lady)
I agree with your point, but balaclava is the hat, baclava is the delicious Greek pastry.
We take on risk every time we decide to wake up and start the day.
I live in a place where I’m considerably more likely to get hit by a car while walking than thrown in jail as a political prisoner. That doesn’t mean I’m never going to go for a walk. I’m going to live life.
Leaving my phone at home seems pretty silly when the risk is very low in my nation and I do riskier things while cooking dinner.
Oh, in day to day usage I agree with you: we’re all one little uninteresting datapoint in a whole lot of datapoints and there are plenty of other ways in which we are tracked.
However if you’re part of a Political Party or Movement and/or attend demonstrations, it’s probably wiser to leave the phone at home, if only because that makes you stand out as a much more interesting datapoint than average.
It can be used, even while powered off, to track and surveil you.
How? The only legit thing I can think of is if they are tracking you anyway, and then they see your phone is turned off, they might try to claim that you must be up to something. But they won’t be able to track it while it’s off.
If you can’t take out the battery, it’s never actually off.
That’s not quite how it works, though. These devices are basically mini computers now, there’s a limit to what they can do without fully booting. Devices that are plugged into the wall might be likely to retain some power-draining function while plugged in, but there’s only so much you can do on a trickle charge while a phone is powered off.
They’re still running in low power mode and can wakeup from the network so they can absolutelly be made to “boot up” without turning the screen on and you being aware of it.
This is not like a bloody PC were the lights turn on and you can hear the fans when the thing starts, it’s a machine with a low power mode in which it can already do a lot and which can be brought to a high power mode if needed without there being any visible or audible side-effects to alert the user.
Unless you completelly cut it off from power (by taking the battery out, which you can’t in most modern smartphones) that smartphone with the lights off, the screen off and making no sound at all can just as easilly be in low power mode waiting for you to press the On button, as it can be in full power mode with a mobile network connection active, accessing the microphone and the GPS microchip and sending that data out, and both will look exactly the same from the outside.
I think you are overestimating what these devices can do when turned off, specifically when whoever is doing the tracking wants to be covert. Devices like Cellular Radios and GPS chipsets are getting more efficient every year, but they still consume enough power that it would be noticed if they came on by themselves even if the device was off.
I think the fact that we are able to record everything that happens and automatically upload it seriously outweighs what you are saying.
The only reason cops get in trouble is only because people are filming. If it’s not caught on camera, it didn’t happen in the eyes of the law if it’s just our word against a cops.
Maybe get a dumb burner phone with no personal data on it. You could potentially keep your main phone in a secret/secure pocket.
keep your main phone in a secret/secure pocket.
Terrible idea, it will be found with absolute certainty if you’re arrested.
No. Several Jan 6 participants tried burners and they still got caught because the burners were still linked to their movements and activities and their personal phones were unusually unused/off/immobile for the amount of time the burners were used. You would have to expend a lot of effort to make sure your burner was completely disconnected from yours and your phone’s location, as well as making sure your phone showed signs of appropriate activity in your absence.
Not so easy.
Just having a burner phone works against dragnet surveillance if one is not doing really stupid shit like logging in to one’s personal social media accounts from one.
If however it’s an actual crime which actually gets investigated by actual criminal investigators, they’re going to be coming at it individually and using much more specific techniques than just “use a surveillance warrant to get a list of all mobile phones that connected to certain cell towers at certain points in time and plonk them all on a database to cross-check with similar data from other demonstrations”.
You can’t just treat a burner phone as a second phone that you have active anywhere near your home, place of work or places you normally frequent and you can’t just keep it and keep on using it for a long period of time: the longer one holds on to that burner phone the more data points there will be that can be bulk checked with other, identifyable, data from other sources (say, car tracking data) to find out a more than normal overlap.
I wouldn’t at all be surprised if those people with the burner phones had them with them active whilst ridding their personal vehicles which had something like OnStar or were dumb enough to log-in to their Facebook account from them.
Last week, the 9th Circuit Court of Appeals in California released a ruling that concluded state highway police were acting lawfully when they forcibly unlocked a suspect’s phone using their fingerprint.
You can turn that and Face ID off on iOS by mashing the power button 5 times- it locks everything down.
⚠️ WARNING: On android, mashing the power button 5 times calls emergency services…
On android you can add a ‘lockdown’ mode to the power menu.
on my phone lockdown mode is found by pressing side button and power up at the same time, then selection lockdown from the menu
There are two ways you can do this on Android currently, but they’re not as quick. You can try to unlock with the wrong finger 5 times and it will stop allowing fingerprint unlocks. Or, you can hold down the power button for 10 seconds and the phone will reboot and also disable fingerprint unlocking.
Not on my Pixel 6. 🤷♂️ It just does what I told it to do, namely to open the camera.
Edit: these are some Reddit down votes. I just didn’t know I had this feature, and I apparently have disabled it, but I don’t remember doing so. Oh well.
Cool, you disabled the gesture. Clearly the default SO setting doesn’t apply to you…
I didn’t even know it existed. I had to search to find the setting, but I see it exists on my phone and it’s disabled. I don’t recall disabling it though.
Have to tried? On my Samsung pressing twice does the camera (as I’ve set it to) but doing 5 times tries to call emergency services.
They disabled it . I don’t understand why they even commented. It reads like some weird flex
I don’t know how it sounds like a weird flex. I was just asking. I don’t remember if it was something you could disable or not from when I had my pixel 5.
Right, correcting your incorrect information is “weird flex”. What are you, five?
On my Mi Max 3 it does not work as well. In “configure buttons” section of menu there is no call emergency number action, neither is there press [any button] five times trigger available. So clearly the function your phone has is not universal. What a wild world do we live in!
Thank you for defending me. ❤️ They were correct though. Apparently I had the setting disabled, but I don’t remember doing so. Must have been years ago on another phone? And then carried over when settings migrated? I don’t know when this feature was introduced. But yeah. It’s a thing.
But obviously not universal if you don’t have it. Which Android version are you on?
Which Android version are you on?
10 qkq1.190910.002
I didn’t even know it existed. I had to search to find the setting, but I see it exists on my phone and it’s disabled. I don’t recall disabling it though.
It’s not a flex… 🙄 I was just confused about how it seemed so established that this was an “Android” feature, so should be activated on my phone too, but it isn’t. And now that I see I have the functionality disabled but people say it’s the default, I’m even more confused because I don’t remember even seeing this setting. 🤷♂️
I did, yeah. Gotta test before commenting, of course. I see I have the setting disabled for some reason. Don’t recall disabling it though.
I’ve always wanted a setting to create a lockdown key and an unlock key. So something like middle-finger to unlock but index-finger to force it into PIN/password only mode. So you can have some convenience of a quick unlock but if an authority figure asks or forces you to unlock it you can one-tap lock it down.
That would be awesome.
In GrapheneOS, a single wrong fingerprint disables fingerprint unlock until the password is entered.
Android has a similar feature. It’s called “Lockdown mode” on the shutdown menu. Locks the phone and turns off any biometric unlocks.
Except it doesn’t activate by mashing the power button 5 times. On my Pixel 8, that activates the emergency dialer that will automatically call 911 if you don’t cancel the prompt in 5 seconds. I did not know that before. Probably a better use for that feature. It also points out the different ideologies of Apple vs Android.
It does the same thing on iOS, but face/Touch ID is disabled after.
You can turn off the 911 “feature.” Don’t ask me how I know 😅
On iOS, for SOS, Medical ID, and “slide to power off” you hold power and a volume button. That also disables biometric ID.
My wife’s pixel 3(?) with a flaky power button had us wake up to cops knocking on the door because of that feature.
You can turn it off somewhere in the settings
Yeah, I poked around in the settings that afternoon to make sure it didn’t happen again.
I was mowing my lawn and learned about that feature. A nice ladies voice came through my bluetooth headphones asking if I needed help lol. You can change what the button spam does and I changed it to call my mom instead.
On my Pixel 7 Pro, I press the power and volume up buttons simultaneously, then I can click Lockdown. Now my passcode is required to unlock the phone.
On my ditto (running GrapheneOS), the Lockdown option is accessible through the regular power button menu. When I press power+volumeUp it switches to silent mode. I don’t know if/where I changed this, since I can’t find the options when searching in settings.
EDIT: I just found it - in Settings > System > Gestures > Prevent ringing. I can either set power+volumeUp to mute the phone, or vibrate only. Nothing about the Lockdown option, but having it in the regular power button menu is good enough for me.
If by “regular power button menu” you mean holding the power button for a couple seconds, that was changed at least on pixel devices to bring up some bullshit called “Gemini”, some AI from googie that I never got a chance to say no to. Power + volume up is now how we get to the power menu, because of course they would change the function everyone uses occasionally to a more obscure combination without notice
“Oh shit, what’s happening? NO NO NO!”
Yup, can confirm.
Push and hold to get the power menu on my 7.
On my 8, that just activates the Google assistant. To get to the power menu, you have to press power (oddly named button, to be honest) and vol up at the same time. But these are active acts that you have to think about and verify to make sure they did what they are supposed to. Mashing the power button 5 times is succinct. I don’t have to guess how many seconds I’ve waited. I don’t have to feel to make sure I’m hitting the vol up instead of vol down accidentally. I count 5 times, 6 to make sure, and I can drop it while being certain that it’s going to call 911. That’s what I want in an emergency. A quick distinct action that requires no guessing to make sure it works. It makes sense once you stop and think. Nothing else about the power button makes sense, but at least that part does.
Try system - gestures - press power button. I have the choice of the power menu or the digital assistant.
I actually didn’t know that was changeable, one of my most hated “features” of my phone that it wants to bring up an AI assistant I’ll never use and didn’t ask for when doing something that has brought up the power menu on every phone I’ve ever owned
In a getting pulled over situation, this works. But do it before you go protest anything. Or better yet, leave your phone at home. You don’t want to be reaching for something while a cop is pointing a gun at you and saying “Hands up!”
Not to mention it’s pretty regular to track who is participating by checking the towers in the zone all the people are participating.
Or get a geofence warrant
☞ EFF / Surveillance Self-Defense / Attending a Protest
That’s terrifying. So once we have tech to forcibly see inside the brain, that will be legal too?
“You shouldn’t be worried if you have nothing to hide” 🤷♂️
Tap for spoiler
/s
You think it wouldn’t xD?
Probably. Wouldn’t it be good to have the truth during investigations?
However I think that we really need refine when warrantless searches can occur. Right now many searches seem to be done with very little evidence to justify them. I think this protection should apply to your mind and phone just like it applies to your house. This probably also needs to be considered at border crossings. Right now they have basically unlimited rights for searching what you have on you with little to no evidence.
We should probably also rethink about how the information is shared when there is a warrant. Right now during a trial a huge amount of personal information can be made available. Maybe if it was easier to get precise information less would be needed.
Wouldn’t it be good to have the truth during investigations?
Well, yeah, but the mind is fallible. That’s why eye witness testimony usually only gets a case so far, people tend to forget specifics and fill in the gaps without realizing they did.
Do you have to mash it? Or will pressing it normally work?
The only thing I’ll mash is that subscribe button
Pretty sure Apple would replace the buttons with pressure sensors – not for user comfort but so that they are no longer replaceable with OEM parts and can be serialized. They did literally this with Macbook sleep sensors.
You can also just long press a volume button with the lock button (with a FaceID phone). I find this harder to mess up under stress.
The article pretty plainly says the guy was coerced into entering his password. So the headline feels a bit manipulative.
The headline is click-bait. I honestly don’t know why people still read this crap.
So he was “only” coerced, ie likely verbally abused and lied to (which cops are allowed to do) about the consequences of refusing to unlock, instead of being physically forced. Such freedom.
What’s that got to do with using a thumb to unlock the phone?
“The general consensus has been that there is more Fifth Amendment protection for passwords than there is for biometrics,” Andrew Crocker, the Surveillance Litigation Director at the EFF, told Gizmodo in a phone interview. “The 5th Amendment is centered on whether you have to use the contents of your mind when you’re being asked to do something by the police and turning over your password telling them your password is pretty obviously revealing what’s in your mind.”
Sure, but what does your original comment have to do with the thumbprint?
It’s Gizmodo. I’d all manipulative bullshit.
Lemmy quality descended quite quickly. What’s the more intelligent tech community alternative besides hacker news?
It seems everything descends into this samey mess of america bad, eat the rich which I don’t dispute with but I am here for tech and not politics honestly. Time and place for everything.
The amount of low effort comments that seem to only be about points/validation which aren’t even visible for some is tiring.
It used to be that you would look into comments for useful information about the posted article. Now you can skip the comments altogether and the posted links quality also became questionable.
I miss times where you could find links to some niche but full of creativity/usefulness websites in the comments or posts. Those juicy gems of the web. Or learn some fact that you had no idea about.
I want to learn something new being here. Not make my brain feel good with the reward of validation.
Probably because America bad, eat the rich.
and this is why lemmy is a limp-wristed do-nothing. too many people here want to stick their head in the sand. but by all means, pls share some more star trek memes.
I mean I have curated my ‘All’ only to non world news and non memes comms and I was left with literally nothing except this community. There is literally nothing here :/
I will still keep using it whenever I can though just out of principle and to curb some of my Reddit addictions.
I am sorry to say nowadays 95% of content appears to be meaningless. Not contributing anything, not creative, not even funny lots of the times. I won’t sugar coat this
but tech news ad nauseum is ‘meaningful’. lol okay.
See I have this weird feeling that we are too different to even connect somehow. You didn’t even read my comment. Any benefit of doubt of mine is pointless when you just throw some out of place, bland one liner and don’t even want to discuss anything. It’s like talking to a wall
I don’t want to have a discussion. I want to unify a disgruntled public so we can make change for the better. Get friends if you just want to have a discussion. All I’m here to do is to get you to say it with me:
EAT. THE. RICH.
However, the panel said the evidence from his phone was lawfully acquired “because it required no cognitive exertion, placing it in the same category as a blood draw or a fingerprint taken at booking…"
If the precedent is that unlocking the phone is the same category as fingerprint taking, well, what happens if you refuse to be “coerced” into having your prints taken? Even if the legal precedent isn’t fully understood, it looks like the reasoning here isn’t based on whether there was physical force applied, but whether the search required the contents of the person’s mind.
I do t know about fingerprints but I thought a blood draw required cooperation or court order
In many (if not most) US jurisdictions, operating a vehicle under a driver’s license specifically implies consent to a blood draw when under suspicion of impaired driving.
Maybe don’t live in a fucking dystopia. The US is a police state and you have no freedom left.
You do have the delusion of it though. It may not be real but if you want it to be you can work hard for money that was never real to begin with.
The more of those Talisman you handle the more magick will save your life til your labor is done with.
While I buy you’re general cynicism, it’s wrongly applied here …
It seems like we have both more and less protections than other places, for this instance.
- while it’s not entirely settled case law, you can NOT be compelled to give up your passwords. Different states differ and they’re constantly trying
- however biometrics are counted as public knowledge, so you have no protections
This is more of a scenario where legal contortions turn into huge inconsistencies, plus our legislature has refused to clarify so it’s all on the court system
It’s frustrating to no end that fingerprints and face ID are treated like passwords when they should be treated like usernames.
That makes a lot of sense !
They make sense as a 2FA. It would be really cool if I could require either PIN+fingerprint or a long recovery password.
Why does this comic always give me Lain vibes
## How to disable Face ID through the Power Off screen
- Hold down both the Side Button and either Volume Button at the same time for three seconds.
- The Power Off slider should appear. Tap Cancel.
You actually don’t need to hit cancel, you can just hit lock, so you can do this whole thing with your phone in your pocket.
https://appleinsider.com/inside/iphone/tips/how-to-quickly-disable-face-id
This is easier and less intrusive than the lock-button-5-times method because it doesn’t start making a phone call that you have to quickly cancel.
This is the advice people (with iOS) should follow, not disabling biometrics altogether. Using FaceID or TouchID prevents shoulder surfing to find out what the password to your phone is. When local passwords have so much control over a device, using biometrics to prevent anyone from seeing what your passcode is is very useful.
Those settings can also be altered under Settings > Emergency SOS
FYI Androids have a feature for this. If you are ever forced to interact with a cop you can press the side button and volume up(might be different on other phones) to select lockdown which will force your phone to only be opened with the password. Its gross that we need this feature, but now you know.
It’s good that they have this, but there are a lot of situations involving cops where it’s not going to be safe to stick your hand in your pocket. I’ll just leave the biometrics off on my devices.
iPhones also have this feature, for a long time now:
https://ios.gadgethacks.com/how-to/keep-law-enforcement-out-your-iphone-your-privacy-intact-0194999/
Rather irresponsible of the article to not point out these features on Android and iPhone. Did a cop or government official write that article?
You can instead hold the power button for 1 second to open the same menu. Feels easier to me.
Yeah, but I want a combo that force starts the feature. I want to pull out my phone and be able to blind start it, not stare at my screen to select the correct thing.
On pixel, if you ever need to - press and hold the power button, select “lockdown”.
(It might apply to other androids too, I don’t know.)
You will now need a pin to unlock the phone. This disables the lock screen shortcut (camera, light, etc) as well.
Why disable your convence features for an scenerio that is not likely and can be quickly and easily be prevented.
Universal: You could also just the tap the sensor with a “wrong” finger a few time, and the pin will be required.
Maybe don’t do this one in front the cops…if you find your self in a postion where they are trying to unlock your phone, you probably don’t want to piss them off. .
Edit: I’m surprised no one called me out on “if you’re ever need to”. The sentence was going to be “if you’re even in a situation that needs…”, but that was getting too long. Forgot to change you’re to you.
On iOS just rapidly press the power button five times and it enters its lockdown state.
The Pixel fingerprint scanner is so bad, you could end up locking it entirely by accident.
Behind-the-screen fingerprint scanners are an abomination.
My 5a sensor is fantastic (it is on the back). I’ll be sad when it’s time for this phone to go.
Behind-the-screen fingerprint scanners are an abomination.
Always reminds me of 1984’s telescreens. We’re almost there.
Mine works without issues since I removed the white circle and the unlocking animations.
Not my experience. They are usually instant, but you need a flagship device, of course. Otherwise it’s comparing apples and oranges.
First gen in-screen scanners were absolute trash. Borderline unusable. But the tech has improved quite a lot since the first ones. The one in my galaxy tab s9’s screen is fast and accurate.
On my pixel 6 it is power + Volume Up to access the power menu with lockdown.
I also have a pixel 6 and holding down power also works, though you have to wait a second. Power and volume up is instant.
My power button long press only activates Google assistant, it never pops the power menu. Maybe it’s a setting somewhere.
Oh, yeah I think you’re right. I think I might’ve changed it at some point.
Just checked and it’s under system > gestures > press and hold power button
This was new info to me! Can confirm it works on a Pixel w/ GrapheneOS
It’s from AOSP, so any device close to the actual Android baseline should support that. This means that you can enter that mode from LineageOS as well.
A stipulation of Payne’s parole agreement was that he be willing to provide a passcode to his devices, though that agreement didn’t explicitly refer to biometric data. However, the panel said the evidence from his phone was lawfully acquired “because it required no cognitive exertion, placing it in the same category as a blood draw or a fingerprint taken at booking, and merely provided [police] with access to a source of potential information.”
These both seem like bad calls. You have a right to privacy, right? And for police to access your files/home/phone tap requires obtaining a warrant.
Fingerprints at booking gives access to public records. Not your own personal private data. Pretty sure drawing blood is justified suspicion of DUI.
Yes and no. When you take parole, you agree to give up some freedoms in exchange for getting out of prison early. For example, taking drug tests, checking in with your parole officer, or not leaving the state/country. If your crime was related to using a phone or something, like being a drug dealer, then it can make sense to have to allow your parole officer to check it.
So after you have been convicted of a crime, you will have restrictions based on that crime. That’s a world of difference from pulling over Bob and forcing him to unlock his phone.
I’ve avoided willingly using biometrics so far. Though I’m sure our faces, gaits, body shapes, etc, are all stored somewhere, willingly or not.
Say no to biometrics. It’s like having a password you can never change.
So, it really depends on your personal threat model.
For background: the biometric data doesn’t leave the device, it uses an on-device recognition system to either unlock the device, or to gain access to a hardware security module that uses very strong cryptography for authentication.
Most people aren’t defending against an attacker who has access to them and their device at the same time, they’re defending against someone who has either the device or neither.
The hardware security module effectively eliminates the remote attacker when used with either biometric or PIN.
For the stolen or lost phone attack, biometric is slightly more secure, but it’s moot because of the pin existing for fallback.The biggest security advantage the biometrics have to offer is that they’re very hard to forget, and very easy to use.
Ease of use means more people are likely to adopt the security features using that hardware security module provides, and that’s what’s really dialing up the security.Passwords are most people’s biggest vulnerability.
I’ve read all this before. If you believe the people who designed and implemented the device and its myriad layers of firmware and software were 1. All acting in good faith and 2. Knew WTF they were doing… then: yes, sure.
Unfortunately that’s way too many strangers for me. Hundreds of people design and code these things. Meanwhile, every week there’s a clever new breach somewhere.
While I do respect that viewpoint, there’s a lot more independent scrutiny of the hardware modules than there are around the parts that would handle any other authentication mechanism you might use.
Pixel phone example iPhone example
Just because something isn’t perfect doesn’t mean we should keep using the less good thing that it replaces.
Use the PIN if that’s more your cup of tea, just so long as you move away from passwords, since it’s the HSM that’s the protection, not the biometrics. Those are just to make it easier than passwords.
You can change PINs and passwords, but you cannot change your biometric data.
It’s about as smart as using your SSN as your username.
The point being that most people do not need to ever change their biometric data, because it isn’t used for remote authentication.
It’s about picking the right threat model, and for most people anything that gets them using the HSM is an improvement to their security.
If you’re that afraid if the people who build phones, why are you ok with using any device that can access the internet?
I like how being cautious with my biometric data is beung framed as irrational fear and paranoia. As if ID theft never happens.
Password you can never change
Not with that attitude! You can absolutely change your face. its rather inadvisable
Face… off…
Same here. Still using the pattern lock. I’ve never used fingerprint not to even mention face scan.
it’s not a password; it’s closer to a username.
but realistically it’s not in my personal threat model to be ready to get tied down and forced to unlock my phone. everyone with windows on their house should know that security is mostly about how far an adversary is willing to go to try to steal from you.
personally, i like the natural daylight, and i’m not paranoid enough to brick up my windows just because it’s a potential ingress.
It’s not a great analogy. Your house and its windows are exposed to your neighborhood/community. Your internet device is adjacent to every hacker on the web.
it’s an analogy that applies to me. tldr worrying about having my identity stolen via physical access to my phone isn’t part of my threat model. i live in a safe city, and i don’t have anything the police could find to incriminate me. everyone is going to have a different threat model. some people need to brick up their windows
Assuming the phone’s security works as intended, what you’re saying is true. However, it’s a legit concern that the security is not airtight, and physical access is not actually required to harvest your biometric data.
I know the phone manufacturers make all sorts of claims about how secure biometric data is, but they have a profit motive to do so. I’m not being brick-up-my-windows paranoid by pointing out all the security failures and breaches we’ve seen over the years. Companies that have billions on the line are still frequently falling short at securing their own assets, much less their customer’s data.
I understand biometrics are convenient, and many folks love the ease / coolness factor of using them. Just don’t kid yourself that it’s secure by requiring your physical phone. Once the dark web has a digital copy of your biometric data, it’s compromised forever.
First provide proof that you can pull out biometric data out of a secure element in a phone.
That’s not retrieving the biometric data from the device, that’s retrieving the biometric data from surveillance or physical interaction.
It’s quite specifically the type of threat that most people do not need to worry about.
Sucks to be american. Sucks to live in america.
Why would anyone?
This is a dumb question. Almost 50 million people live in Sudan where there’s an ongoing famine. 70 million people live in UK where mass surveillance is roughly state supported. Asking why 300 million people don’t just move is … stupid
The difference is that people from the US and UK are generally welcommed in other countries. People from Sudan have a much harder time being let into other countries
As tourists, sure. But getting a work visa/residence permit is not as easy as you think.
And second of all, what do you expect? An entire country to up an leave? That’s stupid beyond measure. Won’t that entire country elect the same government wherever else they end up in?
LOL
1- Its correct that its not easy to get a residence permit, but it is a lot easier if you are entering from the US/UK than if you are coming from Sudan.
2- I don’t expect people leaving the US, to want to live like they did in the US. So assuming that they would want to create a similar life outside the US is kind of childish, and not even possible in most countries.
That said, it’s a figure of speech. You’re taking it too far and too literal
None of the cool countries are going to let massive amounts of Americans immigrate to them and nobody wants to go somewhere worse.
I live in the UK. A judge can compel you under Section 49 of the Regulation of Investigatory Powers Act 2000 to hand over any passwords for any devices or services they reasonably believe you have possession of the passwords for.
If you don’t then you can be imprisoned for up to 2 years for normal crime or 5 years for crimes relating to national security or the production, possession or dissemination of CSAM
I’m very glad I had the opportunity to leave. Being bilingual makes it a lot more feasible.
I really think this depends largely on who you are and what you do with your phone. I have face recognition and fingerprint recognition both enabled on my phone. It’s good enough to prevent a thief from gaining access to my device, and if law enforcement asked, there’s nothing on my phone that could possibly be incriminating. Realistically, I’d have no issue just unlocking my phone and giving it to a police officer, although I do know well enough to always get a lawyer first. Biometrics add an extra layer of convenience; it’s nice to just look at my phone and it unlocks. My concern personally is more about someone stealing my phone and accessing my accounts than self-incrimination.
If I ever was going to put myself in a situation where I’d run afoul of the authorities, I’d leave my phone at home anyway.
For Android: learn the hard reset combo for your phone, especially if you encrypt it.
After rebooting, pattern/PIN will be required to decrypt the phone. Biometrics won’t work for this step. This is what graphene does for security, tries to keep the phone in a “before first unlock” state by rebooting on a timer. You can’t even read anything over USB/ADB, it’s scrambled until you unlock the phone.
The only drawback to just keeping your phone in this state is none of your apps are loaded, so no notifications/updates/processing at all.
Just power down your phone. No phone allows initial unlock with bio data
You don’t even need to do that. You can go to the power down menu on Android 14 and select lockdown. Even from the lock screen without unlocking the phone.
This is the best summary I could come up with:
Last week, the 9th Circuit Court of Appeals in California released a ruling that concluded state highway police were acting lawfully when they forcibly unlocked a suspect’s phone using their fingerprint.
The case didn’t get a lot of coverage, especially because the courts weren’t giving a blanket green light for every cop to shove your thumb to your screen during an arrest.
The ruling was also complicated by the fact that Payne was on parole at the time, back in 2021, when he was stopped by California Highway Patrol where he allegedly had a stash of narcotics including fentanyl, fluoro-fentanyl, and cocaine.
However, the panel said the evidence from his phone was lawfully acquired “because it required no cognitive exertion, placing it in the same category as a blood draw or a fingerprint taken at booking, and merely provided [police] with access to a source of potential information.”
The Electronic Frontier Foundation, a digital rights group, has offered guides for best practices when attending protests, and one of those is to turn off your thumbprint or face unlock before you hit the street.
“The general consensus has been that there is more Fifth Amendment protection for passwords than there is for biometrics,” Andrew Crocker, the Surveillance Litigation Director at the EFF, told Gizmodo in a phone interview.
The original article contains 988 words, the summary contains 217 words. Saved 78%. I’m a bot and I’m open source!
