Stop Using Your Face or Thumb to Unlock Your Phone

https://gizmodo.com/stop-using-your-face-or-thumb-to-unlock-your-phone-1851438205

by rntn • 2 years ago

32 38 2 years ago

tedunangst• 2 years ago

No.

jsheard• 2 years ago

Even if you don't want to give up the convenience in general, it's good to know that if you're in a situation where you're likely to be arrested then if possible you should reboot your phone, or press the lockdown button if it has one, so that biometrics are disabled until you provide your PIN/password.

wrs2• 2 years ago

Observation: If you click the power button of your iPhone five times quickly, it will require a passcode on the next unlock. It’s easy to do that by accident when you’re nervous.

frizlab• 2 years ago

If you long press the power and volume down button too (as soon as the UI to shutdown the phone appears).

Five-times pressing is disabled by default now IIRC, and call the authority when enabled.

wrs2• 2 years ago

Good point, the defaults have been evolving. Check “Emergency SOS” settings and adjust to taste.

mingus884• 2 years ago

If you are about to be confronted by a cop:

On iOS, click the lock button five times. The biometrics reset. A passcode is required.

If you are about to cross a border:

Power your phone off. On iOS this clears any keys stored in the Secure Enclave and it’s much harder to get a forensic image.

user_7832• 2 years ago

I often hear about such things, I'm curious, has anyone here on HN experienced such a thing (or know of someone who did)? At borders I might imagine wanting to check your devices if you're coming back from say some place in central Asia, but how common are random police seizures? (I'm not from the US)

mingus884• 2 years ago

In today’s climate of protests this is something everyone needs to know. Police will detain and drop charges the next day simply to clear the area, and in the meantime they can seize your devices and look through them.

In the US, border patrol has a 100 mile jurisdiction from any border. Practically this means they can seize your devices with no pretext at all, and 5th amendment protections do not apply here.

That means anyone in San Diego, San Francisco, Los Angeles, Seattle, etc can have their devices imaged and confiscated for any reason at all.

I don’t know of anyone who has had this happen but given everything going on in the world right now I wouldn’t be surprised in the least if next year we start seeing it happen everywhere

detourdog• 2 years ago

One can also hold the power and either volume for a second or two and that will lock your phone and display SOS or shutdown screen.

idle_zealot2• 2 years ago

Note that pressing the power button 5 times on a Samnsung phone calls 911 rather than lock your phone. To lock an android phone like this you need to bring up the power menu and select "Lockdown mode". The only way I'm aware of to bring up the power menu is to hold the power button, and the default seems to be to not show the lockdown button; it needs to be enabled in settings. Also, by default holding the power button brings up a voice assistant rather than the power menu, leaving no way to access the power menu at all, so this needs to be changed to show the power menu in settings as well. And even after all that configuration you need to be looking at your screen to hit a little touch target to trigger a lockdown. This seems like a really poorly thought out panic button.

neilv• 2 years ago

And on current GrapheneOS:

* Lockdown (require PIN to unlock) -- Hold power button 1 second, then tap Lockdown icon on screen.

* Call 911 -- Click power button 5 times, then don't slide to cancel in the 5 second delay.

* Camera -- Click power button 2 times. (If you invoked this while at lockscreen, you'll be restricted to Camera and recent Gallery, AFAICT.)

So, if you're at, say, a heavy-pickpocketing tourist attraction, or high-risk mugging neighborhood, then you might switch your phone to Lockdown, and use this restricted Camera mode when you want to take photos. Then someone just grabbing the phone will still get the phone, but at least not likely be able to access your accounts. (Though, if they try to force your finger or face to the screen, then you might need to calm them down, as you type in your PIN.)

chuckadams• 2 years ago

On iOS, holding the power button also brings up Siri, but holding power and either volume button brings up the shutdown screen. Does this not work on android, or is it another one of those vendor-specific things?

40180923• 2 years ago

On iOS this clears any keys stored in the Secure Enclave and it’s much harder to get a forensic image.

Are you sure about that? I've been able to power on my phone without any connectivity and still access my keychain passwords, which should be locked behind a key in the enclave.

kkfx• 2 years ago

I smile when I read info like that because you imaging to get privacy from a state actors using a device you do not really own.

Anything on a smartphone is in the hand of their vendor, if a local cop can't access stuff but have the right to, your data will go to the police, if there is no right to but some State actors do want they'll get your data as well.

Things on such devices are in the GAFAM et al hands, there is no protection.

mingus884• 2 years ago

You are right, the only way to win is not to play. Leave your cell phone at home.

But that’s not practical for most people and anybody can get talked to by authorities for any reason at all. When that time comes, folk need to know how to reduce their attack surface for anyone looking for a reason to make an arrest

jjav• 2 years ago

If you are about to cross a border:

I suggest something different. Do not take any phone you use for accessing anything remotely important. Carry no phone, or carry a burner phone. If you do this regularly, just have a dedicated phone for international travel with nothing except tourist basics on it (uber,etc).

appplication• 2 years ago

For those who think this is overly paranoid: a few years ago, my partner had been in the US for years on an active visa and we had just taken a quick weekend trip out of the country. On return to the US, we went through different lines. I breezed through customs.

She was held up by CBP, detained in a holding cell for hours. She was not allowed to contact me - or anyone - during this time. They took her phone, scanned it with their software and found a conversation in a messaging app from several years ago where she had joked with a family member about crazy ways you could technically get a green card. They interpreted this as malicious intent, rejected her entry, and physically destroyed her visa paperwork and work authorization cards.

After about 6 hours, a CBP officer called me to tell me they were denying her entry and would allow me to pick which flight she left the country on as long as it left within 24 hours. I bought her a light that left in about 8 hours. I went home and cried.

2 hours before the flight was supposed to leave, I got a call from her. There was a shift change for the CBP workers and the incoming supervisor didn’t agree with what the previous shift had done. He let her into the country, with no paperwork other than a letter that stated her visa documents were “accidentally destroyed” and he recommended she leave the country permanently.

Customs and Border Patrol are no joke. That can and will ruin your life on a complete whim. In her case it all started with a random screening which led them to searching her phone for any reason they could to reject her. The only reason she didn’t leave the county is I happened to pick an outgoing flight late enough that the next shift decided to review the previous shift’s decision.

greyface-• 2 years ago

It can be a reasonable tradeoff to leave it enabled, even knowing that the state can compel you to present your finger or face. If you disable it, you'll need to enter your passphrase regularly, which means it needs to be short and easy to enter, which usually means 4 to 6 digit numeric, which means you're more vulnerable to offline bruteforce attacks if you lose physical custody of your device. If you leave it enabled, and deauthenticate any time you're about to interact with a police officer, then you can use a longer and more complex passphrase, and be more secure if it's seized from you.

loeg5• 2 years ago

Or, most people (reasonably) do not factor arrests into their phone security threat model at all, and can happily keep using convenient biometric unlock features.

Rinzler89• 2 years ago

When it comes to consumer tech, convenience beats everything else, period.

deanresin• 2 years ago

This is eerily similar to the privacy argument "well I don't do anything wrong so I have nothing to worry about". The problem is you don't decide what should be hidden and what should be available, the state does, and things can change quickly. Having said that, it would be easy to change your security settings as known security threats become apparent.

loeg5• 2 years ago

"Eerily similar" only in that I, like most other people, do not have to worry about being arrested, yes.

mistrial92• 2 years ago

so this is subtle and persuasive rhetoric .. let's look more closely.. "most people" divides the public into "us vs them" .. "factor arrests" immediately and implicitly makes the dividing line into "law abiding citizens" and their implied complement, criminals.. "can happily" inserts an emotional component into the divisive classification.. "use biometric unlock features" seals the statement, firmly cementing "law abiding us people" against "those other people who obviously have something to hide"

in short - no. A broader view of human nature, and the relationship of an individual adult versus the state or corporate status quo .. says that no, an individual person with rights and privacy does not have to acquiesce to draconian surveillance state record keeping.. and asserting your rights to not participate does not make you a member of the criminal "them" class.

Secondly, snide and smug assertions made in public that do associate privacy and individual rights with criminals, might be made by exactly those who are promoting these kinds of systems, for profit.

summary - no.

loeg5• 2 years ago

This analysis is numerology.

mistrial92• 2 years ago

“Those who are staying in there are not staying in there for noble causes. They’re criminals,” University President Tom J told the local newspaper.

crazygringo• 2 years ago

Exactly.

Knowing how to set it to require a passcode feels like absolutely important information if you're a political dissident, a journalist with valuable sources, if you live or are visiting somewhere where the police will harass you (or worse) for your private lifestyle, if you're employed by a corporation with trade secrets the government wants to spy on, or of course if you're just a straight-up criminal.

But if you don't fall into these and similar categories, then it seems totally fine to rely on biometrics.

Because this isn't at all a case where just because I have nothing to hide, means I'm cool with eroding privacy protections. The point is that you can protect yourself when you do have something to hide. But me relying on convenient biometric unlocking isn't preventing those who need to disable it from doing so. It's not even making them seem more suspicious, since my iPhone asks me to verify my passcode every couple weeks anyways, or every time it restarts.

2bluesc• 2 years ago

On Google Pixel 8 (IDK about other Android phones) you can press the power button + volume up button to launch a pop-up menu with the following options: restart, power off, lockdown, emergency.

If you select lockdown you'll be required to use a pin or password to unlock the phone.

sonofhans• 2 years ago

This is stupid and reckless advice. The perfect is the enemy of the good. Practically nobody will set a robust, multi-character passphrase and use it dozens of times a day.

The vast majority of people will never be troubled by law enforcement; phone theft is much more common. Shoulder-surfing someone’s password and grabbing their phone to run out the closing subway doors has been A Thing for decades now.

imarkphillips• 2 years ago

There's a Secure Folder on Samsung phones. It requires a pin code to access & you can store a lot of apps in there, but it pretty weak.

Since reading these police access reports from the US I tried using the Secure Folder.

As a digital nomad for past 9 years I visit 10-20 countries a year, so lots of border crossings.

Secure Folder sadly doesn't allow you to hide all your disclosing apps inside.

Certain apps like browsers still need to be run inside your main section, and therefore accessible from a fingerprint login.

And a phone without finger or face login is too cumbersome for digital entrepreneurs in this day & age.

So the idea of shutting off the phone as you cross borders seems to be the best approach for us nomads.

I note the court case wasn't about a border crossing so I'm still looking for practical solutions.

Not being American I, like many, am almost paranoid visiting the US with all its foibles.

Stop Using Your Face or Thumb to Unlock Your Phone

Related Stories