Hacker News Reader

Comment by mtgx | Hacker News Reader

> These changes are coming in conjunction with another privacy-minded feature that will disable Touch ID by pressing the power button five times.

Wow, that's really nice. I wish Google was so forward thinking about things like this. I see no reason why a fingerprint authentication should be forced upon someone anymore than a password unlock would be. The only reason this is how it works today is because it's much "easier" for the government for force your finger onto the phone, or take blood from you, or hair, and so on - and they can't really do that with passwords. But we can fight back with technology and ingenuity and ensure that a fingerprint auth is "just as good" as as password, at least from this point of view (government forcing you to give it away).

View on HN

>Unlike most Silicon Valley companies, Apple’s business model is one of "Data Liability." Unlike Google or Facebook which use advertising to extract value from users’ personal information, Apple focuses on selling things that protect a user's data from all unauthorized access — including by Apple. Basically, Apple views user data as a headache, not a monetization opportunity.

https://lawfareblog.com/ios-11-may-complicate-border-searche...

> I see no reason why a fingerprint authentication should be forced upon someone anymore than a password unlock would be.

In Canada, there is a difference. A fingerprint is something you have. A password is something you know. Police can compel you to use your fingerprint to unlock the phone. They can't compel you to disclose the password.

You shouldn't be compelled to give up anything that is "you" without a court order and a warrant. Not indiscriminately photographed, fingerprinted, and in some cases tested for drugs against your will.

Canada forces people to unlock their phones, when crossing the border, quite frequently - and have for years. They will make you unlock it, or disallow entry and/or detain you.

There's a whole series that shows this. It's Canadian Border Guard, or similar. I see it when I cross the border, which I do with some frequency. I just unlock my phone for them.

What do they do with it after you give it to them? Does the device leave your sight?

They just flip through it. I'm a citizen so they don't do much with it. They usually look at texts and emails, to see if people are going to work there illegally. I'm able to work there so it's pretty silly.

It has never left my sight. I can't speak for others and didn't watch the show that carefully. I live so close to the border that my neighbors get Canadian television. So, I've seen it there. I don't actually have TV hooked up, so I don't see it often.

As does the States.

What I meant was that inside of Canada, there are situations where the police don't need a search warrant for your phone. You can unlock it with your fingerprint, so it's legally "open" and searchable.

If you have a passphrase, then they need to know your mind in order to unlock it, and they can't force you to disclose something you know.

Ah, okay. Yes, inside the US it is pretty much the same. Borders are the exception and, I think, you need to actually be crossing in order for them to demand it. Citizens are immune, for the most part.

Curiously, citizens aren't immune in Canada. I have dual citizenship and they still sometimes want to flip through my phone. No, I'm not sure why. They have had me power on and unlock my laptop a couple of times, as well.

Exactly the same in the US: https://www.theatlantic.com/technology/archive/2016/05/iphon...

It's not "forward thinking" to put that feature in 4 years after Touch ID debuted and people have already been forced to unlock their phones. They should be issuing warnings that fingerprint sensors are for convenience and reduce security unless they're used in multi-factor authentication.

The alternative was passcodes and Apple's research suggested that people disabled passcodes rather than use anything secure. TouchID was determined to be far more secure than no passcode and having both TouchID and a passcode is secure enough for most users. You can't add devices without both (along with an Apple ID password) and, at that point, you have physical access to the device which negates most security features anyways.

Interesting and pragmatic. Do you have a reference for this? I'd be interested in reading more.

There is a reference for this as Apple published a security white-paper about it prior to the release of TouchID. Unfortunately, I'm not at a point where I can search for it. If I find the time today, I will update this post with a link.

Cheers. I'd appreciate it.

Edit to add: I came across this one:

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

It was linked from an article in 2014[1], though this PDF document is dated March 2017.

[1]: http://www.biometricupdate.com/201402/apple-publishes-whitep...

Yeah, that's the updated one. Prior to the release of TouchID, something similar was released.

Here's the whitepaper about iOS security: https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Reply on news.ycombinator.com