Hacker News Reader

Comment by bigiain | Hacker News Reader

I think my favourite Usenix paper is appropriate here:

"Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT." -- https://www.usenix.org/system/files/1401_08-12_mickens.pdf

Good passwords and biometrics help if your adversary is not-Mossad.

Anybody who thinks biometrics or encryption or anything short of "Magical amulets? Fake your own death, move into a submarine?" is going to protect them again a nation state level adversary is kidding themselves.

View on HN

> you’re either dealing with Mossad or not-Mossad.

No, you’re leaving out one very important class of actors, which I will call the NSA: The NSA, and others like them, unlike Mossad, are not after you personally, in that they don't want to do anything to you. Not immediately. Not now. They simply want to get to know you better. They are gathering information. All the information. What you do, what you buy, how you vote, what you think. And they want to do this to everybody, all the time. This might or not bite you in the future. You seems to imply that since nothing immediately bad is happening by using slightly bad security, then it’s OK and we shouldn’t worry about it, since Mossad is not after us. I think that we should have a slightly longer view of what allowing NSA (et al.) to know everything about everybody would mean, and who NSA could some day give this information to, and what those people could do with the information. You have to think a few steps ahead to realize the danger.

(This has been a partial repost of a comment written a year ago: https://news.ycombinator.com/item?id=23572778)

The NSA _is_ Mossad. The NSA has means way beyond what an individual actor has. The NSA splices cables and taps directly into ISPs and large companies to vacuum up all your data. Do they read your encrypted data ? Maybe not. But the moment you truly become interesting to them, they _will_ have a wrench to make you give out the password. Don't kid yourself.

All that is true. What I was criticizing was the logic of the linked paper, which went, essentially: ‘When I do slightly insecure things, nothing bad observably happens. Therefore, Mossad must not be after me. It follows that it’s OK to not be very secure, since only Mossad could break through my security anyway’. This logic is faulty for the reason I wrote; your slightly bad security can be broken without you necessarily knowing about it, since the reason the entities I termed “the NSA” have for breaking your security is different from the reason which what he termed “Mossad” has.

Whether passwords are considered testimony or not is not quite settled in US and Canada yet. There are instances where the court has determined that the accused can be forced to put their finger on the fingerprint reader of their device, but cannot be forced to give up their password. Although there are cases where the password was forced to be given up as well. Until this is resolved one way or another, passwords remain potentially safer than biometrics.

It's similar in Germany. Police may just take your finger and put it on the sensor. But you can't be forced to give out your password.

FaceID might be useful here? Won't work if your eyes are closed.

I think you can disable that by disabling "require attention". If "require attention" is enabled FaceID won't work unless you are looking at your phone. I believe it is enabled by default.

But pro-tip if you are being apprehended by police is to furiously click on the side button as the phone will require pin code after that.

> But pro-tip if you are being apprehended by police is to furiously click on the side button as the phone will require pin code after that.

Apparently that won't work on Android -- though there's a lockdown feature (that will disable biometric-unlock) that you can access after long pressing the power button.

Yea, I wish lockdown was easier to access on Android. An alternative would be holding the power button for long enough to turn the phone off. Not great either though.

I don't know about Germany but here in The Netherlands Face ID falls in same ballpark as fingerprint. The police can use reasonable force to have you unlock your device with fingerprint, or with your face.

I wouldnt rely on that personally - too risky for me to have it sporadically misfunction or the police tricking me somehow.

There's a difference. Your finger can be used against your will. Your brain can't be scanned for password against your will, you have an ultimate choice to provide password or not.

Your brain can be “brute-forced” and Mossad will do it.

Your brain has different failure modes to your fingerprints, though, and your brain in itself cannot [yet] be used involuntarily in the way that your finger[-tip] can, and as a result of factors like these it's harder to implement distress protocols in biometric authentication systems.

What?

Throw someone in an MRI or whatever. Continuously scan their brain, while their eyes are taped open, and display a changing character on the screen. Meanwhile, play a sound file with someone saying "password" in the background constantly, so diversionary mental tactics won't work.

Soon, the first character of their pass will appear, a part of their brain will respond, and you have the first char. Continue until the entire pass appears, and "despair" alights in their brain.

Success! Drink champagne and rejoice.

has this been tried? sounds interesting on its own :)

That is barbaric. Implanting a neuralink should do the job more elegantly.

Are you sure about this? It does sound a bit more expensive than this 16 Shekel wrench.

if someone is ready to die to protect it for some reason his procedure would be more viable.

If someone is relatively unfamiliar with torture, they might think something like this. It is difficult to grasp the loss of physical and even mental autonomy and the lasting effects that it can have. One of the arguments against torture (from the point of view of effectiveness) is that everyone talks, even when they don't have the information sought.

(For the sake of an entertaining argument)

I have plenty of passwords memorized. I could think of my email password from 2002 (yes, I remember it), or any of my work passwords, or my Steam account password.

It's going to take a lot of MRI sessions.

if it really works it should not be to hard to overcome this. there will be a different reaction when you see letters of the password you've been actually asked for piling up. so just second session looking for this yet unseen pattern could work.

I think this is quite interesting and would not only work for passwords if it does at all. i would love to read more about this :)

Hence why they wouldn't bother with this.

You do however, have close relatives, family, friends, things you own, people you care for, your own life, that can be used and threatened for you to give out your password.

Don't kid yourself. Torture methods exist for a reason: as horrible as they are, they work, no matter the person. And they won't stop until they get your vacation pictures.

You can quickly disable biometric access on iPhones while the phone is locked by pressing the wake and a volume button simultaneously or pressing the wake button five times, although the latter triggers a call to emergency services too. Of course, that's only useful if you are in position to do so.

Every police officer should know this, and try to work around it when the situation arises.

My fingerprint reader on my smartphone is so fucked up that if I just quickly move my finger on it, I had to many attempts and its disabled. Then it requires whatever you use else (PIN, password, ...)

James Mickens wrote some of the funniest things I have ever read. I strongly recommend all of his articles.

Reply on news.ycombinator.com