Hacker News Reader

Comment by smnrchrds | Hacker News Reader

Whether passwords are considered testimony or not is not quite settled in US and Canada yet. There are instances where the court has determined that the accused can be forced to put their finger on the fingerprint reader of their device, but cannot be forced to give up their password. Although there are cases where the password was forced to be given up as well. Until this is resolved one way or another, passwords remain potentially safer than biometrics.

View on HN

There's a difference. Your finger can be used against your will. Your brain can't be scanned for password against your will, you have an ultimate choice to provide password or not.

Your brain can be “brute-forced” and Mossad will do it.

Your brain has different failure modes to your fingerprints, though, and your brain in itself cannot [yet] be used involuntarily in the way that your finger[-tip] can, and as a result of factors like these it's harder to implement distress protocols in biometric authentication systems.

What?

Throw someone in an MRI or whatever. Continuously scan their brain, while their eyes are taped open, and display a changing character on the screen. Meanwhile, play a sound file with someone saying "password" in the background constantly, so diversionary mental tactics won't work.

Soon, the first character of their pass will appear, a part of their brain will respond, and you have the first char. Continue until the entire pass appears, and "despair" alights in their brain.

Success! Drink champagne and rejoice.

has this been tried? sounds interesting on its own :)

That is barbaric. Implanting a neuralink should do the job more elegantly.

Are you sure about this? It does sound a bit more expensive than this 16 Shekel wrench.

if someone is ready to die to protect it for some reason his procedure would be more viable.

If someone is relatively unfamiliar with torture, they might think something like this. It is difficult to grasp the loss of physical and even mental autonomy and the lasting effects that it can have. One of the arguments against torture (from the point of view of effectiveness) is that everyone talks, even when they don't have the information sought.

(For the sake of an entertaining argument)

I have plenty of passwords memorized. I could think of my email password from 2002 (yes, I remember it), or any of my work passwords, or my Steam account password.

It's going to take a lot of MRI sessions.

if it really works it should not be to hard to overcome this. there will be a different reaction when you see letters of the password you've been actually asked for piling up. so just second session looking for this yet unseen pattern could work.

I think this is quite interesting and would not only work for passwords if it does at all. i would love to read more about this :)

Hence why they wouldn't bother with this.

You do however, have close relatives, family, friends, things you own, people you care for, your own life, that can be used and threatened for you to give out your password.

Don't kid yourself. Torture methods exist for a reason: as horrible as they are, they work, no matter the person. And they won't stop until they get your vacation pictures.

It's similar in Germany. Police may just take your finger and put it on the sensor. But you can't be forced to give out your password.

FaceID might be useful here? Won't work if your eyes are closed.

I think you can disable that by disabling "require attention". If "require attention" is enabled FaceID won't work unless you are looking at your phone. I believe it is enabled by default.

But pro-tip if you are being apprehended by police is to furiously click on the side button as the phone will require pin code after that.

> But pro-tip if you are being apprehended by police is to furiously click on the side button as the phone will require pin code after that.

Apparently that won't work on Android -- though there's a lockdown feature (that will disable biometric-unlock) that you can access after long pressing the power button.

Yea, I wish lockdown was easier to access on Android. An alternative would be holding the power button for long enough to turn the phone off. Not great either though.

I don't know about Germany but here in The Netherlands Face ID falls in same ballpark as fingerprint. The police can use reasonable force to have you unlock your device with fingerprint, or with your face.

I wouldnt rely on that personally - too risky for me to have it sporadically misfunction or the police tricking me somehow.

You can quickly disable biometric access on iPhones while the phone is locked by pressing the wake and a volume button simultaneously or pressing the wake button five times, although the latter triggers a call to emergency services too. Of course, that's only useful if you are in position to do so.

Every police officer should know this, and try to work around it when the situation arises.

My fingerprint reader on my smartphone is so fucked up that if I just quickly move my finger on it, I had to many attempts and its disabled. Then it requires whatever you use else (PIN, password, ...)

Reply on news.ycombinator.com