Hacker News Reader

Comment by carlosjobim | Hacker News Reader

> Nobody has a secure password on their phone, so your requirement fails. > maybe finger prints, but I have found them unreliable and so I quit using them

You mean that you specifically do not have a secure password on your phone because you chose not to. The rest of us use finger print sensors or facial recognition to make our devices as secure as can be. Your argument applies only to you and a handful of people.

The SMS fallback is always combined with your finger print in all applications I've used.

View on HN

Biometric phone security is only secure until a judge or police officer compels you to unlock your phone; and legally you must comply, because your face or finger aren't speech. However, if you use a passphrase, (at least in the US and other countries with string freedom of speech laws) you can't be legally compelled to unlock the phone, as that would impinge on freedom of speech.

I never use biometrics to unlock my phone or computer for that reason.

On iPhones you can press Volume Down + Power to disable biometrics (faceid) before you hand it to somebody else or when going through customs etc. It will require your passphrase to unlock then.

so the main usecase of this feature is to defeat the nice policeman/customs officer?

thanks! i always wondered

That certainly is a case. Or they could torture and threaten you to give the password.

If this situation happens you can rapidly press the home button with the wrong finger and the phone will demand a pin code. Or you could turn it off. I don't know what recourse people with face unlock have.

Android: long press power, tap lockdown. Your entire point is now just inaccurate. I do this when going through security checkpoints, if I were to get pulled over, and Android auto trihgers it under abnormal conditions upon which I have a decently long device-specific password.

On iOS you can disable face and Touch ID with Siri “who’s phone is this” or by tapping the power button.

How long is the pin code that can be used to log-in into your phone and likely must be used when you restart it? 4-6 digits?

Use a long passphrase and unlock via biometrics.

Disable biometrics when handing the phone to somebody else or even remotely (e.g. mark as lost via “find my”).

Good compromise of usability and security.

Reply on news.ycombinator.com