Hacker News new | past | comments | ask | show | jobs | submit login
[dupe] Police told to avoid looking at recent iPhones to avoid lockouts (engadget.com)
86 points by tekacs on Oct 14, 2018 | hide | past | favorite | 68 comments



Discussion on a similar article here: https://news.ycombinator.com/item?id=18208954 (65 comments)


A quick reminder: on iPhone X you can hold power button + one of the volume up/down buttons for 2 seconds to temporarily disable Face ID.


And if your movement is restricted, “Hey Siri, who am I?” will also trigger a lockout requiring a PIN.

Edit: for clarification - this will not lock your phone by itself. If your phone is locked (so on your lockscreen with the lock icon still there) it will trigger a lockout and won’t allow biometric authentication until your PIN has been entered.


This does not work on an XS.

Neither do “lock my phone,” “disable Face ID,” or “require passcode.”

Edit: I was wrong - it does work for me when the phone is locked.


Edit: see my parent comment or my response to joshstrange.


Ah, I got it to work. Thank you!


Just tried this and it didn't work, (iPhone XS Max iOS 12.0)


Are you doing this with your lock screen in the ‘unlocked’ state or in the ‘locked’ state? If the lock screen is already unlocked, it doesn’t work (and wouldn’t matter, since whatever adversary you have already has access to your phone). Try it again with your phone locked and the screen off. If it still doesn’t work, report it as a bug to Apple. I can personally vouch for it working on a 6, 6S, 7 and X.


Here are my screen shots:

1. Lock screen in locked state

2. Siri request

3. FaceID settings

4. iOS version/model

I'm not trying to prove you wrong, I really want to see this work and I am trying to figure out what might be different on our phones.

[0] https://imgur.com/a/uil5O7e


Oh I believe you. Do you have your ‘my card’/‘my info’ configured? By that I mean, if you scroll up in Contacts does it show your contact card at the top (and if you ask ‘who am I, does Siri pull up this card)?


Aha! My name DOES show up at the top of my contact but once I click into it it's really some kind of a "shadow contact" or placeholder. It seems it was guessing a bunch of info about me but there wasn't really a record tied to it. I "edited" it, added some basic info (phone number and email), hit save and now the feature works as you described. Thank you!


FWIW I just tried this with my Xs locked and it worked exactly as described.

Thanks for the tip!


Tried it locked and unlocked. No difference.


Follow my comment tree with joshstrange. You basically need a ‘my info’/‘my contact’ card configured.


Probably best not to disable the “Require Attention” option for facial recognition - then if your eyes are closed or not focused on the phone, it won’t unlock.


Maybe a stupid question, but how comes they cannot just obstruct the front sensors for faceid to fail?


That's what I thought. Just like making sure the phone doesn't connect to the internet so it can't be remotely wiped. I don't own an iPhone so I might be wrong but can't the cop just tape over the camera/sensor?


Most likely they would place it in a shielding bag to cover both issues.


A PSA on biometric security's weakness against coercion - including law enforcement, but likely more often abusive spouses or employers.


Unlike the courts, an abusive spouse or employer won't presume innocence. They will take your initial refusal to insert PIN/password as proof of guilt and coerce you into doing so.


With a spouse the 'threat' is that they can unlock your phone when you're sleeping. This isn't about giving in to coercion, but about covert access.

Not sure how this works with an employer though.


That's why iPhones have "Require Attention" option, that checks that your eyes are open and looking into the TrueDepth sensor.


How do they cope against a video of you, like if I pretend to take a selfie but video instead, oh whoops .. but then I have a video to use to unlock your phone?

Or police could use the mugshot process to get a video?


The iPhone camera makes a 3D "scan" by projecting infrared dots onto the face, so putting a screen or sheet in front won't work.

https://en.wikipedia.org/wiki/Structured-light_3D_scanner


Cool, I missed that development; seems it needs a bit of work to crack - https://www.wired.com/story/hackers-say-broke-face-id-securi....


If it’s to this point she needs to leave.


That's not helpful advice to someone trapped in an abusive relationship.


To clarify: if someone is at the point where their SO is snooping around their phone at night, there is a potentially dangerous power imbalance in the relationship. Step one is not "leave". That may not be possible without catastrophic effect in some cases (think stalking, violence, blackmail).

Rather, step one is to prevent the toxic SO from gaining more power over you. (Step two is to reduce their power.) Technology that automatically prevents them from snooping on your digital life is a great way to do this.

(And yes, it is best if the tech is a given. If a toxic partner notices that you are taking actions to keep them at bay, that can be dangerous too. E.g. this is why Facebook broadcasting idle time to everyone in your network is terrible for those with stalkers. The implementors of that feature should be ashamed.)


Biometric authentication should stop working once a lockout has been triggered.


On iPhones it does.



[european here] I can't read this article as there is no way to opt-out of the tracking - isn't this in breach of GDPR?


A fellow HN detailed how he did it here, seems extremely non-intuitive.

https://news.ycombinator.com/item?id=17235923


It's somewhat easier to just browse in Firefox's private mode all the time with trakingprotection enabled and no 3rd party cookies. Nothing is shared with the tracking networks and any cookie set by the site itself is deleted at the end of the session. As for the consent and GDPR annoyances themselves, they can be killed easily with uBlock (along with the ads etc.).

Welcome to the smooth, no-tracking surfing experience of circa 2003.


Hope you're also using garlic encryption and blocking other apps which might (probably are) sniping on you anyway.


As long as it's not opt-in, I'm pretty sure it is a breach. I really hope EU gets its act together on this before the law becomes functionally dead.


I'm pretty sure it is. I also spent some time to click around to find the opt-out toggle, but that's nowhere to be found.

I guess that sooner or later they'll be forced into compliance.


> I guess that sooner or later they'll be forced into compliance.

Forced by whom?


Oath's gdpr wizard îs torture. I hope they will pay their share of fines for it, just to compensate for the time wasted ...


Me too but has anyone actually been fined for this sort of thing yet? I tried to report one site to the UK ICO and didn't even get an automated email reply.

Seems like the law exists but there's nobody to enforce it.


Though the iPhone X series uses a special chip to store the face I never read it doesn't site the face of others. None of this really matters though as any "authority" looking at your phone has the power to force you to unlock it against your will.

New Zealand, for example, recently instituted a $5000 maximum fine for individuals at airports who are unwilling to unlock their phones even asked by "officials".

Both the US and NZ, along with several other countries, are part of the same surveilance ring. So if you think not looking at your phone matters in the slightest it doesn't. Not at all.


Seems like it would be best to totally wipe all of your devices before crossing a boarder and restore from backup over the internet when you are over it.


Curious what the border control response is to being handed a phone that has clearly been wiped immediately before the flight.


What are they going to do, demand a replacement with real data?

It is the phone you're traveling with. The point is supposed to be about bringing illegal stuff into the country. A blank phone contains none. If they want to explain that they need fed juicy private stuff for admission, well, I'd love to hear all the details about that.


I imagine they're going to view you with suspicion and so detain you for [further] interview; probably add you to a watch list?

A completely blank phone suggests you're naively hiding something: like carrying an empty box with an obvious fake bottom. Enticing stuff for a TLA agent I imagine.


> A completely blank phone suggests you're naively hiding something

I'd see that more as "proudly refusing to play along", but interpretations of course will differ. I'm willing to add little fuck-yous in the notes and pics, if that helps interpretation.

Push back, people. Meekly bending over because you don't want to be inconvenienced is quite literally asking for more.


> What are they going to do

If it comes to the point where they're wanting to look at your devices, their response to stock devices with no data will be to confiscate your device, detain you, and/or turn you away from crossing the border.


Tell them it’s a new iPhone.


I personally have a “burner” phone I take when traveling internationally (usually an unlocked older iPhone). If it’s stolen / seized I don’t really care.


Thats just comically funny. "Hey cellmate, I need you to punch my face in." "You sure dude?" "Yeah, they are gonna make me unlock my phone today...gotta make it fail!"


Could you please stop posting unsubstantive comments to Hacker News?


What exactly is unsubstantive about the ridiculousness of forced face ID unlocks as referenced in the article?


That is a good reason not to use face recognition.


On iPhone X, you can hold the power button and volume up for 5 seconds and it will lock the phone, disable Face ID, and force entering your passcode to unlock.


You can also tap the power button five times in a row, which brings up the emergency screen (Power Off, Medical ID, SOS call), but also disables face recognition until a pin unlock has happened.


Note this initiates an alarm and emergency call, with a three second window in which to cancel. Quite a surprise!!


I wish there was a control center toggle for this. I like to disable biometrics when I travel so a CC option would be great.


How does that work if you are under arrest? This is the scenario I am referring to and the article is about the police, so it's on point.


The idea being that you are able to disable the biometric stuff before you expect to encounter a situation involving overreaching law enforcement. Hitting the power button 5 times in your pocket is easy enough.

Additionally TouchID is disabled after several hours of the device being unlocked. I presume FaceID is no different. So if you refuse to comply and they have to get a court order then the time limit may be reached.

You can even have the device wipe itself after 10 failed attempts to unlock it.


If you’re doing something illegal, I’d assume you wouldn’t use Face ID because of this exact scenario, but from what I’ve seen, most criminals are dumb.


>from what I’ve seen, most criminals are dumb

Nope, just the ones you see caught.


Innocent people get arrested. Innocent people spend years in jail awaiting trial. And occasionally innocent people get convicted.


So you are fine with always type in a long password/numbers in public? And sure nobody looks at you/films your typing?


Its a tradeoff. It depends how defensive you want to be against law enforcement.

You could change the password on a regular basis as mitigation against prying eyes.


Except the law is most likely to be the ones watching you entering the password. So the tradeoff is about one attack vs another.


Very strange. I submitted this story about a half day ago and was marked as a dupe.


Not so strange; it's just that moderators don't see everything.


Face id and finger print id, unless used in addition to, not instead of, a passcode, are convenience features, not security features. Removing the "something you know" part of digital security makes anything else just shy of useless. Apple should remove the options or start using honest terminology in the configuration steps if they actually care about security.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: