Slashdot Mirror
The Government Wants Your Fingerprint To Unlock Phones (dailygazette.com)
schwit1 quotes this report from the Daily Gazette: "As the world watched the FBI spar with Apple this winter in an attempt to hack into a San Bernardino shooter's iPhone, federal officials were quietly waging a different encryption battle in a Los Angeles courtroom. There, authorities obtained a search warrant compelling the girlfriend of an alleged Armenian gang member to press her finger against an iPhone that had been seized from a Glendale home. The phone contained Apple's fingerprint identification system for unlocking, and prosecutors wanted access to the data inside it.
It marked a rare time that prosecutors have demanded a person provide a fingerprint to open a computer, but experts expect such cases to become more common as cracking digital security becomes a larger part of law enforcement work. The Glendale case and others like it are forcing courts to address a basic question: How far can the government go to obtain biometric markers such as fingerprints and hair?"
It marked a rare time that prosecutors have demanded a person provide a fingerprint to open a computer, but experts expect such cases to become more common as cracking digital security becomes a larger part of law enforcement work. The Glendale case and others like it are forcing courts to address a basic question: How far can the government go to obtain biometric markers such as fingerprints and hair?"
The harder a government tries, the faster a market for hard-to-crack devices will grow.
New option: set a finger to use which will cause the device to wipe. (I can think of an appropriate digit to use).
If this starts happening people will just use a multi layer logins ie a sequence of fingers prints instead of just one or a fingerprint and a pass sequence. Also regarding terrorists, they just use burner phones for no more than a day or two now and use cryptic key words that mean nothing to your average key word search engine.
There is no difference in the task - but it used to be you got put in the police archive for easy identification, NOT that you gave up all your personal files to the police.
-=This sig has nothing to do with my comment. Move along now=-
And the police fingerprints are still good enough to be used to defeat the best fingerprint scanners. There's been no noticeable improvement in the technology since the paper on defeating it was published in 2002.
https://cryptome.org/gummy.htm
The crack was confirmed by MythBusters in 2011.
https://www.youtube.com/watch?...
There has been no basic change in the technology. Fingerprint scanners are still trivially beaten.
See this Slashdot article from October 2014: Virginia Court: LEOs Can Force You To Provide Fingerprint To Unlock Your Phone. And that's not the first.
(IANAL.) The idea is that forcing you to reveal something you know (passcode, etc) is testifying and thus could be self-incrimination and not constitutional, but that forcing you to provide something about yourself is totally kosher. The analogy is being compelled to give up a key or DNA vs a safe combination - the former is searchable, the latter is not. Fingerprints are routinely taken upon arrest, even if the person is released without charges. Physical descriptions or stuff on/about you is not testifying. The argument to make here is a fourth amendment one about being "secure in ones papers" - but they have a warrant so that doesn't do any good anyway.
What it comes down to is the fifth amendment is a very important, but very circumscribed, right - not a get out of jail free card. Which shouldn't have been a surprise, really, otherwise the police would never be able to prosecute much of anything.
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
They got a warrant. None of my other "persons, houses, papers, and effects" are secure against a warrant, so why should my phone be?
You may not think that there are other situations where the State could require my cooperation to investigate my alleged crimes, and yet those situations exist commonly. Fingerprints or DNA, for example, are coerced confessions from my body to be used by the state against me - and there's a long history (sometimes sordid) of their acceptance and use. They are coerced cooperation - try not giving fingerprints or DNA and see how far you get.
The only significant issue I see is that the coerced cooperation required to open my phone, opens a huge window into my private business that doesn't have much of a parallel pre-cellphone. But that isn't much different than a search warrant for my house - the warrant must be specific, but that doesn't mean that the police who search my house won't investigate every document, container, and closet that may (or may not) be covered by the warrant.
And the worms ate into his brain.
How far can the government go to obtain biometric markers such as fingerprints and hair?
They can go as far as just taking you around the back of the courthouse and shooting you. Of course those governments don't tend to be popular, but it happens. It all depends how much power the people give the government, until a critical mass is reached where the government no longer needs the people and can just give itself power. Guess which phase the US is in today.
Seven puppies were harmed during the making of this post.
I think you have a bit of a misinterpretation of the fifth amendment.
The explicit text related to self-incrimination is:
"...nor shall be compelled in any criminal case to be a witness against himself; ..."
which is generally interpreted as:
"The Fifth Amendment protects criminal defendants from having to testify if they may incriminate themselves through the testimony. A witness may 'plead the Fifth' and not answer if the witness believes answering the question may be self-incriminatory."
So, the fifth amendment specifically applies to testimony.
So while you can't be compelled to provide authorities with your decryption key for instance, we have recently seen here that you can be ordered to perform the decryption itself and be held in contempt of court for not doing so.
Sounds like a mistake to use your fingerprint as a password in that case, then. Not law enforcement's fault.
Fingerprinting is not new--not only is it required of criminal defendants as a matter of course, but many states take fingerprints for other reasons such as admission to the bar.
The Fifth Amendment right against self-incrimination does not apply because certain information is not considered "testimonial" in nature. You are not testifying when providing a fingerprint. While this is a slightly different case because the fingerprint is being used to unlock a phone, ultimately they are still not using testimony to unlock the phone--they are using a physical characteristic of an individual. So it will still be considered non-testimonial, and the appeals court that reviews the matter will agree.
The Fourth Amendment still protects you from a random search of your phone, but there was a warrant in this case.
Real lawyers write in C++
I've always wondered why people would think that fingerprints are a highly secured method of authentication. You leave the things around everywhere you go and you can't change them if they are compromised. Imagine if you dropped little strips of paper with your password (that could never be changed) written on it everywhere you went. How long would your "highly secured" password last if someone decided they wanted into your account? Especially if that person was the government?
Heck, if the government has your phone, chances are they have your fingerprint on your phone (or have access to somewhere you've been that you've left your fingerprints). Even if they don't have you in custody (and thus didn't fingerprint you), they can use those fingerprints to gain access to your phone.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
In at least one well-known case, it was held that a subpoena for the contents of a phone (protected by a password) to be used or provided depends on one factual question. The same question that applies to documents locked in an old-fashioned safe that has a combination.
If there is a question about whether or not the phone belongs to the defendant, providing the password would be admitting ownership. That would be testimony, which is protected by the 5th.
On the other hand, if the defendant admits it's his phone (or safe) , they have no 5th amendment right to interfere with a lawful subpoena just because unlocking the documents requires a combination that they know in their head, rather than one they wrote down.
That approach won't work. The device won't take fingerprints after 48 hours. In fact, if the person simply refuses to submit to use of their fingers to unlock the device, they might get held in contempt, but after 48 hours, they can submit to the use of their fingers, and they're no longer in contempt, but it won't be of any value to the government.
Check out my sci-fi/humor trilogy at PatriotsBooks.
1 finger unlocks the phone, other 9 wipe it.
Also... Back in my teenage days I once got SOOOO drunk my pals thought it would be fun to test if I had any sensation left - by putting a lighter under my left index finger.
Permanently altered that fingerprint due to scar tissue.
I'm pretty sure there are various other ways one could alter one's fingerprints rather easily and quickly.
Causing those 1 to 9 odds to suddenly look a lot more like 100%.
Look like being the operative word.
Mit der Dummheit kämpfen Götter selbst vergebens
I don't know where you are, nor have hands-on access. MythBusters reprised the 2002 paper: Feel free to repeat the experiment, yourself, with a scanner, a printer, and a permanent marker to print the expanded scan, correct broken lines with a fine marker, then reduce the scan. And yes, I've done this about 3 years ago, at a data center with a laser printed paper fingerprint, moistened, on my own fingerprint. I'm not sure which model it was, but it was a useful proof of concept. The claims of "this is a 3D scanner and therefore cannot be fooled" seem to be complete nonsense.
And that's why Apple disables the fingerprint reader - after 3 unsuccessful attempts to use the fingerprint reader, 48 hours of no fingerprint, or on a power up.
And people think Apple's method is "asinine" for requiring a passcode. The only reason Apple has a fingerprint reader was to make phones more secure by having more people actually USE a passcode. Because passcodes are a pain when you're having to enter them in 1000 times a day, so a good majority of users don't do that. The fingerprint reader lets you have a passcode but not have to go through the hassle of entering it thousands of times a day.
The problem with biometrics are they are fixed. So once they are stolen, you are screwed. Duplicating a fingerprint is easy. Iris scans are probably simple enough to defeat given the right equipment. Even some future DNA scan could be defeated, in theory. Keep in mind, no matter what form of security is used, it has to be digitized in some way. That is a crack in security.
-- Will program for bandwidth
What if you made the passphrase answer a statement that you were guilty of doing something? Then, since you can't be forced to testify against yourself, you can't divulge the passphrase since it is itself self-incriminatory.
I should have gone to law school.
(Yes, this is a serious, non-sarcastic post.)
Yikes, that scenario had never occurred to me. I just turned TouchID off on all my devices. Entering my (>4 character) passcode isn't really that hard.
This sort of story is why I like Slashdot. This was interesting and useful. Thanks to the submitter and the editor.
"Don't blame the log for the fire." --Andrew Ratshin
Fingerprints are not passwords. If you use them that way, you're an idiot.
At best, fingerprints are shortcuts for your USERNAME. You can use them in systems like that - school library and dining hall systems are perfect, you're not interested in "security", you're just interested in determining the correct child to a certain degree of accuracy quickly.
Your password should still be something that only you know.
People using fingerprints for passwords are deliberately making their machines less secure.
This case is so insidious that I really hope it gets more traction on slashdot or other media sites.
The slashdot summary didn't do it justice, either. The court is holding someone who claims to have forgotten his password indefinitely until such a time that he produces his password.
If the police search your house, and deep in your basement find a computer hard drive from 6 years ago that you've completely forgotten about, and have no recollection of the passphrase to unlock, do you deserve indefinite detention?
Claim that you used OTP encryption, ask for a copy of the encrypted data, generate a key that will decrypt the encrypted data, verifiably and reproducibly, to any plaintext you chose.