Submitted 6 months ago by return2ozma@lemmy.world to technology@lemmy.world
https://gizmodo.com/stop-using-your-face-or-thumb-to-unlock-your-phone-1851438205
Further advice regarding civil disobedience:
LEAVE YOUR PHONES AT HOME. Write down some numbers in case you get arrested—or better yet, memorize them. There are journalists there for documenting. And there will be plenty of other people that don’t follow this advice. Leave anything they could use as leverage over you and your cohorts away. Don’t bring ID. Don’t bring anything except what you need for the action. It’s not worth the risk.
If you’re going somewhere where you think you might be at risk, IMHO, it’s probably just easier to turn your phone off. Android and iOS both require a non-biometric passcode after boot.
Or, if you want to keep your phone on, enable lockdown mode on Android, or tap power 5 times on iOS to require a non-biometric password at the next unlock.
It’s never a good idea to bring your phone with you. It can be used, even while powered off, to track and surveil you. The BLM protests were just the tip of the iceberg. The apps you have on your phone track you. The government is buying that tracking data. Your phone is a massive privacy weak point. It’s basically a bug you carry on you willingly. It’s not safe. Period.
theconversation.com/police-surveillance-of-black-…
vox.com/…/police-law-enforcement-data-warrant
Leave your phone at home. It’s not worth it. It may not bite you in the ass the day of, but could very easily come back to haunt you after they investigate, in case anything goes “wrong” in their eyes. It’s just not worth it.
The concern with bringing your phone is that police have subpoenaed cell providers to force them to turn over cell tower records. The police then used the lists of cell phones connected to those towers to track down protestors.
You shouldn’t bring your phone to a protest because it could end with police kicking your front door in three weeks after the protest has wrapped up.
And completely cover any tattoos. Even more identifiable than your face, honestly.
Maybe get a dumb burner phone with no personal data on it. You could potentially keep your main phone in a secret/secure pocket.
keep your main phone in a secret/secure pocket.
Terrible idea, it will be found with absolute certainty if you’re arrested.
No. Several Jan 6 participants tried burners and they still got caught because the burners were still linked to their movements and activities and their personal phones were unusually unused/off/immobile for the amount of time the burners were used. You would have to expend a lot of effort to make sure your burner was completely disconnected from yours and your phone’s location, as well as making sure your phone showed signs of appropriate activity in your absence.
Not so easy.
The article pretty plainly says the guy was coerced into entering his password. So the headline feels a bit manipulative.
The headline is click-bait. I honestly don’t know why people still read this crap.
So he was “only” coerced, ie likely verbally abused and lied to (which cops are allowed to do) about the consequences of refusing to unlock, instead of being physically forced. Such freedom.
It’s Gizmodo. I’d all manipulative bullshit.
Lemmy quality descended quite quickly. What’s the more intelligent tech community alternative?
Ya know… I hadn’t see anything by them in so long I forgot.
However, the panel said the evidence from his phone was lawfully acquired “because it required no cognitive exertion, placing it in the same category as a blood draw or a fingerprint taken at booking…"
If the precedent is that unlocking the phone is the same category as fingerprint taking, well, what happens if you refuse to be “coerced” into having your prints taken? Even if the legal precedent isn’t fully understood, but it looks like the reasoning here isn’t based on whether there was physical force applied, but whether the search required the contents of the person’s mind.
I do t know about fingerprints but I thought a blood draw required cooperation or court order
It’s frustrating to no end that fingerprints and face ID are treated like passwords when they should be treated like usernames.
They make sense as a 2FA. It would be really cool if I could require either PIN+fingerprint or a long recovery password.
That makes a lot of sense !
Maybe don’t live in a fucking dystopia. The US is a police state and you have no freedom left.
You do have the delusion of it though. It may not be real but if you want it to be you can work hard for money that was never real to begin with.
The more of those Talisman your handle the more magick will save your life til your labor is done with.
While I buy you’re general cynicism, it’s wrongly applied here …
It seems like we have both more and less protections than other places, for this instance.
This is more of a scenario where legal contortions turn into huge inconsistencies, plus our legislature has refused to clarify so it’s all on the court system
## How to disable Face ID through the Power Off screen
- Hold down both the Side Button and either Volume Button at the same time for three seconds.
- The Power Off slider should appear. Tap Cancel.
This is the advice people (with iOS) should follow, not disabling biometrics altogether. Using FaceID or TouchID prevents shoulder surfing to find out what the password to your phone is. When local passwords have so much control over a device, using biometrics to prevent anyone from seeing what your passcode is is very useful.
Those settings can also be altered under Settings > Emergency SOS
Real MVP right here. Good to know!
This also encrypts your data.
FYI Androids have a feature for this. If you are ever forced to interact with a cop you can press the side button and volume up(might be different on other phones) to select lockdown which will force your phone to only be opened with the password. Its gross that we need this feature, but now you know.
iPhones also have this feature, for a long time now:
ios.gadgethacks.com/…/keep-law-enforcement-out-yo…
Rather irresponsible of the article to not point out these features on Android and iPhone. Did a cop or government official write that article?
Most likely just a written with little real tech experience.
iPhones do this too. Hold the lock and volume down button until your phone buzzes, to get to the SOS/reboot screen. Once that screen is activated, it’ll disable biometrics until the passcode is entered.
You can even take photos/videos with the locked phone, and the recordings won’t be able to be deleted from your iCloud until the passcode is entered. Handy for recording cops. Cuz even if they take your phone and delete the recording, it’ll still sit in your “Recently Deleted” for 30 days. And while the phone is locked, they can’t access that Recently Deleted folder to permanently wipe it. So you can just access your iCloud account from any computer and recover the “deleted” footage.
It’s good that they have this, but there are a lot of situations involving cops where it’s not going to be safe to stick your hand in your pocket. I’ll just leave the biometrics off on my devices.
Yeah, but I want a combo that force starts the feature. I want to pull out my phone and be able to blind start it, not stare at my screen to select the correct thing.
Same, but this is our only option unfortunately.
I have Button Mapper trigger a Tasker task that locks my phone when I hold the volume down button, for some reason Button Mapper’s lock doesn’t trigger a lockdown.
(Tap and hold still lowers the volume)
You can instead hold the power button for 1 second to open the same menu. Feels easier to me.
Usually that just launches the Google Assistant on most new phones.
Terrible article. Even worse advice.
On iOS at least, if you’re concerned about police breaking into your phone, you should be using a high entropy password, not a numeric PIN, and biometric auth is the best way to keep your convenience (and sanity) intact without compromising your security. This is because there is software that can break into a locked phone (even one that has biometrics disabled) by brute forcing the PIN, bypassing the 10 attempts limit if set, as well as not triggering iOS’s brute force protections, like forcing delays between attempts. If your password is sufficiently complex, then you’re more likely to be safe against such an attack.
I suspect the same is true on Android.
Such a search is supposed to require a warrant, but the tool itself doesn’t check for it, so you have to trust the individual LEOs in question to follow the law. And given that any 6 digit PIN can be brute forced in under 11 hours (40 ms per entry), this means that if you were arrested (even for a spurious charge) and held overnight, they could search your phone without you knowing.
With a password that has the same entropy as 10 random digits, assuming no further vulnerabilities allowing them to speed up the process, it could take up to 12 and a half years to brute force it. Make it alphanumeric (and still random) and it’s millions of years - infeasible within our lifetime - it’s basically a question of whether another vulnerability is already known or is discovered that enables bypassing the password entirely / much faster rates of entry.
If you’re in a situation where you expect to interact with law enforcement, then disable biometrics. Practice ahead of time to make sure you know how to do it on your phone.
(It might apply to other androids too, I don’t know.)
You will now need a pin to unlock the phone. This disables the lock screen shortcut (camera, light, etc) as well.
Why disable your convence features for an scenerio that is not likely and can be quickly and easily be prevented.
Maybe don’t do this one in front the cops…if you find your self in a postion where they are trying to unlock your phone, you probably don’t want to piss them off. .
I’ve avoided willingly using biometrics so far. Though I’m sure our faces, gaits, body shapes, etc, are all stored somewhere, willingly or not.
Say no to biometrics. It’s like having a password you can never change.
A stipulation of Payne’s parole agreement was that he be willing to provide a passcode to his devices, though that agreement didn’t explicitly refer to biometric data. However, the panel said the evidence from his phone was lawfully acquired “because it required no cognitive exertion, placing it in the same category as a blood draw or a fingerprint taken at booking, and merely provided [police] with access to a source of potential information.”
These both seem like bad calls. You have a right to privacy right, and to access your files/home/phone tap requires a warrant.
Fingerprints at booking gives access to public records. Not your own personal private data.
Sucks to be american. Sucks to live in america.
Why would anyone?
No.
I’ve already planned to spam the lock button for a few seconds if something like that came up (iPhone) it triggers the emergency settings and disabled unlock without a passcode.
For Android: learn the hard reset combo for your phone, especially if you encrypt it.
After rebooting, pattern/PIN will be required to un-encrypt the phone. Biometrics won’t work for this step. This is what graphene does for security, tries to keep the phone in a “before first unlock” state by rebooting on a timer. You can’t even read anything over USB/ADB, it’s scrambled until you unlock the phone.
I really think this depends largely on who you are and what you do with your phone. I have face recognition and fingerprint recognition both enabled on my phone. It’s good enough to prevent a thief from gaining access to my device, and if law enforcement asked, there’s nothing on my phone that could possibly be incriminating. Realistically, I’d have no issue just unlocking my phone and giving it to a police officer, although I do know well enough to always get a lawyer first. Biometrics add an extra layer of convenience; it’s nice to just look at my phone and it unlocks. My concern personally is more about someone stealing my phone and accessing my accounts than self-incrimination.
If I ever was going to put myself in a situation where I’d run afoul of the authorities, I’d leave my phone at home anyway.
This isn’t new information. Might be a higher circuit reaffirming it though.
No.
This is the best summary I could come up with:
Last week, the 9th Circuit Court of Appeals in California released a ruling that concluded state highway police were acting lawfully when they forcibly unlocked a suspect’s phone using their fingerprint.
The case didn’t get a lot of coverage, especially because the courts weren’t giving a blanket green light for every cop to shove your thumb to your screen during an arrest.
The ruling was also complicated by the fact that Payne was on parole at the time, back in 2021, when he was stopped by California Highway Patrol where he allegedly had a stash of narcotics including fentanyl, fluoro-fentanyl, and cocaine.
However, the panel said the evidence from his phone was lawfully acquired “because it required no cognitive exertion, placing it in the same category as a blood draw or a fingerprint taken at booking, and merely provided [police] with access to a source of potential information.”
The Electronic Frontier Foundation, a digital rights group, has offered guides for best practices when attending protests, and one of those is to turn off your thumbprint or face unlock before you hit the street.
“The general consensus has been that there is more Fifth Amendment protection for passwords than there is for biometrics,” Andrew Crocker, the Surveillance Litigation Director at the EFF, told Gizmodo in a phone interview.
The original article contains 988 words, the summary contains 217 words. Saved 78%. I’m a bot and I’m open source!
Thank you.
Stop using biometrics period.
carl_dungeon@lemmy.world 6 months ago
You can turn that and Face ID off on iOS by mashing the power button 5 times- it locks everything down.
BrianTheeBiscuiteer@lemmy.world 6 months ago
I’ve always wanted a setting to create a lockdown key and an unlock key. So something like middle-finger to unlock but index-finger to force it into PIN/password only mode. So you can have some convenience of a quick unlock but if an authority figure asks or forces you to unlock it you can one-tap lock it down.
ColeSloth@discuss.tchncs.de 6 months ago
That would be awesome.
Fiivemacs@lemmy.ca 6 months ago
⚠️ WARNING: On android, mashing the power button 5 times calls emergency services…
then_three_more@lemmy.world 6 months ago
On android you can add a ‘lockdown’ mode to the power menu.
victorz@lemmy.world 6 months ago
Not on my Pixel 6. 🤷♂️
UnityDevice@startrek.website 6 months ago
There are two ways you can do this on Android currently, but they’re not as quick. You can try to unlock with the wrong finger 5 times and it will stop allowing fingerprint unlocks. Or, you can hold down the power button for 10 seconds and the phone will reboot and also disable fingerprint unlocking.
MostlyGibberish@lemm.ee 6 months ago
Android has a similar feature. It’s called “Lockdown mode” on the shutdown menu. Locks the phone and turns off any biometric unlocks.
Bonehead@kbin.social 6 months ago
Except it doesn't activate by mashing the power button 5 times. On my Pixel 8, that activates the emergency dialer that will automatically call 911 if you don't cancel the prompt in 5 seconds. I did not know that before. Probably a better use for that feature. It also points out the different ideologies of Apple vs Android.
ShittyBeatlesFCPres@lemmy.world 6 months ago
In a getting pulled over situation, this works. But do it before you go protest anything. Or better yet, leave your phone at home. You don’t want to be reaching for something while a cop is pointing a gun at you and saying “Hands up!”
devfuuu@lemmy.world [bot] 6 months ago
Not to mention it’s pretty regular to track who is participating by checking the towers in the zone all the people are participating.
merde@sh.itjust.works 6 months ago
☞ EFF / Surveillance Self-Defense / Attending a Protest
someguy3@lemmy.world 6 months ago
That’s terrifying. So once we have tech to see inside the brain, that’s will be legal too,
slaacaa@lemmy.world 6 months ago
“You shouldn’t be worried if you have nothing to hide” 🤷♂️
Tap for spoiler
/s
devfuuu@lemmy.world [bot] 6 months ago
Tou think it wouldn’t xD?
kevincox@lemmy.ml 6 months ago
Probably. Wouldn’t it be good to have the truth during investigations?
However I think that we really need refine when warrantless searches can occur. Right now many searches seem to be done with very little evidence to justify them. I think this protection should apply to your mind and phone just like it applies to your house. This probably also needs to be considered at border crossings. Right now they have basically unlimited rights for searching what you have on you with little to no evidence.
We should probably also rethink about how the information is shared when there is a warrant. Right now during a trial a huge amount of personal information can be made available. Maybe if it was easier to get precise information less would be needed.
FederatedSaint@lemmy.world 6 months ago
Do you have to mash it? Or will pressing it normally work?
teacup@lemmynsfw.com 6 months ago
The only thing I’ll mash is that subscribe button
EdibleFriend@lemmy.world 6 months ago
NO
ChaoticNeutralCzech@feddit.de 6 months ago
Pretty sure Apple would replace the buttons with pressure sensors – not for user comfort but so that they are no longer replaceable with OEM parts and can be serialized. They did literally this with Macbook sleep sensors.
catloaf@lemm.ee 6 months ago
Assuming you have the access to do this, e.g. awake, conscious, not handcuffed, etc. It’s safer to just always use a PIN in the first place.
ccunning@lemmy.world 6 months ago
You can also just long press a volume button with the lock button (with a FaceID phone). I find this harder to mess up under stress.
HEXN3T@lemmy.blahaj.zone 6 months ago
On Graphene/Calyx you can auto-restart the phone after a given time period if it hasn’t been interacted with. Recommend turning this on for all users.
cflewis@programming.dev 6 months ago
What’s the name of this feature for GrapheneOS? I’m not finding it.
hubobes@sh.itjust.works 6 months ago
Just hold volume up and power for 3 seconds.
tsonfeir@lemm.ee 6 months ago
Came here to say that! Glad it’s getting around.