Hacker News Reader

Comment by ianferrel | Hacker News Reader

In the February 2017 case of a California artist who was questioned at San Francisco International Airport upon re-entry, after he finally agreed to unlock his iPhone, it was taken out of his sight for several minutes and could have been imaged without his knowledge. Under iOS 11, unless the artist, Aaron Gach, decided to actually give up the passcode (rather than type it in himself), he could at least have been reasonably confident that the phone could not be imaged without his knowledge.

So, doesn't this just mean that border agents will force you to write down your password, key it in themselves to verify that it works, then walk away with the phone to image it?

View on HN

As mentioned elsewhere, Apple can't prevent "rubber hose decryption" (where someone compels/coerces/tortures you to get access to an unlocked phone). I suspect this feature wasn't designed to prevent that threat.

My guess is this somehow foils or mitigates the workaround that the Israeli company sold to the FBI after the San Bernadino phone issue.

They could add a "duress passcode", with an alternate reality of data. I don't expect them to, but it's possible. Bitcoin hardware wallets have this kind of feature to help avoid wrench attacks.

Lying to a federal agent is a crime.

Edit: No seriously. See https://en.wikipedia.org/wiki/Making_false_statements. Refusing to unlock your device is one thing. Claiming that you did unlock it but in fact just used a "duress passcode" is a lie and can land you in jail.

Has the 5th amendment been officially repealed?and the 4th?

The 5th amendment does not protect you from lying. And the 4th has nothing to do with lying either.

And neither necessarily applies at a border crossing

Beating a human is a crime.

This makes me wonder something. I know that while they can't force you to enter your passcode, they can force you to unlock with your fingerprint. I've heard people ask for a feature where you basically have a "duress fingerprint," since fingerprint is already different than password, would using a duress fingerprint be acceptable?

If you're instructed to unlock the phone with your finger, and your "duress fingerprint" unlocks fake data, then you're misrepresenting that fake data as the real data and would presumably be considered to be making a false statement (though this is just speculation on my part).

On the other hand, a "duress fingerprint" that locks out TouchID wouldn't be misrepresenting anything. But it wouldn't surprise me if they could still get you in trouble some other way for knowingly locking out the device after it's been confiscated.

That would be the technical equivalent to the fifth amendment.

The 5th amendment says you can refuse to incriminate yourself. It does not say you can lie.

Refusing to unlock your phone would be equivalent. Unlocking fake data would not.

I believe if you tap the power button 5 times on the iPhone, it disables fingerprint unlock. Perfect for a scenario where you are afraid you might be compelled to fingerprint.

This is apparently an upcoming feature in iOS12 but doesn't work in iOS11 now

What does work is putting the wrong finger on your sensor until it tells you TouchID is disabled and needs your passcode (which is 5 times) or rebooting your device without logging in.

So don't lie about it.

"I just entered my duress pass code, the device is now wiped".

Can they charge you with destruction of evidence when they have no idea if/what evidence was on the phone?

I'm pretty sure they can. And they will probably successfully argue that since you did destroy evidence, you were hiding something.

How do you honestly think that will go down for you or anybody else that tries it, telling a federal officer that you just destroyed the thing they asked you to open?

If you're willing to destroy the data to prevent it being read, why not just wipe the phone before you leave and restore it from an encrypted online backup when you arrive?

Arriving with "empty phone" has also caused refusal of permission to enter in the past.

With the facial recognition tech they might be able to measure duress. Or geofence known customs checkpoints. Would love to reasonably claim that I can't give up my data while I fear for me freedom.

I believe that they simply dumped the NAND to circumvent the passcode entry limit then brute-forced. But it was also an iPhone 5C model which does not include the Secure Enclave. This method could not be reproduced on any model beyond the 5S.

What Apple could do to is to move the bar from "rubber hose decryption" to "rubber hose account access" by offering a dead simple cloud recovery. Imagine a "Flight mode" where everything on your phone is backed up to apple and your phone is presented with an "enter backup id and password" dialog which allows you to load anyone's cloud backup and is essential a factory reset. Border control might still force you to enter a backup id and password under the assumption that you surely have one, but (to my limited knowledge of the US legal framework) it would not be a felony to load a "duress" backup id (because there is no such thing as a duress backup id, just different data sets).

It does. But if your a US citizen or are ok to be barred from entering the US for a long time, then you have the option to not unlock.

If you go the US citizen route, be prepared to never get your phone back and many future border crossings to be 4+hr affairs where they confiscate most of your things.

As a US citizen they have to let you in.

If you do have money and effort to spare though, perhaps you can file a suit that gets up to the Supreme Court after enough of those 4hr border crossings.

My guess is that those with money and effort to spare will not be required to endure this ritual (they know who they're dealing with).

> As a US citizen they have to let you in

True, and of course they can arrest you the instant they let you in.

Yes, but an arrest requires evidence that you actually committed a crime, whereas border searches require no particular standard and are conducted relatively indiscriminately. Refusing to unlock your device is not a crime in itself. (However, lying to a federal agent is a crime, so it's important for anyone attempting this strategy to be forthright about their refusal, rather than trying to trick the border agent with fake data or whatnot.)

Rubber Hose Cryptanalysis?

Can't wait for iOS to have the deniability factor of having different passwords unlock different things :)

For the sensitive stuff, have periods of time that require several computers to solve cryptographic challenges in order to unlock the phone. Some of which may be your friends' devices. If they don't hear from you and your intended hosts in a certain amount of time, phone stays locked.

Or one of the devices can be an NFC or Wifi hotspot in a certain area, and one at home. If you don't reach it, phone stays locked.

That's the worst case for rubber hose.

Even if you give up all your passwords they can still keep beating you to get the "real" pass.

They should have an "erase everything" password.

If you are under the threat of violence that won't save you.

But maybe death is preferable to living with your anime collection out there.

I'm calling Poe's law here. I hope you do not serious mean that anime collections are shameful.

s/anime/youknow/ aka Rule34.

better yet, a pass code option to show a bare user account without access to the real user data

If you are realistically in a situation where that would happen, and you would be harmed, they may just decide to kill you as you're no longer of any value.

In this case, a blank phone probably means no entry and not actually harming you. So, there's that, I guess.

Why can't they do that ANYWAY?

So you are afraid of actors that would torture you to get access to the data.

And your "solution" is to share this experience with your friends by tying their devices to yours and setting up a device in such a manner that that actor would not be able to verify if they indeed have access to the real data stored on it.

This is a recipe for a one way ticket to a very dark place for you and your friends.

For the most part the number one rule of actual data safety is that never implement protection that would put your well being or the well being of others at risk, unless you are protecting the nuclear launch codes no data is worth being physically harmed for.

> unless you are protecting the nuclear launch codes no data is worth being physically harmed for.

What if you’re just protecting the location of your daughter/sister from her physically abusive ex? Not worth enduring some violence for?

In that case they would come to break your face to begin with not your 256bit encryption.

So, since the vendor will undoubtedly inject themselves into this complex situation for 'usability', you are basically arguing for devices that are never actually controlled by their user because terrorism. Good 9/11 argument there.

What are you TALKING about?

The user controls their device to the exact same extent now. You have to trust the apps and OS you use. And iOS isn't exactly open source either.

I am saying the user can choose to select beacons to unlock their phone during a trip somewhere. The user CHOOSES to lock their phone in a way that requires things additional to the password, things that represent having made it safely past the security lol.

This is a rare case where multi-factor authentication, and the option to involve biometrics as hardened sub-layer auth, would be nice.

To be adequately effective, though, all back-up activities would require the full authentication credentials for all verification factors, which might only be possible with, say, a fingerprint scanner (touchbar) equipped laptop, or additional external hardware peripherals for other types of systems.

"Multi-factor authentication" doesn't make sense unless you're communicating with a server over the network. Biometrics can be copied and faked. Ultimately it's security theater.

Nothing beats a strong password.

Yeah, this XKCD never been so true as it is now. https://xkcd.com/538/

Reply on news.ycombinator.com