Hacker News Reader

Comment by DanHulton | Hacker News Reader

I don't think it went far enough. Consider the circumstance where an office or agent wants your phone unlocked. Your passcode is protected, your thumbprint is currently in debate, but holding your phone to your face? If that just always unlocked your phone without any sort of interaction from you? That's an uncomfortable level of privacy loss.

View on HN

Thumbprint is not currently in debate, a Virginia judge ruled it lawful for police to force you to unlock your phone.

https://www.theatlantic.com/technology/archive/2016/05/iphon...

iOS 11 has cop mode at least.

iOS beta has a feature that lets you force passcode authentication without a reboot; I'm assuming this would disable Face ID as well but I don't think we'll know for sure until the new hardware and software are out in the wild.

http://gizmodo.com/a-hidden-trick-in-the-ios-11-beta-lets-yo...

A sufficiently motivated and legally-empowered government official will always be able to find a way to unlock your phone. If nothing else, plenty of governments would simply torture you until you gave up the passcode.

Biometric/facial ID/etc. are conveniences for the masses. They're not ever going to stop the secret police, and bringing up that they won't stop the secret police is not a useful objection, since nothing you can do will stop sufficiently-motivated secret police from being able to force you to access something you have access to.

I guess this can't be repeated enough: press the side button 5 times and it'll require a passcode. You can do this as you're handing it to the officer.

All of this debate is pretty irrelevant since refusal to unlock a phone is reason for police to hold you indefinitely until you unlock it. It's a misconception that locking with a passcode means you've "defeated" the police somehow. Most officers probably won't deal with the hassle, but if the officer is in a particularly bad mood or if they have reason to suspect you actually do have something incriminating, the officer will just hand it back to you and tell you to unlock it, and if you don't, to the holding cell you go.

Obviously the choice is going to be between complying or a holding cell. This allows you to make that choice instead of having it made for you. That's not irrelevant at all.

False. CBP yes. Police no. You do not have for follow their orders except for their safety. They'll have to drag you before a judge to force you to unlock it. And even then it is questionable is providing a password is protected constitutionally. Courts have ruled differently on this.

Not false. Police can ask for your password, and if you do not give it to them, you can be arrested pending a hearing with a judge. The judge can then compel you to give up the passcode (though they probably won't unless there's reasonable suspicion that you're hiding something - but again you're just banking on the judge's mood/feeling at that point), and if you don't, you can be held in prison until you do give it up.

The "questionable constitutionality" of it is irrelevant since in practice until there is a higher ruling on this, if you don't want to go to jail, you must give up your passcode.

They did say you have to look directly at the phone. If looking away is enough to prevent it from unlocking, that doesn't seem too bad.

Effectively you'll need to have your head on the table if you're ever detained, or be closing your eyes shut and not able to walk, or waving your head around. Any of those could be seen as not complying with police.

Just as not providing your thumb would.

> They did say you have to look directly at the phone.

But it will work with sunglasses too? I find it hard to believe. Just slap some sunglasses on the perp and unlock his phone. easy peezy.

It learns your face and can work around haircuts, sunglasses etc.

Well but that's the exact point - if it can work with sunglasses on,then it means you can force it to ignore whether someone is looking at it or not. Put sunglasses on someone unwilling to look at the phone - bam,done, phone unlocks without a problem.

How does it work around sunglasses if Apple also said you have to have your eyes open?

Just a guess: it uses infrared to somehow determine where you are looking, and sunglasses don't block infrared.

If this is true, then require looking directly into the camera is useless. Border agent could simply put a pair of sunglasses on you and unlock your phone easily.

In addition, you also have to have your eyes open for the phone to unlock.

So it will not work with sunglasses? FAIL if true.

They said it works if you are wearing glasses, so it will probably also work with sunglasses

Glasses are much more see-thru than sunglasses and therefore it may work with glasses but not sunglasses

This doesn't use visible light - it's IR.

A lot of IR is blocked by sunglasses. I know my IR iris scanner on my S8+ rarely works through sunglasses.

Rule of thumb - power off Phone. IPhone will force passcode on first unlock

In iOS 11 you can also quickly press the power button five times to require passcode for next unlock without turning the phone off.

something you should do if you're going to an airport/border/protest/pulled over/etc

If you watched the demo, they explained you have to be looking at the phone and have your eyes open. Forcing someone's eyes to open isn't impossible but would be difficult.

> Forcing someone's eyes to open isn't impossible but would be difficult

1. Be at border.

2. CBP officer requests to unlock my phone.

3. He/She holds it up to my face to trigger the unlock.

4. I close my eyes to prevent the unlock.

5. The officer presses the end of his/her gun on my head and tells me to open my eyes within the next five seconds.

6. I comply to avoid having my brains splattered on the pavement.

7. ???

8. iPhone is unlocked.

Or, you know, anyone else who wants to unlock it (cybercriminals, pickpockets, etc) can simply threaten your life over a phone (since, let's be real, people have died for less in the first world).

I don't see your point. This is true, but it's true for everything. Passwords, biometrics. Even a physical key.

If your point is no lock is safe from someone saying "I will kill you if you don't unlock this" then yeah, that's true.

Steps 5-8 are the same if you have a passcode lock too.

And step 9 is simple, call the bluff.

I don't see how this is a change from other identifications methods (passcode, fingerprints). If someone is ready to use unlawful violence to get your phone, you have no real way of avoiding it.

Some friends and I have defeated a few other devices with face unlock features. It was the super technical task of finding and printing a photo found on social networking sites, then holding it up to the camera. I wonder if apple has hardened against this.

30 seconds of googling would've told you that it uses a 3D mapping camera + IR to scan your face.

So no, printing a photo found on social media won't work. 3D printing a perfect model of a face might, we'll see.

Unlikely, since they hardened their model against professional face masks.

but the market for professional face masks that can pass a faceid check just opened up.

They did mention in the keynote that they worked with photos, as well as professional maskmakers and makeup artists to prevent this

It uses a depth sensor. And they have trained the neural networks to prevent using 3d printed masks instead of the real face. I guess they are using depth-ir-powered-video instead of still photos.

Did you watch the keynote?

Reply on news.ycombinator.com