Hacker News Reader

Comment by jimworm | Hacker News Reader

A PSA on biometric security's weakness against coercion - including law enforcement, but likely more often abusive spouses or employers.

View on HN

Unlike the courts, an abusive spouse or employer won't presume innocence. They will take your initial refusal to insert PIN/password as proof of guilt and coerce you into doing so.

With a spouse the 'threat' is that they can unlock your phone when you're sleeping. This isn't about giving in to coercion, but about covert access.

Not sure how this works with an employer though.

That's why iPhones have "Require Attention" option, that checks that your eyes are open and looking into the TrueDepth sensor.

How do they cope against a video of you, like if I pretend to take a selfie but video instead, oh whoops .. but then I have a video to use to unlock your phone?

Or police could use the mugshot process to get a video?

The iPhone camera makes a 3D "scan" by projecting infrared dots onto the face, so putting a screen or sheet in front won't work.

https://en.wikipedia.org/wiki/Structured-light_3D_scanner

Cool, I missed that development; seems it needs a bit of work to crack - https://www.wired.com/story/hackers-say-broke-face-id-securi....

If it’s to this point she needs to leave.

That's not helpful advice to someone trapped in an abusive relationship.

To clarify: if someone is at the point where their SO is snooping around their phone at night, there is a potentially dangerous power imbalance in the relationship. Step one is not "leave". That may not be possible without catastrophic effect in some cases (think stalking, violence, blackmail).

Rather, step one is to prevent the toxic SO from gaining more power over you. (Step two is to reduce their power.) Technology that automatically prevents them from snooping on your digital life is a great way to do this.

(And yes, it is best if the tech is a given. If a toxic partner notices that you are taking actions to keep them at bay, that can be dangerous too. E.g. this is why Facebook broadcasting idle time to everyone in your network is terrible for those with stalkers. The implementors of that feature should be ashamed.)

Biometric authentication should stop working once a lockout has been triggered.

On iPhones it does.

Reply on news.ycombinator.com