Hacker News Reader

Comment by dillonmckay | Hacker News Reader

Only one of those can unlock your phone while you are unconscious, or with a body part that has been removed.

If someone is going to go to the lengths of cutting off your finger to get into your phone, I would suggest you're screwed anyway because they seem like the kind of people who'd chop off your/your wife/your children's fingers to get you to unlock it if you had a passphrase anyway.

Consider someone robbing you in a dark alley. They just want your phone and to disable any security alarms/tracking that may exist in the phone. They certainly have no motivation to cut off your finger, but now you've given them one

Consider also a roommate or someone you've recently started seeing. They can very easily unlock your phone by using your finger while you're asleep. They could shoulder-surf as well, but you can be vigilant against that. It's almost impossible to be vigilant against someone grabbing your finger while sleeping

> It's almost impossible to be vigilant against someone grabbing your finger while sleeping

I believe most phones have a way to easily disable fingerprint or face unlock until the next time the pass code is entered.

For example, on recent iPhones, just hold both the power button and one of volume buttons down for a couple seconds, which brings up the screen for power off, medical ID, and emergency SOS. Hit cancel on that screen, and biometrics are disabled until you next enter the pass code.

It should be reasonably possible to be vigilant enough to do that before going to sleep.

There's no value to a robber of unlocking an iPhone with a fingerprint. Unless the phone is dissociated with an iCloud account (which requires entering the user's Apple ID and password) it's useless for anything other than for spare parts.

There is if you’ve allowed touchID for bank accounts and have ability to transfer money. Also, it could happen if you’re a heavy sleeper or passed out drunk.

Over here (UK) at least, I think a lot of phone thefts are done by people on mopeds who grab phones out of peoples hands while they're using them, so the phone is already unlocked.

>> or with a body part that has been removed

If I remember the order correctly: One of the first attacks on finger print readers was to blow on them, making them read the remains on the previous fingerprint used. That was fixed by adding a temperature sensor to the reader, so to attack it you had to use a plastic bag with water at around human temperature. The easy fix was to also check for a pulse while reading the fingerprint, this also make it impossible to use a removed body part.

I have not kept up with the progress in the last years, so not sure how good creating a fake fingerprint that you put on top of your own prints work, like they do in movies. Finding and reproducing a print is not that hard.

As others have written, fingerprint are usernames. It is not secret and you can not change it

Those would be the "attackers willing to go that length" the person was referring to. If these are the adversaries you want to defend against, your solution is even simpler - don't store such secrets on your phone. Also maybe hire a bodyguard.

If those are your adversaries, they are going to use rubber hose decryption.

If someone have lifted your pin/password, they can very much unlock your phone while you are unconscious.

IMO a combination of bio-metric and pin/password/phrase would be a good solution.

"or with a body part that has been removed"

wow. in what line of business do you work if you don't mind me asking?

Technology.

;)

Just stealing your drinking glass to get a good print to replicate seems to be almost as reliable as detaching body parts, with much less mess.

Is that more of a day-to-day problem for you than shoulder surfing? I ask because I used to have a drinking problem, too.

The kind of criminal prepared to knock you unconcious or remove a thumb is pretty rare.

I'd say finger removal is a few steps less likely than knocking someone unconscious, esp. if you can knock them unconscious and then clone their fingerprint.

Mind you, there are some quite dumb criminals, so "likely probability" besides "how likely am I to get robbed?" likely goes out the window.

There’s quite a few people that knock themselves out with drugs like alcohol.

Reply on news.ycombinator.com