Kinda surprised biometrics are recommended. I’ve always thought passcodes were more secure - particularly as the data is not easily accessible by interrogators for example.
> requiring a defendant to expose his face to unlock a computer can be lawful, and is not far removed from other procedures that are now routinely approved by courts, with proper justification: standing in a lineup, submitting a handwriting or voice exemplar, or submitting a blood or DNA sample
Contrasting the logic used by a judge in a similar case in (2019) [2]:
> If a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one’s finger, thumb, iris, face, or other biometric feature to unlock that same device
Ars has a summary of more cases [3]. It looks like in several instances state courts allowed the devices to be unlocked using biometrics, but the rulings were reversed at the federal level. In many cases a warrant was required.
3. https://arstechnica.com/tech-policy/2020/06/indiana-supreme-...
Biometrics is good for law enforcement but is it tougher for hackers?
Maybe by the NSA. Any defense attorney will tell you otherwise. If your fingerprint unlocks your phone then the cops will hold your finger to the phone. If you face unlocks your phone then they will do that too. A pin/password means you retain at least some control.
If this was an Archer episode, I'd point out that while dead people cannot divulge pins/passwords their fingerprints still work.
Passwords are better than biometrics for security; but between password validations, presuming some level of convenience is needed, using biometrics to check that the same person is still there is better than "just stay unlocked for a few minutes even after being put to sleep".
It's like HTTP Basic Auth (sending credentials with every request), vs. logging in, receiving a short-lived session cookie, and then sending that session cookie with your requests for a few minutes.
It’s not perfect, but I think it strikes the best balance.
Remember this is for people working on sensitive information.
This is what the NSA's original mission was, to keep people safe and strengthen the American defense posture from the single person up to the entire infrastructure that we rely on day-to-day. The mission has shifted to offense after 9/11 so there's conflicting goals here (can't patch something we're using against the bad guys)
The only shift after 9/11 was getting the three agencies to actually talk to each other.
https://www.nsa.gov/about/cryptologic-heritage/historical-fi...
> The Brownell Committee suggested that the creation of AFSA could be seen as a "step backward," and recommended that the power of the director, AFSA, to centralize COMINT be increased.
> In October, Harry Truman authorized a reorganization and renaming of AFSA, and in November, the secretary of defense authorized the replacement of AFSA by the National Security Agency.
The NSA director even said they were appalled how the agents were portrayed and went on PR campaigns to defend them selves. They were always spying but not ruthless killers as depicted in the movie.