Hacker News Reader

Comment by ortusdux | Hacker News Reader

Biometrics are not passwords, they are usernames. You can change passwords.

We're at a point where this old saw needs to be retired.

Yes, if a system is storing your biometric data remotely, then it can't be changed and it's a username, not a password.

But modern biometrics don't work that way, at all. The biometrics is stored client-side (hopefully securely and considerable effort is made to realize that hope), and it is used to access a private key which signs a challenge.

The biometric can be revoked, the private key can be revoked, all of these things can be changed by the user.

So let's say someone busts my fingerprint out of the TouchID secure enclave. That's not great (nor is it easy!), but they don't have an ability to generate a private key with it which Apple will recognize: that requires my password.

So I can generate a fresh key, confirm it with my password, and now my copy of the biometric works and theirs doesn't.

Edit: "courts or police can compel your fingerprint but not your password" is a completely different argument, and the solution is a way to rapidly lock out biometric authentication so that the password is a hard requirement. It also doesn't apply in a number of jurisdictions.

As a practical matter, actors who are unwilling to reach for the rubber hose can't get a password, while a fingerprint just requires the willingness to manhandle someone without injuring them, and that much is basically universal.

They are authentication and authorization just like a username/password set. I don't see the Supreme Court allowing this if they won't allow compulsion of releasing a password. Right against self incrimination. Should be interesting though.

"A password, sometimes called a passcode, is secret data, typically a string of characters, usually used to confirm a user's identity."

https://en.wikipedia.org/wiki/Password

There is nothing secret about your biometrics. Especially not while you are in detention.

No but compelling you to use your biometrics to self incriminate is something else altogether.

Imagine their password was written on a bracelet. Plainly visible to the public, easily recreated from photos, and 0% secret. The cops wouldn't even need a court order to read it. That is what biometrics are. They are the sticky note next to the monitor with a password written on it.

The state doesn't need your cooperation to type in a password that is plainly visible though. That's where the self incrimination comes in.

The Supreme Court has repeatedly punted the issue down to state courts. What do you think is different this time?

They'll eventually have to rule on it because the state courts are split, when that is, who knows. It's certainly a 5th amendment case, so they'll have to address it eventually, perhaps they are waiting on the right case? I dunno.

What appellate courts have ruled in favor or biometrics being protected?

That would potentially upend decades of case law - the government can compel somebody to produce a physical key (which now includes fingerprints and other biometrics) but cannot compel production of a passcode/combination.

>What appellate courts have ruled in favor or biometrics being protected?

This article talks about a case in the 11th circuit in 2012 and another in the Pennsylvania Supreme Court, Commonwealth v. Davis. Apparently the only time you can compel someone to give their password (which biometrics serve the same purpose) is if the state already knows what's on there. It's called "foregone conclusion exception."

Yet if the government can show that it already knows of the existence and the suspect’s possession of the documents at issue—i.e., that these matters are a “foregone conclusion” and thus that the factual assertions implicit in the act of production add “little or nothing to the sum total of the Government’s information”—then “no Fifth Amendment right is touched because the ‘question is not of testimony but of surrender.’”

https://crsreports.congress.gov/product/pdf/LSB/LSB10416

i think the difference is compelled speech - you don't have to 'say' your biometric user/pass combo

> Right against self incrimination.

You can be forced to submit to fingerprinting, which could also be incriminating.

That's a good point, but those fingerprints aren't used to open say, a biometric safe. They are used to compare with fingerprints found at the scene of a crime.

Here's some interesting copy on similar cases.

https://arstechnica.com/tech-policy/2020/06/indiana-supreme-...

Quoting: "Reffitt’s lawyer told CNN ...that the laptop is now unlocked."

they are both a username and a password as a single entity, they identify the user and verify said user

> they are both a username and a password as a single entity

And should your username ever also be your password?

Sometimes it is fine, depending on the particular application. I often use a single token to identify myself to office buildings, my car, my house, etc. Even my bank is okay with it, although that is more debatable.

It shouldn't be, but it shouldn't be disallowed.

Reply on news.ycombinator.com