Hacker News Reader

Comment by nimbius | Hacker News Reader

>Use strong lock-screen pins/passwords: a 6-digit PIN is sufficient if the device wipes itself after 10 incorrect password attempts.

im calling BS. NSO and others have demonstrated repeatedly they can (and do) bruteforce these pin based logins quickly and efficiently without triggering the wipe using sidechannel attacks on running services and software over the air and through USB. use a PASSPHRASE.

>Consider using Biometrics (e.g., fingerprint, face) authentication for convenience to protect data of minimal sensitivity

remember: the fifth amendment does not cover biometrics . if a DUI case can forcibly extract your blood, then you can and will be required to present your face to unlock a laptop. use passphrases.

>DO NOT jailbreak or root the device.

this often allows people to remove pre-installed spyware just as easily as it can be installed.

View on HN

> remember: the fifth amendment does not cover biometrics . if a DUI case can forcibly extract your blood, then you can and will be required to present your face to unlock a laptop.

On the iPhone theres a neat trick: If you seem to be in a situation where you might be forced to hand over your phone (and unlock it with bio), hold down the power button for a second or two (secretly/inconspicuously in your pocket or wherever your phone is). This will disable fingerprint unlocking and you will be forced to enter PIN.

Doesn't seem to work on Android (11 at least) though.

I'd imagine it varies by OEM, as my BlackBerry KeyOne gives me the option to "Lock Now" when I hold the power button for 2 seconds. It does actually lock out biometrics, as I've tested it previously.

My Samsung S10 has an option to "enable lockdown mode" in the power menu which disables notifications, biometrics unlock and smart lock.

Yeah that's tricky to do in your pocket though. If you take out your phone and hastily do something like that you're gonna activate "I have something to hide" suspicions.

But as another commenter pointed out you can hold the power button for a longer time (5+ seconds) and the phone will turn off or reboot, which achieves the same thing. Just quicker and stealthier on the iPhone.

Android doesn't have a stealthy way to do it without powering down, but you can either activate lockdown mode, reboot, or power down and the next access will require PIN, not biometrics.

AFAIK you must hold down both power and volume button on IOS for this to work. On Android there’s a Lockdown mode option which others have mentioned.

Do you have an iPhone at hand to confirm? Because I'm quite sure that just the power button for a second or two is enough. At least it was with iPhone SE (original) back in spring 2020 (I'm nowadays on Android).

> Doesn't seem to work on Android (11 at least) though.

I'd hold the power button a bit longer and turn off the device altogether. Granted, not as convenient.

Hmm okay yeah, that works. Had to hold it for 5+ seconds and then it rebooted.

NSO pwnd Titan M? Source?

Reply on news.ycombinator.com