Hacker News Reader

Comment by EGreg | Hacker News Reader

That's why this is a dumb idea, merchants can just use the replay attack: https://www.wsj.com/articles/in-china-paying-with-your-face-....

The only place where you should be using your biometrics is to unlock devices you carry with you, like the iPhone.

View on HN

I would argue that the devices you carry with you are exactly the ones you shouldn’t use biometrics for.

Law enforcement can force you to use biometrics to unlock a phone. They have used dead bodies to unlock phones.[0] What they can’t do is make you remember a code/password which you have “forgotten.”

[0] https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-c...

The vast majority people will never encounter a circumstance where that will be an issue. To withhold a (n optional) feature from the masses based on the hypothetical actions of an agency who can abuse your fingerprints but will stop short of torture doesn't really make sense.

HN, and the tech bubble at large, is all about "edge-cases." Too many Debbie Downers getting off on playing "what if" scenarios, while ignoring reality.

1. With police authoritarian levels where they are, I doubt saying "the vast majority" won't encounter similar tactics in the near future would be correct, or at least there is evidence enough to offer strong debate on the topic.

2. Nobody claimed to then want to withhold the feature "from the masses"... so this is a strawman.

3. "hypothetical actions of an agency"... I think it's pretty clear that these types of methods are not hypothetical, and are being used already

4. "will stop short of torture"... I also think it's clear that many LEO's, especially the closer to federal ones, have been found to torture already.

I agree with gp, biometrics on phones are a bad idea all around, for a lot more reasons that have been said. I don't know why you are protesting this idea as you do.

> What they can’t do is make you remember a code/password which you have “forgotten.”

They might be able to with an FMRI machine.

Maybe at some point in the future, but we definitely aren't at the stage of being able to parse out a specific password from an FMRI reading right now.

No, but combined with torture it might be effective enough.

No, I think that adding torture to the mix will make the FMRI results even less readable

What I was thinking was using FMRI to find out if they actually do remember the password (FMRI lie detection really only works with yes/no questions, AFAIK). If they don't know, then torture is a waste of time. If they do know, then you know torture may be fruitful.

FMRI uses indicators like pulse, heartrate, etc. to make a more or less estimate on the truthfulness. Torture can make these indicators useless. Torture is a very flawed method to extract informations. You can't be sure that the victim isn't telling lies or admits to crimes just to make the torture stop.

They can just ‘538 it. https://xkcd.com/538/

For some, being placed in the MRI would be torture. Hope you don't have a plate in your head or other bodily location. Would torturers be so concerned with this, or is that just part of the threat.

TLA person: Give us the code or we put you the MRI machine!!

Victim: Can't you just use a $5 wrench instead?

In the US at least FMRI should fall under fifth amendment, right? Otherwise the fifth amendment would be useless. A right to remain silent wouldn’t exist if you can’t silence your brain. If one day there are stargate replicators that can reach into your mind, would that be legal?

In court, absolutely.

There are still plenty of places where polygraph examinations are used legally.

> What they can’t do is make you remember a code/password which you have “forgotten.”

But they can lock you up for not supplying it.

What good does this do for anyone though?

> Unfortunately for the FBI, Artan’s lifeless fingerprint didn’t unlock the device (an iPhone 5 model, though Moledor couldn’t recall which. Touch ID was introduced in the iPhone 5S). In the hours between his death and the attempt to unlock, when the feds had to go through legal processes regarding access to the smartphone, the iPhone had gone to sleep and when reopened required a passcode, Moledor said.

From your https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-c...

Except the FBI probably won't make that mistake again. They'll wake up a judge and expedite the process, citing this exact case as to why they need to be granted the subpoena. from there it's not that hard to make a jig that constantly does some sort of action so the phone never goes to sleep.

Even for that it's not safe if anyone can bypass it with a $5 trick. It's definitely a thumb idea

You can unlock most home doors within seconds even without having the key

Nonetheless, we still lock our doors and thieves often break in, even though picking the lock is both safer and less likely to arouse suspicion.

Your argument makes sense, but we humans aren't really rational

Breaking into my house doesn't get you my password for all of my accounts though, no matter how much of an invasion of my space it is.

There's a good reason why criminals don't carry lockpicks around and that's because they're regulated, in much of the world mere possession of them outside of your residence is a criminal offence and even in places where you can carry them legally they not only show prior intent, their use in criminal activities carries a charge just like breaking and entering. I'd also argue that being stuck picking a stubborn lock for 2-3 minutes is significantly more suspicion arousing than the literal seconds it takes to break a window but that's neither here nor there.

On the rationality of having locks when criminals can very easily break a window, the old saying that locks keep honest people out rings true. Locks do serve a purpose even if they do very little to slow criminals down. To bring the analogy full circle fingerprint readers always seemed like windows to me in how easy they are to bypass, luckily they're more of a luxury than a necessity. :-)

Lockpicks for the common locks can be made on site in under 5 minutes and then after about half-minute the lock is broken, and picks are discarded.

That is why they aren't carried around any more.

And that is not taking into account that most locks can be defeated without lockpicks, a steel ruler will do.

It's just sad when people that don't know a bit about the trade boast about "regulations" and how they are relevant. They are not.

Lockpicks are not illegal or regulated in UK, you just have to learn how to use them

Criminals don't carry lockpicks because a brick is easier.

> definitely a thumb idea

Four hours have gone by without comment on this and I feel the offense should be recognized.

I thought it was intentional, won’t lie, I laughed.

I can’t put my finger on why though.

until you fall asleep with your phone on you.

Reply on news.ycombinator.com