Hacker News Reader

Comment by sublinear | Hacker News Reader

This is precisely why it's constantly argued that a phone is not a good 2nd factor for authentication. The auth data should be on a device that is basically worthless except for the data it holds which in turn is also inaccessible to someone else.

Arguing for laws that are "tough on crime" is regressive and doesn't even solve the actual problem.

View on HN

How are "tough on crime" laws regressive? What do you think is the actual problem?

I think they mean that just passing laws that make it punishable by say 30 years in prison to steal a phone would be regressive, since the punishment is in no proportion to the crime.

However, what would actually be nice if, like people here have suggested, is that the police would actually bum off to retrieve stolen phones, bikes, etc and then deliver whatever appropriate penalties to the perpetrators if found.

Doesn’t matter if it’s only a small punishment so long as people get their stuff back and the thieves learn they’ll be sought after.

So basically, we don’t need better laws here, simply enforcement of them.

Since rich people are less likely to steal phones, increasing the punishment for phone theft affects rich people less, which means it's regressive.

(I think using this argument to justify being soft on crime is ridiculous. I'm just pointing out what the argument is.)

> Losing a smartphone today can have a profound impact on people’s lives.

This is the actual problem. Theft is also a problem, but not all that relevant.

"Tough on crime" doesn't really prevent crime when the incentive to commit it is still probably higher than the disincentive no matter how "tough" and getting caught is still unlikely.

A trivial, but more relatable, example of this line of (criminal) reasoning is that people are more likely to enjoy extreme sports vs a high paying "dangerous job" despite working the job being less lethal, less accident prone, and a much greater net positive.

Anyway the regression is adding unnecessary laws.

> a phone is not a good 2nd factor for authentication

That's an argument for a phone not being the best 2FA mechanism. The argument for phones as 2FA isn't predicated on them being optimal, it's predicated on them being (1) present in almost all cases and (2) easily used.

Obviously yes, it would be safer if we'd all carry around password-locked yubikeys. But we aren't going to. We do have phones in our pockets, though.

Since phones are now the primary computing device for most people, is it really a "2nd factor" though?

As conventionally defined, yes. The "first factor" is traditionally a password (or in the modern world, maybe password+working_email_address).

You are techincally correct, the best kind of correct, but just for balance I should mention that cavaliers like me end up merging the factors by having all their logins saved on their phones (modulo fingerprint prompts etc.).

Something you have and something you know, yes. But isn't the thing you have supposed to be separate from the client you're using to authenticate?

We're talking about the case where the phone is stolen. There's almost no reason to steal an authentication device other than harassment or tactical delay of access.

Where are people going to keep that second device? In their wallet? The wallet is just as likely to be stolen as the phone.

My employer provides Yubi keys, which have no value other than being an auth mechanism and fit on a keychain. I have one configured as a backup.

> Arguing for laws that are "tough on crime" is regressive and doesn't even solve the actual problem.

There are definitely tough on crime laws that would solve or mostly solve the problem. Unfortunately these will mostly be cases of the cure being worse than the disease (e.g. panopticon with facial recognition and use of face coverings leading to jail time).

>e.g. panopticon with facial recognition and use of face coverings leading to jail time

Yeah. Or the inclusion of accurate GPS trackers in each and every phone, so law enforcement could track them down. That would be truly dystopian!

I always wonder why we don’t use decoys more. Have seemingly tipsy girls stand waving their phone around for a cab and a cop a few feet hidden away. Then stiff penalty. It’ll make people think twice about whether their “mark” is legit.

Same for bike theft…

Because, at least in some jurisdictions, this is regarded as soliciting illegal behaviour.

Which is just as ridiculous as saying that rape victims solicited illegal behavior by dressing provocatively.

AFAIK, in the US, it's only considered entrapment if the officer (or other actor) explicitly entices you to perform an illegal action.

If they stand there, looking like a drug dealer, and you ask… all good.

If they ask you if you want coke, entrapment.

I'm not sure it's as cut and dry as that, but the gist is "would you have committed the crime regardless of the actor's behavior."

Perhaps phone theft is too petty a crime to make it worth it?

In the 80s and 90s bait cars were ubiquitous in cities https://en.wikipedia.org/wiki/Bait_car

I could buy a used car for the price of an iPhone 14 Pro Max.

> Unfortunately these will mostly be cases of the cure being worse than the disease (e.g. panopticon with facial recognition and use of face coverings leading to jail time).

Not necessarily. Even if we didn't catch any more criminals than we do now, you could probably reduce the problem a lot just by making sure the ones we do catch actually go to jail.

Reply on news.ycombinator.com