Hacker News Reader

Comment by qingcharles | Hacker News Reader

Note: the verdict only applies to those in Utah. Other US states have other rulings. Wait until there is a US Supreme Court ruling that affects the entire nation.

Right now: do not use biometrics (can be legally forced); do not use numeric passcodes. Use alphanumeric password.

View on HN

On iPhone at least you can require passcode by holding down the side button and either of the volume buttons for three seconds. Just ignore the power down/SoS screen that comes up (or tap cancel) - by the time you see it Face/Touch ID is already temporarily disabled. The iPhone will also give you a "rumble" confirmation so you can do it when the device is in a pocket, bag, etc.

Obviously doesn't help if they pull an elaborate Russ Albrecht-style move but useful for situations where you can see them coming (which is likely most of them).

Reaching into your pocket or bag right when you see the police coming after you may not be a great idea either.

> On iPhone at least you can require passcode by holding down the side button and either of the volume buttons for three seconds.

Caution, this may call 911 depending on your settings.

Settings > Emergency SOS > Call with Hold and Release.

You can also disable Face ID by pressing the power button 5 times - which can also be a 911 shortcut, check the settings in the same place.

Calling 911 requires a longer hold, typically: if you let go when the haptic feedback happens, you won’t call 911

But you may want to call an ambulance to be on the safe side.

> Caution, this may call 911 depending on your settings.

If the police already have you, calling 911 on accident probably isn’t a concern.

This basically happened to me when I was cuffed in the back of a squad car on the way to jail. I told the dispatcher I was being kidnapped. The cops in the front gave me the side-eye.

Let me see if I can get the recording via FOIA...

> On iPhone at least you can require passcode by holding down the side button and either of the volume buttons for three seconds. Just ignore the power down/SoS screen that comes up (or tap cancel) - by the time you see it Face/Touch ID is already temporarily disabled.

You can also press and release the power button five times consecutively for the same power down/SOS screen, and then the biometric lock gets disabled (requiring the device passcode).

On Android, hold the power button* until the power down menu comes up, then press "lockdown".

* This may vary by phone, but I'm not sure.

It still very much annoys me that this requires interacting with the touch screen to accomplish.

You will not have time to reach into your pocket when getting arrested. Just turn the biometrics off.

I would likely have the phone in my hand already.

Excellent coverage about this here: https://reason.com/volokh/2023/12/14/is-compelled-decryption...

The author thinks this could be the case that goes to SCOTUS.

Disabling biometrics can be done trivially quickly, and means you don't have enter your passcode in any observable way.

I promise you, from experience, it is not quick enough.

I know, also from experience because it was something I specifically tested, I can do this in the time I take to pick up the device, or take it out of my pocket.

Unless your concern is your device is out of your control when it is seized, in which case you could mitigate your concern by locking it when it will be out of your control, or if you really want to just never enable biometric authentication. Of course that puts you back in the bucket of every time you unlock your device it can be observed.

How are you going to touch the phone when there is a gun to your head and you have been told not to move an inch or you will be shot?

See the second sentence: "Unless your concern is your device is out of your control when it is seized, in which case you could mitigate your concern by locking it when it will be out of your control, or if you really want to just never enable biometric authentication"

I'd be willing to bet that even if it becomes federal law, it won't apply inside of airports. Not to mention that most of the world is not the US.

Well, borders in the USA have a special exemption to the 4th Amendment, so take everything with a grain of salt if you are entering or exiting the USA.

Why not numeric?

Too few possibilities?

How is a 6 digit pass code too few possibilities when the phone locks you out after like 5 missed attempts? It seems unrealistic to expect people to type their alphanumeric password every time they want to unlock their phone.

If these are implemented in software it'd be possible to brute force offline and bypass the timeout

I watched a video where they had the iphone cracked open and slightly modified in a way that would allow them to reset the storage to brute force quickly without timeouts.

That shouldn’t be (at least easily) possible on newer iPhones anymore. The counters are now in rollback-protected dedicated memory; the lockout is implemented in the secure enclave.

Sure, but this is all protected by dubious hardware that often gets cracked. A text password is protected by pretty sound math.

If I recall correctly, some early techniques to unlock passcode-protected phones involved bypassing the user interface and trying passcodes at a point in the execution flow prior to the code that locks out the UI.

I think modern devices have addressed this in various ways, but it’s not a good idea to rely on timed lockouts when it’s possible that techniques exist (or could eventually be found) to bypass the lockout.

In short, assume those lockouts are targeted at normal users. A sufficiently motivated actor with technical resources is another story.

I am thinking that a numeric code is something that people can see you typing in again and again.

An ex-bf/gf that hates your guts will remember that your pin is 1-2-3-4-5-6, because that one time your hands were wet and she needed to see that photo from that party and you told her the PIN..

While if you have a word, new bf/gf will mean new word, and good luck knowing that.

A numeric code may be easier to shoulder surf. Nothing prevents you from changing a numeric code or ensures you will change an alphanumeric code however.

Glad runescape solved this in 2004 by implemented randomized positions for each digit

Heck, the keypad at my church in my hometown did this back in the mid to late 90's (if not sooner)

The government will clone your device hard-drive, then be able to attempt to unlock it on many simulated devices in parallel, until one unlocks.

Then they can unlock the actual device.

I don't think this is meaningfully true for modern phones. The passcode is used by the phone's TPM to derive the actual encryption key, which never leaves the TPM. TPMs are designed to be impossible to retrieve the secret key from without being physically destroyed to prevent the kind of attack you describe.

This is why phone cracking devices like Cellebrite rely on exploits in phones rather than just cloning the disk and trying the small number of possible passcodes.

That doesn't work with iPhones, the Secure Enclave in the only thing that can unlock the phone, and after the attempt limit is exceeded, passcode-protected data is erased by Secure Storage.

I guess if they really wanted to they could attempt to decap the chip and do something with a hardware attack, but thats difficult and dangerous.

How does gray key bypass this then? GK is still being purchased and sustainability contracts issued for LE today so I would imagine they have a way of attacking it, particularly 6 digit pins or less

Literally the point of the HSMs in phones and laptops is to stop that.

If your device's encryption key is produced by a PBKDF then yes it's doable, but no actually secure system works like that. The way a secure system works is

1. You have an HSM ("Secure Enclave" in Apple speak, Trusted Computing Module in MS speak, and I can't recall the google/android name)

2. The HSM generates a random encryption key (or family of keys)

3. The HSM encrypts and decrypts the data with those keys (the keys themselves never leaving the HSM)

4. The HSM gates access to those keys based on an attempt limited use of your passcode/password

There were common flaws a few years ago that meant that you could glitch the HSMs into (essentially) not incrementing the attempt counters or similar but I haven't heard of such in a few years now (almost a decade now? essentially these kinds of flaws were discovered en mass once HSMs reached consumer hardware so more security researchers were able to investigate)

The important thing though is the encryption key is now fully random, rather than derived from your password, which is the difference between a 128+ bit key and a ~40-60 bit key.

For dummies like myself, an HSM is a hardware security module.

Gah sorry, I was like “don’t use a useless marketing name” so instead I used a useless acronym instead, huzzah! \o/

In some cases, they can attack the password outside the phone / device environment by comparing hashes.

At the very least, such an effort may well be able to reduce the problem space considerably, leaving it down to a few guesses on the device.

I can’t seem to find it now, but I remember a news story a while back where a police agency was able to unlock an iPhone with a 6 digit numeric passcode in a little over a year, bypassing the hardware security module and time limits.

Prior legal rulings in the USA have been vague, but said that a numeric code does not require you to "testify" in that you don't really have to use a thought process. I'm paraphrasing, but basically numeric passcodes have been exempt from your right against self-incrimination.

Reply on news.ycombinator.com