Stop Using Your Face or Thumb to Unlock Your Phone
gizmodo.com
gizmodo.com
On iOS, click the lock button five times. The biometrics reset. A passcode is required.
If you are about to cross a border:
Power your phone off. On iOS this clears any keys stored in the Secure Enclave and it’s much harder to get a forensic image.
In the US, border patrol has a 100 mile jurisdiction from any border. Practically this means they can seize your devices with no pretext at all, and 5th amendment protections do not apply here.
That means anyone in San Diego, San Francisco, Los Angeles, Seattle, etc can have their devices imaged and confiscated for any reason at all.
I don’t know of anyone who has had this happen but given everything going on in the world right now I wouldn’t be surprised in the least if next year we start seeing it happen everywhere
I recall seeing arguments that any airport that has international flights is effectively an "international border" too for some purposes, though I'm not sure where.
Twenty years ago talk like this would be whacko conspiracy talk but 2015 onwards I have seen far too many wild things happen in government that we never thought would happen…
* Lockdown (require PIN to unlock) -- Hold power button 1 second, then tap Lockdown icon on screen.
* Call 911 -- Click power button 5 times, then don't slide to cancel in the 5 second delay.
* Camera -- Click power button 2 times. (If you invoked this while at lockscreen, you'll be restricted to Camera and recent Gallery, AFAICT.)
So, if you're at, say, a heavy-pickpocketing tourist attraction, or high-risk mugging neighborhood, then you might switch your phone to Lockdown, and use this restricted Camera mode when you want to take photos. Then someone just grabbing the phone will still get the phone, but at least not likely be able to access your accounts. (Though, if they try to force your finger or face to the screen, then you might need to calm them down, as you type in your PIN.)
Are you sure about that? I've been able to power on my phone without any connectivity and still access my keychain passwords, which should be locked behind a key in the enclave.
Anything on a smartphone is in the hand of their vendor, if a local cop can't access stuff but have the right to, your data will go to the police, if there is no right to but some State actors do want they'll get your data as well.
Things on such devices are in the GAFAM et al hands, there is no protection.
But that’s not practical for most people and anybody can get talked to by authorities for any reason at all. When that time comes, folk need to know how to reduce their attack surface for anyone looking for a reason to make an arrest
I suggest something different. Do not take any phone you use for accessing anything remotely important. Carry no phone, or carry a burner phone. If you do this regularly, just have a dedicated phone for international travel with nothing except tourist basics on it (uber,etc).
She was held up by CBP, detained in a holding cell for hours. She was not allowed to contact me - or anyone - during this time. They took her phone, scanned it with their software and found a conversation in a messaging app from several years ago where she had joked with a family member about crazy ways you could technically get a green card. They interpreted this as malicious intent, rejected her entry, and physically destroyed her visa paperwork and work authorization cards.
After about 6 hours, a CBP officer called me to tell me they were denying her entry and would allow me to pick which flight she left the country on as long as it left within 24 hours. I bought her a light that left in about 8 hours. I went home and cried.
2 hours before the flight was supposed to leave, I got a call from her. There was a shift change for the CBP workers and the incoming supervisor didn’t agree with what the previous shift had done. He let her into the country, with no paperwork other than a letter that stated her visa documents were “accidentally destroyed” and he recommended she leave the country permanently.
Customs and Border Patrol are no joke. That can and will ruin your life on a complete whim. In her case it all started with a random screening which led them to searching her phone for any reason they could to reject her. The only reason she didn’t leave the county is I happened to pick an outgoing flight late enough that the next shift decided to review the previous shift’s decision.
There is no one size fits all security best practices, you should analyze how much you are at risk before deciding what safe practices would be useful.
I’m sure are right about the numbers, most people won’t go to a protest. But I very much want to live in a country where people can peacefully protest without fear of having their digital lives completely by the government.
And a protest is just one example situation of how this can be abused to trample on privacy rights.
in short - no. A broader view of human nature, and the relationship of an individual adult versus the state or corporate status quo .. says that no, an individual person with rights and privacy does not have to acquiesce to draconian surveillance state record keeping.. and asserting your rights to not participate does not make you a member of the criminal "them" class.
Secondly, snide and smug assertions made in public that do associate privacy and individual rights with criminals, might be made by exactly those who are promoting these kinds of systems, for profit.
summary - no.
Knowing how to set it to require a passcode feels like absolutely important information if you're a political dissident, a journalist with valuable sources, if you live or are visiting somewhere where the police will harass you (or worse) for your private lifestyle, if you're employed by a corporation with trade secrets the government wants to spy on, or of course if you're just a straight-up criminal.
But if you don't fall into these and similar categories, then it seems totally fine to rely on biometrics.
Because this isn't at all a case where just because I have nothing to hide, means I'm cool with eroding privacy protections. The point is that you can protect yourself when you do have something to hide. But me relying on convenient biometric unlocking isn't preventing those who need to disable it from doing so. It's not even making them seem more suspicious, since my iPhone asks me to verify my passcode every couple weeks anyways, or every time it restarts.
Since reading these police access reports from the US I tried using the Secure Folder.
As a digital nomad for past 9 years I visit 10-20 countries a year, so lots of border crossings.
Secure Folder sadly doesn't allow you to hide all your disclosing apps inside.
Certain apps like browsers still need to be run inside your main section, and therefore accessible from a fingerprint login.
And a phone without finger or face login is too cumbersome for digital entrepreneurs in this day & age.
So the idea of shutting off the phone as you cross borders seems to be the best approach for us nomads.
I note the court case wasn't about a border crossing so I'm still looking for practical solutions.
Not being American I, like many, am almost paranoid visiting the US with all its foibles.
Five-times pressing is disabled by default now IIRC, and call the authority when enabled.
If you select lockdown you'll be required to use a pin or password to unlock the phone.
The vast majority of people will never be troubled by law enforcement; phone theft is much more common. Shoulder-surfing someone’s password and grabbing their phone to run out the closing subway doors has been A Thing for decades now.