Hacker News Reader

Comment by SEJeff | Hacker News Reader

I suspected that they used Cellebrite for this three days ago:

https://x.com/SEJeff/status/1813079033430876433

As much as it makes folks reel, this is working as intended. If you don't want them to crack your phones, consider setting a 10+ digit alphanumeric passcode instead of a numeric PIN.

Also, do not enable the biometrics such as FaceID. I'm very much of this opinion[1] that biometrics are usernames, not passwords.

[1] https://blog.dustinkirkland.com/2013/10/fingerprints-are-use...

View on HN

In addition to the problems you mentioned, biometric systems are basically designed to cause hash collisions. And probably to a higher degree than most people realize.

After all, it would be annoying if FaceID failed just because I haven’t shaved today. So the algorithm has to account for that. As such, the entropy of the input is reduced.

> Also, do not enable the biometrics such as FaceID

I'd really like to see the ability to set a specific fingerprint to lock down the phone, requiring a different, more secure credential from the regular lockscreen to unlock. A long passphrase would probably be the right credential for most people.

If you hold power and a volume key on an iPhone will disable biometrics and require your password.

That's almost as good, but maybe harder under duress. As far as I can tell, Android requires interaction with the touchscreen.

I'd like to have different fingers do different things, including one that prevents fingers from working And have a short extra custom gesture to face to unlock Or a dozen of other simple things we could get with a little more competition in a more open space

I'm not sure FaceID would have helped them as much in this instance going by pictures of the aftermath.

Numeric pin? Seems like fingerprints on the glass alone would make a shorter numeric pin trivial to crack.

I'm just thinking of all the other weak security systems like garage door keypads where the code is derived from the more worn buttons. Or cleaning/dusting an ATM keypad before someone enters their code and then carefully examining the buttons afterwards.

But who knows — perhaps people have completely munged up their displays making fingerprinting useless.

There are some touchscreen input systems that will randomize the configuration of the numbers displayed to mitigate the "finger smudge" attack.

Man that would suck. I rely on muscle memory to recall passwords in everyday usage. Of course I could open a PWD manager elsewhere but it becomes cumbersome.

You would be surprised. After a couple days only, my brain adapted to the random layout well enough that it's the regular layout (on my iPhone, which doesn't seem to have the randomization ability) that throws me for a loop.

Would the ATM thing actually work though? Afaik most European ATM banks issue 4 digit pin codes and will block and eat the card at 3 invalid tries. Not sure how many tries you have total, but I figure it's not that easy to guess it right.

Update: ChatGPT says 12 tries total to get it right, so that makes it ~10% success ratio?

I probably read about this technique in Phrack or something similar .... so that kind of dates it.

Yeah it could be very well possible that it wasn't limited to just 3 tries back then, or at the very least the ATM would not block and eat the card then, allowing you to try again or at a different machine.

> As much as it makes folks reel, this is working as intended. If you don't want them to crack your phones, consider setting a 10+ digit alphanumeric passcode instead of a numeric PIN.

Can't emphasize this enough. If you're going to use a phone, set a long strong password. Nothing else will do. Yes, it's a bit more inconvenient. There is no workaround.

And turn your phone power off before committing a crime…

The first thing the police will do is connect it to power battery packs

Don't even bring your phone with you. You need to use old school methods to avoid tracking.

But if you leave your phone at home only on the days you commit crimes, it's a problem too. This was used in the past to identify people.

ALPR is the other big one. Your daily habits are in many databases and it’s easier than ever to sort out the outliers

I read this story many years ago where researchers were able to re-identify people using open travel datasets.

https://www.unimelb.edu.au/newsroom/news/2019/august/myki-pr...

Reply on news.ycombinator.com