Hacker News Reader

Comment by seethishat | Hacker News Reader

Knowledge-based access (something only stored in your head) has Constitutional protection in the United States. The same is probably not true for physical things such as phones and YubiKeys stored in your pocket.

Not that I worry about that, but it is worth pointing out that you may lose some legal protections when you use physical things rather than your knowledge.

View on HN

Do you have a source for this? As far as I know, it's at best a legal gray area. I believe in most cases you'll still be held in contempt of court for not producing secrets needed to access information which the authorities have a warrant for.

Additionally, it's a bit silly in the context of email since the authorities will obtain it from the service provider anyway.

That said, you can still add an encryption key to your phone and you're back to "knowledge based" with the additional caveat a thief would also need the hardware as well.

That's heavily dependent on which country you're in. In France[1] it can go up to 5 years in jail for refusing to provide a password. In the US[2], it seems that passcode are protected since you may be self-incriminating but FaceID, passkeys and fingerprints are not. UK seems to allow police to require you to give your password under their anti-terror laws.

[1] https://news.ycombinator.com/item?id=33550824

[2] https://www.selectlawpartners.com/faqs/do-you-have-to-give-p...

[2] is the "constitutional protection" grandparent comment is talking about, since it is ruled by the US Supreme Court.

The real answer is you shouldn't tell law enforcement anything without an attorney present, and the best advice would be to heed your attorney's advice on the matter for whether you personally should give up your passwords or not.

You can get passkeys with knowledge-based access if you use 1Password, or if you set a PIN on your YubiKey: https://support.yubico.com/hc/en-us/articles/4402836718866-U...

I have the most amazing coincidence to report about what protects my phone and Yubikeys.

Unfortunately, the forensic devices that easily extract data from your phone, can't be plugged into your head.

According to the manufacturers, those forensic devices also don’t work on my iPhone unless it’s unlocked with a password, but this is also irrelevant because they can get the stored passwords from the same phone in any scenario where they can access the passkey.

More to the point, this is also not what the average computer user is worried about. It assumes that they’re targeted by police, have something they need to keep secret, and that those police can compel physical access but scrupulously obey civil rights protections.

> The same is probably not true for physical things such as ... YubiKeys stored in your pocket.

There's nothing preventing you from password-protecting your YubiKeys.

Right, they can seize my yubikey but the 5th amendment protects me from being compelled to hand over the pincode protecting it.

On the other hand, passkeys are almost exclusively used to authenticate to some service that can just as well be subpoenaed directly.

Exceptions do exist; two I can think of are passkey-based cryptocurrency wallets and the so-called "PRF extension" that allows using a passkey as a source of entropy for e.g. locally encrypting a password manager's database.

Reply on news.ycombinator.com