News for hackers. Stuff that matters.
Re:Forcing suspects to reveal phone passwords is unconstitut... by ctdonath on Friday September 25, 2015 @10:03AM (#10278171)
Not a new idea. There has long been a meme going around that if you enter your ATM PIN backwards, it will let you access your bank account but silently calls the police to your location (AFAIK it's just an urban myth). False passwords have a much older history than that.

Investigators are going to take a very dim view of such events, and probably didn't get to the point of demanding access without having documented sensible reason to believe the evidence is there - and may very well have actionable proof that you destroyed evidence, which will not turn out in your favor.

Re:Forcing suspects to reveal phone passwords is unconstitut... by dalke on Friday September 25, 2015 @10:20AM (#10278287)
"AFAIK it's just an urban myth"

Your doubt tells us that your PIN is not a palindrome. The second most common PIN is 1-1-1-1, followed by 0-0-0-0 (says http://www.datagenetics.com/blog/september32012/ ), and looking at the top 20 numbers, over 10% of the people have a palindromic PIN. (If selected randomly, that should be 2%.)

So either the police get called a lot, or there's some special flag that say "palindrome PIN - false alarm" (and it must be supported for international cards) ... or it's simply not true.

Re:Forcing suspects to reveal phone passwords is unconstitut... by ChuckMcM on Friday September 25, 2015 @06:36PM (#10281132)
Excellent reasoning. On my home security alarm if you enter your pin +1 or -1 the alarm disables and it does send the distress signal to the police. Its an advertised feature.
Re:Forcing suspects to reveal phone passwords is unconstitut... by tehwebguy on Friday September 25, 2015 @11:16AM (#10278625)
My home security system has a "duress code" that will disable the alarm sound and silently alert the company. It's not the reverse of the normal one, it's a different one that can be set.
Re:Forcing suspects to reveal phone passwords is unconstitut... by shanecleveland on Friday September 25, 2015 @11:44AM (#10278775)
Our system has the same thing. I can see how this would be a useful feature across other devices/technology – If I sign in this way, do this, etc.
Re:Forcing suspects to reveal phone passwords is unconstitut... by tedunangst on Friday September 25, 2015 @05:38PM (#10280855)
I wonder what you're supposed to when the guy holding the gun says "Give the alarm code. Good. Now give me the duress code."
Re:Forcing suspects to reveal phone passwords is unconstitut... by tfigment on Friday September 25, 2015 @09:21PM (#10281723)
You give him any code. Its not like he is going to use it. If there is a pattern like ChuckMcM's where its +1 then give then give that one. Of course in all probability this scenario will never happen and the xkcd wrench is used instead.
Re:Forcing suspects to reveal phone passwords is unconstitut... by cbhl on Friday September 25, 2015 @12:16PM (#10278989)
How likely are you to actually remember the code when you're under duress, though?
Re:Forcing suspects to reveal phone passwords is unconstitut... by ChristianBundy on Friday September 25, 2015 @12:54PM (#10279260)
More than 0%, which makes it more useful than not.
Re:Forcing suspects to reveal phone passwords is unconstitut... by tsotha on Friday September 25, 2015 @04:31PM (#10280504)
You could make it an easy one. Say your normal code is 5829. The panic code should be something like 1111. You'll never key it in accidentally, and people have codes like that, so it won't tip off an assailant.
Re:Forcing suspects to reveal phone passwords is unconstitut... by rhizome on Friday September 25, 2015 @10:08PM (#10281814)
the thing is, it's not the worst thing in the world if a bad person guesses it.
Re:Forcing suspects to reveal phone passwords is unconstitut... by ClintEhrlich on Friday September 25, 2015 @10:10AM (#10278236)
The ATM feature you mentioned is not totally apocryphal. It's a software called SafetyPIN, which has apparently been patented but not commercially adopted.
Re:Forcing suspects to reveal phone passwords is unconstitut... by phlo on Friday September 25, 2015 @11:09AM (#10278588)
We used to have something similar in a previous workplace of mine. Doors were unlocked by touching an RFID badge to a reader and then entering a PIN. If you entered PIN+1 instead, everything worked as normal and a silent alarm was triggered.

The same place also had a security system for a critical data center room: Opening the door from the outside (i.e. entering) would increment a counter by one, opening it from the inside would decrement it. If the room, according to that counter, was supposed to be empty, any movement within would trigger the same silent alarm. The system worked safely up to the point where two people entered together, one of them left the room and the other one's badge had a temporary malfunction. We were quite impressed with how quickly a large assortment of police would show up, guns blazing and all ;-)

Re:Forcing suspects to reveal phone passwords is unconstitut... by biafra on Friday September 25, 2015 @07:26PM (#10281343)
Having always a +1 for a duress code seems like a bad idea. What if a criminal asks for your code and types in the code you gave -1? If it works he now knows you tried to to set him up. If it does not, he can still try the PIN you gave him.
Re:Forcing suspects to reveal phone passwords is unconstitut... by todd8 on Saturday September 26, 2015 @07:15AM (#10282756)
I hope the bad guys don't read hacker news.
Re:Forcing suspects to reveal phone passwords is unconstitut... by dalke on Friday September 25, 2015 @10:22AM (#10278300)
Re:Forcing suspects to reveal phone passwords is unconstitut... by MichaelGG on Friday September 25, 2015 @05:03PM (#10280665)
FFS what a terrible patent[1]. It really is basically "hey what if people put their PIN in backwards; we could call the cops" written out to many pages long. How any patent examiner could read this and think "yes this is novel and obviously required effort worth protecting" is beyond me.

1: https://www.google.com/patents/US5731575

Re:Forcing suspects to reveal phone passwords is unconstitut... by throwawaykf05 on Friday September 25, 2015 @07:02PM (#10281237)
This is a frequent misunderstanding, but the patent system is not subjective. It cannot be, really, if you think about it. It is a legal system and hence has to be as objective as possible.

So patent examiners cannot just look at something and say, "this is crap, no patent for you". They have to prove a patent application invalid. There are many ways to do this, but the most common is by showing sufficient prior art. If they cannot find one or more previously published works that disclose each and every element of the claim, they must allow it. Apparently the examiner could not find evidence of somebody thinking of this before, and so it was allowed, regardless of how novel it appears to us now.

Another way to find an application invalid is to show that it does not disclose enough detail about how to implement the invention. That is probably why this patent (and most others) are really long-winded.

Re:Forcing suspects to reveal phone passwords is unconstitut... by MichaelGG on Friday September 25, 2015 @07:50PM (#10281431)
I read a summary on Wikipedia[1] and that helps. But why should the fact that someone didn't think (or document their thoughts) on something be evidence of non-obviousness?

I think of touch UIs and the patents there, for example Apple's rubber-band scrolling patent[2]. Sure, it's quite probable that no one thought of this before if they weren't designing touch UIs. And even if they were, they might have thought of that, plus several other ideas, while developing. Why should this make any difference?

For instance, no one has made scrolling that intentionally segfaults if you scroll fast enough (or insert other silly thing here). You won't find prior art on this. Should it be eligible for a patent just because it's novel? There should be some sort of criteria where the effort required to invent something is taken into account. If it's likely to come about merely as a result of playing in the space, then what does the public gain by issuing a patent?

What knowledge is contained in the "reverse PIN dials cops" that merits protection? Even if nobody had that idea before (or bothered to document it), what does that matter? If you patent can be constructed just by asking a simple question ("think of some ways to alarm when being robbed at an ATM"), well that should be grounds for it not being valid.

Edit: Another example. Things like algorithms. Look at a simple database indexing system: ISAM. Sort your data, sample every so often to form an index. Repeat if the index is too large. Ta-da. Going back far enough, this was very novel. But any worker that had to figure this problem out would arrive at the same solution. It's nearly as fundamental as binary search.

1: https://en.wikipedia.org/wiki/Inventive_step_and_non-obvious...

2: http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=H...

Re:Forcing suspects to reveal phone passwords is unconstitut... by throwawaykf05 on Friday September 25, 2015 @11:39PM (#10282008)
> Should it be eligible for a patent just because it's novel? There should be some sort of criteria where the effort required to invent something is taken into account. If it's likely to come about merely as a result of playing in the space, then what does the public gain by issuing a patent?

One line of reasoning is that there are not enough people "merely playing in some space" to find more solutions to problems. This is not just theoretical. There is empirical evidence based on historical data that showed how the introduction of patent protection to previously ineligible arts influenced innovation. It finds there was more innovation in areas where previously protection was not available or where it was too easy for competitors to rip off your inventions. See http://www.jstor.org/stable/4132712 for instance.

> If you patent can be constructed just by asking a simple question...

Many scientists, mathematicians and engineers will tell you that the best way to solve a difficult problem is by framing it correctly. Put another way, you have to first ask the right questions. The solution may become obvious then, but it may be very hard to first ask the right question. And hindsight is a very powerful bias. What may seem like a simple question today may not actually have been so before it was posed.

This is also one of the many problems with requiring effort as a criteria. Besides being difficult to quantify in general, how do you measure the effort required to formulate the right question? How do you quantify flashes of insight? Maybe a person has 20 years of experience in some field X, but sees a problem and reaches a solution in 20 seconds. Was the effort required 20 seconds or 20 years?

Re:Forcing suspects to reveal phone passwords is unconstitut... by colanderman on Friday September 25, 2015 @10:09AM (#10278223)
If that weren't an urban myth it must suck to be one of those 1% of suckers with palindromic PINs.
Re:Forcing suspects to reveal phone passwords is unconstitut... by MacsHeadroom on Friday September 25, 2015 @10:57AM (#10278521)
12% of suckers
Re:Forcing suspects to reveal phone passwords is unconstitut... by rnovak on Friday September 25, 2015 @11:42AM (#10278764)
oh man, I'd get killed because it'd be pretty obvious when I start mouthing a 12-digit pin to try and figure out what it is backwards.....
Re:Forcing suspects to reveal phone passwords is unconstitut... by aianus on Friday September 25, 2015 @06:19PM (#10281060)
You have a 12 digit ATM PIN? I didn't know you could do that and I'm 99% certain that card won't work anywhere overseas.
Re:Forcing suspects to reveal phone passwords is unconstitut... by rnovak on Friday September 25, 2015 @07:13PM (#10281290)
Yeah, I just looked and that appears to be true.

Wells Fargo and a couple others allow anywhere from 8-16 as their maximum, though I reduced mine to 12 because some ATM's were kind of finicky at the longer lengths.

Luckily (hah) working for a US company so I don't get enough time off to actually go overseas, so it's never been something I had to worry about.

Edit: It doesn't seem so weird anymore either. I used to get questions all the time from Cashiers, like "Wow, I didn't know your PIN could be longer than 4". But I haven't been asked about it in 1-2 years.

Re:Forcing suspects to reveal phone passwords is unconstitut... by toast0 on Friday September 25, 2015 @07:27PM (#10281351)
my credit union assigned me a 5 digit pin... most atms will accept it, but for those that don't, the first 4 digits work :/
Re:Forcing suspects to reveal phone passwords is unconstitut... by mrits on Friday September 25, 2015 @03:22PM (#10280145)
Awesome, my pin is 4444