As far as border searches go, border officers have the authority to request your PIN just as they have the authority to request your thumbprint/faceprint/etc. If you don't give it to them, you can be detained and/or your phone confiscated [1]. Rebooting your phone won't help.
1: https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...
Personally, I would refuse to unlock my phone. My privacy and upholding civil liberties is worth being detained for a few hours (or even days).
[0] https://www.eff.org/press/releases/eff-aclu-media-conference...
Of course, how you prove you didn't cross the boarder is an open question. But you can in fact refuse the search on that claim. I suppose they may detain you then.
edit
to clarify, US law pushes police right up to the edge. there is a preference for false positives rather than false negatives. it's more important to catch all of the criminals than it is to inconvenience some innocent people. The risk of letting one criminal go is much more than cost of detaining a doctor for a couple of hours.
Now, we're in this weird time where that doctor can have 20 years of hippa protected medical records in their pocket that they might be forced to disclose. Historically, that doctor may have some records in a briefcase, but not tens of thousands.
They can even nab American citizens for drug possession:
"One of the people arrested was a U.S. citizen who fled the checkpoint and led the police on a five-mile chase. The unnamed man was arrested and charged with three felonies, including reckless driving, possessing a controlled substance, and endangering the welfare of a minor."
But even if you're right, this doesn't change my argument. Most people are less secure most of the time in the absence of biometric authentication. Because without it, they will opt for zero security. You can always use the pin in addition, for whatever that's worth.
regular face: regular unlock right eyebrow raised a tiny bit: hide my sensitive stuff from a casual search*
*and after a few minutes, if I don't deactivate it, start deleting.
Your phone can be easily restored from an iCloud backup once you've got access to wifi. You can always restore from another device or backup if there's data you don't want seen if somehow you can be compelled to do a restore.
From macdailynews:
"iTunes backups are still there for iOS devices, but performing a restore won’t transfer your apps from your Mac, but will instead download them over the Internet from Apple, which is, of course, likely to be slower."
My Android forces PIN entry after 5 wrong fingerprints.
So if you chose only 1 finger and you chose it randomly, they will have a 50% chance of getting in after 5 attempts.
I am not saying that I wouldn't mind at all if my phone was searched. But I can't think of anything in particular that I would be concerned about if it was. Sure in theory the agent could remember some personal information and come back later and use that info or pass it to someone for some nefarious purpose. But that's a pretty small chance event. It's more or less the equivalent of thinking you will get sick because you find a hair in your food at the restaurant. You don't like it and you send it back or demand a refund but the actual harm is more mental in nature.
Or what am I missing here?
How do I know the agent isn't downloading the naked pictures of my wife? (There are lots of reasons to not keep such pictures on my phone, but "Because border agents may see them" should not be one of them)
And there's just the futility of it -- if I really had something to hide from the government, I wouldn't keep it on my phone (or if I did, I'd keep it hidden).
the actual harm is more mental in nature.
That doesn't make it any less real - the government should not make me feel violated.
Bikkannavar says he was detained by US Customs and Border Patrol and
pressured to give the CBP agents his phone and access PIN. Since the phone
was issued by NASA, it may have contained sensitive material that wasn’t
supposed to be shared. Bikkannavar’s phone was returned to him after it was
searched by CBP, but he doesn’t know exactly what information officials
might have taken from the device.
I think the reason people focus on border searching so much is that it's presumed to be one of the easiest entry points for the government to spy on you.
Many security researchers, such as people who work on Tor and related technologies, have had their electronics searched and sometimes seized at the border. That makes it particularly relevant to the HN crowd.
For me, I seriously doubt the government would ever be interested in my data. But imagine that the CEO of my company is suspected of some kind of crime. Perhaps when I am at the border they try to image my phone, in order to get access to things which may allow them to control other company assets (servers, etc), which would get them closer to their target.
I doubt it would ever happen to me, but I'd rather take precautions. Being searched at the border seems much more likely to me than, say, the NSA/FBI targeting me remotely with malware.
The border agent accused her of prostitution. He wanted to get into her phone to see her latest Facebook Messenger and Tinder correspondence. She let him because, of course, it's easier than canceling her entire vacation plans.
Now, the tips in this thread wouldn't have helped her. But do you see how it's not just "I don't have anything to hide?" What about not letting some border agent power trip all over you? Reading your Tinder messages for fucks sake?
One such instance included a British guy who had shared a Facebook post recommending giving aid to refugees, Dubai police put him in jail over it - that was over a year ago and I believe he's still there. One instance included a microscopic amount of cannabis found on the sole of a passengers shoe, he got almost 4 years in prison.
There are many many other instances, if locking your phone stops them from even chancing it, it might be worthwhile.
Most first level TSA/DHS people measure the cost/benefit of my assertion and back off.
(1) https://www.vice.com/en_us/article/mvkgnp/law-professor-poli...
I'd personally much rather the State fundamentally respected a right to private and family life, much like article 8 of the ECHR, but fat chance of seeing that in the USA any time soon.
This is what has been missing from every discussion of this issue that I've seen so far.
The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get in the security line! Pin will be required on start.
Pin is also required when plugging into a new computer.
The rest of the time when you're going about your daily life, and are not worried about a government agent spoofing your face or pointing the phone at your face, you can use this nice feature.
Most people will be _less_ secure without it. They don't want to punch a pin every time they want to tap their phone to pay for coffee. So without the face scan feature, they will opt for no security at all.
The reboot/plug-in pin requirements change the discussion quite a bit, but are usually ignored, seemingly so bloggers can state the obvious "but someone can spoof your face!"