News for hackers. Stuff that matters.
Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by bodz on Thursday September 14, 2017 @01:16PM (#15250140)
> The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get in the security line! Pin will be required on start.

As far as border searches go, border officers have the authority to request your PIN just as they have the authority to request your thumbprint/faceprint/etc. If you don't give it to them, you can be detained and/or your phone confiscated [1]. Rebooting your phone won't help.

1: https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by morgante on Thursday September 14, 2017 @02:50PM (#15251214)
They can request your PIN all they want, but you are not obligated to provide it. They can temporarily detain you but not indefinitely, and the EFF is challenging their authority to even do that. [0]

Personally, I would refuse to unlock my phone. My privacy and upholding civil liberties is worth being detained for a few hours (or even days).

[0] https://www.eff.org/press/releases/eff-aclu-media-conference...

Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by thereare5lights on Thursday September 14, 2017 @03:31PM (#15251713)
This only works if your lawyer is with you or you're white.
Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by greenleafjacob on Thursday September 14, 2017 @08:46PM (#15253714)
Why would you have your lawyer with you? Better to have them outside of the range of border control agents (remote) so they don't get arrested too.
Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by philfrasty on Thursday September 14, 2017 @03:40PM (#15251797)
Does this work for non US-residents e.g. tourist, conference, etc? Or do they politely show you the way out (the country)?
Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by morgante on Thursday September 14, 2017 @03:46PM (#15251864)
No, if you're just visiting they can ask for whatever they please.
Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by tastythrowaway on Thursday September 14, 2017 @04:13PM (#15252078)
An important point: the would likely confiscate any devices you refuse to unlock. Is it worth that?
Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by morgante on Thursday September 14, 2017 @04:16PM (#15252115)
Yes. They are supposed to return it eventually, and even if they don't I'm willing to pay $1,000 to protect civil liberties.
Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by 2close4comfort on Thursday September 14, 2017 @03:23PM (#15251624)
Amen!
Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by jfoutz on Thursday September 14, 2017 @02:19PM (#15250899)
Also, the border is 100 miles from the Mexico/Canada borders and 100 miles from the shore. So, if you're concerned it's not when you're entering or leaving the country. It's any time you're in LA, NY, DC, SF, Huston or Detroit. Or any of the other thousands of miles of border.
Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by ianmiers on Thursday September 14, 2017 @04:06PM (#15252019)
Common misconception: If you have crossed the boarder, then within 100 miles of it they can search you.

Of course, how you prove you didn't cross the boarder is an open question. But you can in fact refuse the search on that claim. I suppose they may detain you then.

Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by jfoutz on Thursday September 14, 2017 @04:56PM (#15252447)
I think you're looking for the phrase `probable cause`. If the officer has probable cause to think you crossed the border, they can search you. I'm not a lawyer, but i think they can search you anyway. It just won't be admissible in court.

edit

to clarify, US law pushes police right up to the edge. there is a preference for false positives rather than false negatives. it's more important to catch all of the criminals than it is to inconvenience some innocent people. The risk of letting one criminal go is much more than cost of detaining a doctor for a couple of hours.

Now, we're in this weird time where that doctor can have 20 years of hippa protected medical records in their pocket that they might be forced to disclose. Historically, that doctor may have some records in a briefcase, but not tens of thousands.

Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by jdavis703 on Thursday September 14, 2017 @07:17PM (#15253283)
There are inland checkpoints, even on the Canadian border that search people who've been in the country for a while: http://www.washingtonexaminer.com/border-patrol-checkpoint-i....

They can even nab American citizens for drug possession:

"One of the people arrested was a U.S. citizen who fled the checkpoint and led the police on a five-mile chase. The unnamed man was arrested and charged with three felonies, including reckless driving, possessing a controlled substance, and endangering the welfare of a minor."

Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by apeace on Thursday September 14, 2017 @03:56PM (#15251940)
I read that they are not able to force you to provide a pin.

But even if you're right, this doesn't change my argument. Most people are less secure most of the time in the absence of biometric authentication. Because without it, they will opt for zero security. You can always use the pin in addition, for whatever that's worth.

Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by skore on Thursday September 14, 2017 @05:39PM (#15252736)
You know what would be really neat? A different, restricted/camouflaged unlock when you make a slight facial expression that would probably go unnoticed.

regular face: regular unlock right eyebrow raised a tiny bit: hide my sensitive stuff from a casual search*

*and after a few minutes, if I don't deactivate it, start deleting.

Re:Face ID, Touch ID, No ID, PINs and Pragmatic Security by eridius on Thursday September 14, 2017 @08:09PM (#15253534)
Unfortunately, lying (including fraudulent representation) to a federal agent is a crime (https://en.wikipedia.org/wiki/Making_false_statements).