News for hackers. Stuff that matters.
Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by nerflad on Monday January 14, 2019 @04:12PM (#18906527)
This might be a good time to let others know: Android (at least my OnePlus) has a "Lockdown" mode in the shutdown menu that locks the screen and prevents the usage of the biometric methods. You have to use the password. This is good because passwords have already been hashed out in court and are unequivocally protected by the fifth amendment; you don't have to tell an officer your password (and entering it for them constitutes telling them).
Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by miles on Monday January 14, 2019 @04:18PM (#18906595)
In iOS 11 and higher, you can disable Touch ID by pressing the power button 5 times in quick succession:

https://www.macrumors.com/2017/08/17/ios-11-emergency-sos-di...

> In iOS 11, Apple has added an "Emergency SOS" feature that's designed to give users a quick and easy way to summon emergency services should the need arise. As it turns out, there's a secondary benefit to Emergency SOS - it's also a way to quickly and discreetly disable Touch ID. ... This is a handy hidden feature because it allows Touch ID to be disabled discreetly in situations where someone might be able to force a phone to be unlocked with a fingerprint, such as a robbery or an arrest. With Touch ID disabled in this way, there is no way to physically unlock an iPhone with a finger without the device's passcode.

Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by gph1234 on Monday January 14, 2019 @04:36PM (#18906767)
"Pressing power button 5 times in quick succession" doesn't work on my iPhone 8 Plus running iOS 12. To achieve the same effect, I need to hold the power button and one of the volume buttons for a couple of seconds.
Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by miles on Monday January 14, 2019 @04:42PM (#18906811)
Sorry - looks like the power button x5 trick only works on iPhone 7 and earlier (had tested successfully on a 6S before posting): https://support.apple.com/en-us/HT208076
Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by basil-rash on Monday January 14, 2019 @07:28PM (#18907913)
On later phones its power and volume simultaneously.
Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by darkpuma on Monday January 14, 2019 @08:01PM (#18908055)
> "summon emergency services should the need arise"

What does that mean? It calls 911 or the local equivalent? That doesn't seem like desired behavior if you're triggering it in anticipation of crossing a border.

Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by judge2020 on Monday January 14, 2019 @08:36PM (#18908197)
There's a slider to call 911/emergency services (as well as to show medical ID). You can configure it to call 911 after 3/5 seconds but even then there's the second countdown with a cancel button. It prevents biometric unlock either way.
Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by renholder on Tuesday January 15, 2019 @04:05AM (#18909785)
This is assuming you have the time to do so. In the shock and awe practices of law enforcement in the states, no-knock-warrants by SWAT teams at 3am in the morning aren't an unheard of thing. Do you honestly think, in that precise moment, you'll remember to run and grab your phone and implement the lockdown mode before they breach into the premises?

I'd say it's better security practice to only use a passcode and, if you must use any biometrics, use an obscure finger (like the side of your pinky finger or something) - whilst also enabling the the auto-wipe feature after 10 failed login attempts.

IANAL but from what I understand of the current goings on in the states, the police have to tell you which digit to try. Just as a password is protected, knowledge of which digit and how it should be placed is also - technically - protected. Think of it like two-factor authentication: The fingerprint is what you are, which was can be used to unlock the phone, but divulging the "which finger and how it should be placed" is what you know.

I can't seem to find it but people were "hacking" the biometrics of Androids with 3D printed heads. The trade-off of convenience for security isn't really worth it.

Again, IANAL, and IMHO, and - if you care about privacy - you shouldn't use biometrics whatsoever but I understand the trade-offs between convenience and security and why so many people fall into that trap.

Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by dragonwriter on Monday January 14, 2019 @08:06PM (#18908074)
Lockdown mode is a new feature in Android Pie: https://www.androidauthority.com/android-pie-lockdown-securi...
Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by jedberg on Monday January 14, 2019 @04:19PM (#18906598)
iPhone too. Press the power button five times and it goes into password only mode.
Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by coralreef on Monday January 14, 2019 @04:30PM (#18906714)
Holding the power + volume button also forces a lock, and is more discreet in that it doesn't make blaring beeps and call emergency.
Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by dylan604 on Monday January 14, 2019 @04:38PM (#18906786)
the beeps can be turned off, though, so that's a good thing.
Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by dylan604 on Monday January 14, 2019 @04:38PM (#18906783)
it depends on what phone you have. the key press combo is different depending on what model you have. the 6s+ is 5 presses of the power key, but that is a very conspicuous thing to do. other/newer models have a much more inconspicuous button press combo that could be done while "attempting" to hand over the device.
Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by chucksmash on Monday January 14, 2019 @04:27PM (#18906684)
Don't know how vanilla this is, but on a Moto g^6 I have configured biometric auth but have to auth via PIN 1) every time I boot the phone and 2) every 24 hours.

Waiting for a case where the FBI bangs down Google's door to get access to a locked Android phone before I make any assumptions about the security implications of that though.

Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by eloisant on Tuesday January 15, 2019 @03:46AM (#18909704)
Also, and I think it works on all Android, if you press the fingerprint sensor with the wrong finger 5 times it deactivates it. So just hit it with your pinky or any other non-registered finger.
Re:Feds Can't Force You to Unlock Your iPhone with Finger or... by chrisper on Monday January 14, 2019 @04:25PM (#18906651)
It's also in EMUI 9 (Huawei) now.