May favourite attack of that kind has been the one where a CCC-hacker stole the German defense ministers finger print... using a DSLR camera and a tele lense at a press conference: https://www.theregister.com/2014/12/29/german_minister_finge...

Sorry but I have to nitpick here. Nobody was ever able to verify the fingerprint was the same as the German defence ministers.

What the attacker was able to do was take a high resolution photo of the defence ministers thumb and then produce a "fingerprint" that they could use to register as a "fingerprint" on their own phone and then unlock that phone with the "fingerprint".

It could be nothing like the defence ministers actual fingerprint but just look enough like any real fingerprint to register with a fingerprint scanner on a phone.

Thanks for the nitpick, you are right, but given the state of photogrammetry today I wouldn't be surprised if just a few pictures would be enough to give you an accurate representation.

If it was a good photograph Tia would be pretty easy to verify visually. It would also be trivial to replicate on towels to see if your methods actually were adequate to authenticate on your own device.

But that wouldn’t work with TouchID sensors right? They also check for “living tissue”. And at that point the attack becomes _very_ expensive to perform

I mean, as a electronics guy I'd say it kinda depends on how that living tissue detection is being done. You can trick a lot of sensors into outputing things that don't make much sense if you know which physical properties they are looking for.

The most sophistication would probably be something like a PPG (optical reflection changes due to blood flow in certain bands). If the fake is thin enough the PPG would likely just shine through it. Skin resistance/humidity can be easily faked as well.

It was mentioned elsewhere in the thread that a not too thick layer of gummy bear could fool it, due to light passing through it, but getting reflected back from the back. Not sure how true is it though.

Oh, I remember this, but I didn't know it was Ursula von der Leyen, now president of the european commission.

That’s exactly what I had in mind when writing that. That was a good one!

A glass?

I mean... Wouldn't there be a bunch of my fingerprints on the phone itself?

And if my bag gets stolen along with the laptop and possibly the phone, wouldn't there be fingerprints on pencils, water bottle and the phone charger?

https://hackaday.com/2015/11/10/your-unhashable-fingerprints...

Where the finger print comes from isn't really the point. The point is that a random opportunistic thief that finds a phone and wants to go spelunking is most likely not dedicated, capable or willing to go through that and your data stays safe.

Bringing us back to the discussion about threat models :P

Never forget the $10 wrench method.

The $10 wrench always works: biometrics, passwords, encryption keys, physical keys, PINs, etc.

But if you have wrench in your threat model you're either in a really bad situation or you're rich enough to have personal security making the wrench method a lot more complex.

It's either Mossad or Not-Mossad.

>My point is that security people need to get their priorities straight. The “threat model” section of a security paper resembles the script for a telenovela that was written by a paranoid schizophrenic: there are elaborate narratives and grand conspiracy theories, and there are heroes and villains with fantastic (yet oddly constrained) powers that necessitate a grinding battle of emotional and technical attrition. In the real world, threat models are much simpler (see Figure 1). Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from [email protected]. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. In summary, https:// and two dollars will get you a bus ticket to nowhere. Also, SANTA CLAUS ISN’T REAL. When it rains, it pours.

https://www.schneier.com/blog/archives/2015/08/mickens_on_se...

The full article is a good read too. Such a great writing style.

Man, inflation is everywhere these days...

Obligatory xkcd https://xkcd.com/538/

Oh, man! The wrench actually costs only $5.

Police can compel people to provide biometrics to unlock their devices, but passwords can be forgotten.

That doesn't always work out that well for the person "forgetting" the password though: https://en.wikipedia.org/wiki/Key_disclosure_law

Exactly, this depends a lot on jurisdiction. I seem to remember that there are some places where you could basically spend the rest of your life in jail if you forget (with or without scare-quotes) your passport.

Yeah... It's like child support laws here where I live (never had to pay child support, have a friend that is a lawyer). They can hold you indefinitely until you come up with what they need. Forgot the password? Ah well, how convenient! We have this place just for you to sit and hopefully.one day remember!

Child support here, while I agree it should be being paid but people can run into hard times, is sort of like this but more ridiculous. If you are.behind on child support, they jail you indefinitely until you can pay it.... But you are in jail indefinitely and likely have lost your job if you had one. So....

That's a choice however, assuming you know it.

on iPhone, you can press the `power` and `volume down` buttons for a few seconds and Face ID is disabled until you enter the code.

On Android, this is (usually, vendors may vary) hold down `power`, then tap "Lockdown" on the screen. I do like the fact that on Apple you can do it without interacting with the screen.

Similarly, tapping the power button five times in close succession will put an iPhone into "emergency mode", which (a) brings up a screen with prominent buttons to call 911 or your emergency contact and (b) disables biometrics until the PIN is provided.

Volume up works too.

You are right. I incorrectly assumed that since `power` + `volume up` takes a screenshot, it wouldn't work, but I just tried it, and holding them for a few seconds does lock the phone too.

Clicking power 5 times also seems to work!

In the US, the idea isn't that the password can be forgotten, but that passwords are protected speech, which can't be compelled. This legal theory hasn't been fully tested, though — I wouldn't depend on it unless it was upheld by the Supreme Court, but I'd expect this Court to give the police absolutely anything they want.

This isn’t true in most of the world and is even questionably true in the US

It will remain questionable in the US until it reaches the Supreme Court.

IMO is clearly a violation of the 5th amendment, but the Bill of Rights in the US has been soo watered down at this point they may not even be considered rights any more....

4th amendment, I think. Regardless, given the current composition of the Court, I wouldn't hold your breath for the situation to improve.

One could make that case, but 4th allows for searches with a warrant

I would say 5th because divulging the contents of ones mind is testimony which one should not be compelled to do, the 5th profits you from being a witness against yourself, reveling a password is being a witness against yourself

Fifth: the password is testimony. It's searching their things, but the warrant issued by the court means that it's likely a reasonable search (ergo, not a violation of the 4th).

Adding to that: just because someone has your fingerprint, they won’t have full access since you can’t reset to a new iPhone and get the backup with just the fingerprint. It’s the combination of fingerprint + the previously authenticated device