I had a chuckle at this being a "non-issue". Where I am from, you'll get a severe beating (or worse) if you refused to provide the authentication credential, whatever it might be. It's like we're living on different planets. I can only humbly suggest fighting for your rights tooth and nail while you have them.

Oh, I'm well aware.

I've spent 25 years fighting against intrusions in our rights. Admittedly, quietly and sadly, mostly unsuccessfully as every year things are eroded further and further.

I don't think the US will ever devolve into a scenario where the police will beat you for refusing to provide your password, I don't even think we will end up in a situation where police can legally compel you to give up your password. I think we will end up where cloud providers will be legally compelled to provide data on request (banning E2E) and consumers will be incentivized (both in unnatural and natural ways) to more deeply rely on cloud services.

It always seemed like the 'fake' encrypted data, e.g. hidden volumes on veracrypt[1] seemed like one of the better options for these situations. Obviously phones don't have them and the data has to be believable, but it gives you an out.

1 - (I'm not sure what this is technically called)

One of the older and more entertaining names is Rubber hose encryption.

When faceless Zombie thugs of a military junta beat you with a rubberhose you can give up successive passwords to deeper and deeper "secrets" until finally(???) your embarrasing stash of midget donkey necro porn is revealed!! .. and no one can ever establish whether there is yet another password that hides your local contacts in the resistance.

The success of this may vary in practice and black site .. but mathematically the theory is sound.

Today we have the less evocative name Deniable encryption.

Fun Trivia:

    Rubberhose (also known by its development codename Marutukku) is a deniable encryption program which encrypts data on a storage device and hides the encrypted data. The existence of the encrypted data can only be verified using the appropriate cryptographic key. It was created by Julian Assange, Suelette Dreyfus, and Ralf Weinmann as a tool for human rights workers who needed to protect sensitive data in the field and was initially released in 1997.

https://en.wikipedia.org/wiki/Deniable_encryption

https://theconversation.com/profiles/suelette-dreyfus-1102/a...

Where are you from where there are no human rights, if you don't mind me asking?

Stock Android doesn't have a shortcut to disable thumbprint, to my knowledge, but it does require passcode on reboot. So a long hold of the power button would avoid this 5th amendment loophole.

My android phone would refuse to unlock with biometrics and requires pin unlock every 24h. Is that manufacturer-specific feature?

On GrapheneOS (what I use) there's this at least: https://grapheneos.org/features#more-secure-fingerprint-unlo...

I don't see why the police couldn't keep an iphone in evidence for months while they attempt exploits to gain access. That's already happened right? I'm guessing that law enforcement will continue to push for companies to install backdoors for them in their devices as well.

I think the point was that after more than a couple of hours you should not be able to unlock a device using biometrics alone. I would tend to agree. Biometrics are a convenience, but also a weakness.

Correct, that was my point, and iOS already does this. I'm surprised Android does not.

Android does this too.

The phone in this case was in his car door, he would have had to do that while pulling over or while pulled over for the initial traffic violation.

On a Pixel phone, you just select "Lockdown" from the same menu that you use to power off or restart.

Also on LineageOS, and probably any close-to-AOSP Android. You have to enable "extended power menu" or something like that, though, and I don't remember the setting being super obvious.

Yeah, I just checked my Samsung tablet (also Android), and it required enabling it somewhere in settings. I wish they'd enable it by default. I'm not sure why it wouldn't be that way.