[nova22033]

Remember...they can make you use touch id...they can't make you give them your password.

https://x.com/runasand/status/2017659019251343763?s=20

The FBI was able to access Washington Post reporter Hannah Natanson's Signal messages because she used Signal on her work laptop. The laptop accepted Touch ID for authentication, meaning the agents were allowed to require her to unlock it.

[wackget]

Link which doesn't directly support website owned by unscrupulous trillionaire: https://xcancel.com/runasand/status/2017659019251343763?s=20

[throwawayfour]

Good reminder to also set up something that does this automatically for you:

https://news.ycombinator.com/item?id=46526010

[forgotTheLast]

I actually think it is fitting to read about a government agency weaponized by an unscrupulous billionaire going after journalists working for an unscrupulous billionaire on an unscrupulous trillionaire owned platform.

[apparent]

There are trillionaires?

[b8]

They can hold you in contempt for 18 months for not giving your password, https://arstechnica.com/tech-policy/2020/02/man-who-refused-....

[ElevenLathe]

Being held in contempt at least means you got a day in court first. A judge telling me to give up my password is different than a dozen armed, masked secret police telling me to.

[noident]

That's a very unusual and narrow exception involving "foregone conclusion doctrine", an important fact missed by Ars Technica but elaborated on by AP: https://apnews.com/general-news-49da3a1e71f74e1c98012611aedc...

[teejmya]

I previously commented a solution to another problem, but it assists here too:

https://news.ycombinator.com/item?id=44746992

This command will make your MacBook hibernate when lid is closed or the laptop sleeps, so RAM is written to disk and the system powers down. The downside is that it does increase the amount of time it takes to resume.

A nice side benefit though, is that fingerprint is not accepted on first unlock, I believe secrets are still encrypted at this stage similar to cold boot. A fingerprint still unlocks from screensaver normally, as long as the system does not sleep (and therefore hibernate)

[jakobdabo]

> I believe secrets are still encrypted at this stage similar to cold boot.

Does this mean that the Signal desktop application doesn't lock/unlock its (presumably encrypted) database with a secret when locking/unlocking the laptop?

[patrickmay]

Is the knowledge of which finger to use protected as much as a passcode? Law enforcement might have the authority to physically hold the owner's finger to the device, but it seems that the owner has the right to refuse to disclose which finger is the right one. If law enforcement doesn't guess correctly in a few tries, the device could lock itself and require the passcode.

Another reason to use my dog's nose instead of a fingerprint.

[parl_match]

I really wish Apple would offer a pin option on macos. For this reason, precisely. Either that, or an option to automatically disable touchid after a short amount of time (eg an hour or if my phone doesn't connect to the laptop)

[thecapybara]

There's only ten possible guesses, and most people use their thumb and/or index finger, leaving four much likelier guesses.

Also, IANAL, but I'm pretty sure that if law enforcement has a warrant to seize property from you, they're not obligated to do so immediately the instant they see you - they could have someone follow you and watch to see how you unlock your phone before seizing it.

[z3phyr]

0.1 in itself is a very good odd, and 0.1 * n tries is even more laughable. Also most people have two fingers touchID, which makes this number close to half in reality.

[goda90]

Remember that our rights aren't laws of nature. They have to be fought for to be respected by the government.

[joecool1029]

> they can't make you give them your password.

Except when they can: https://harvardlawreview.org/print/vol-134/state-v-andrews/

[tedd4u]

75 footnotes for 89 sentences, nice! I guess that's how they roll over at the HLR.

[notyourwork]

I don't get why I can be forced to use my biometrics to unlock but I cannot be forced to give a pin. Doesn't jive in my brain.

[deltastone]

It's something you know vs. something you have. That's how the legal system sees it. You might not tell someone the pin to your safe, but if police find the key to it, or hire a locksmith to drill out your safe, it's theirs with a warrant.

It's interesting in the case of social media companies. Technically the data held is the companies data (Google, Meta, etc.) however courts have ruled that a person still has an expectation of privacy and therefore police need a warrant.

[direwolf20]

When they arrest you, they have physical control of your body. You're in handcuffs. They can put your fingers against the unlock button. You can make a fist, but they can have more strength and leverage to unfist your fist.

There's no known technique to force you to input a password.

[soneil]

Compelled speech is protected, fingerprints aren't.

Imagine it's 1926 and none of this tech is an issue yet. The police can fingerprint and photograph you at intake, they can't compel speech or violate the 5th.

That's exactly what's being applied here. It's not that the police can do more or less than they could in 1926, it's that your biometrics can do more than they did in 1926. They're just fingerprinting you / photographing you .. using your phone.

[wan23]

The fifth amendment gives you the right to be silent, but they didn't write in anything about biometrics.

[sejje]

"technicality" or "loophole" is probably the word.

I fully agree, forced biometrics is bullshit.

I say the same about forced blood removal for BAC testing. They can get a warrant for your blood, that's crazy to me.

[deltastone]

Also, using biometrics on a device, and your biometrics unlock said device, do wonders for proving to a jury that you owned and operated that device. So you're double screwed in that regard.

[direwolf20]

Remember, this isn't how it works in every country.

[mbil]

Reminder that you can press the iPhone power button five times to require passcode for the next unlock.

[rawgabbit]

Serious question. If I am re-entering the US after traveling abroad, can customs legally ask me to turn the phone back on and/or seize my phone? I am a US citizen.

Out of habit, I keep my phone off during the flight and turn it on after clearing customs.

[thecapybara]

Did you know that on most models of iPhone, saying "Hey Siri, who's iPhone is this?" will disable biometric authentication until the passcode is entered?

[fogzen]

In case anyone is wondering: In newer versions of MacOS, the user must log out to require a password. Locking screen no longer requires password if Touch ID is enabled.

[qingcharles]

Everyone makes this same comment on each of these threads, but it's important to remember this only works if you have some sort of advance warning. If you have the iPhone in your hand and there is a loaded gun pointed at your head telling you not to move, you probably won't want to move.

[kstrauser]

Or squeeze the power and volume buttons for a couple of seconds. It’s good to practice both these gestures so that they become reflex, rather than trying to remember them when they’re needed.

[paulsmith]

Alternately, hold the power button and either volume button together for a few seconds.

[tim333]

One thing I miss from windows (on mac now) is there was an encrypted vault program that you could have hide so it wasn't on the desktop or program list but could still be launched. That way you could have private stuff that attackers would likely not even know was there.

[innagadadavida]

Is there a way to setup Mac disabling Touch ID if the linked phone goes into lockdown or Face ID requires passcode? Apple could probably add that.

[rustyhancock]

As far as I know lockdown mode and BFU prevent touch ID unlocking.

At least a password and pin you choose to give over.

[raw_anon_1111]

As if the government is not above breaking the law and using rubber hose decryption. The current administration’s justice department has been caught lying left and right

[qingcharles]

And threats aren't illegal. They can put a gun to wife's head and say they're going to shoot. It's up to you then to call their bluff.

[direwolf20]

Plausible deniability still works. You enter your duress code and your system boots to a secondary partition with Facebook and Snapchat. No such OS exists.

[p0w3n3d]

Allowed to require - very mildly constructed sentence, which could include torture or force abuse...

https://xkcd.com/538/

[neves]

I just searched the case. I'm appalled. It looks like USA doesn't have legal protection for reporter sources. Or better, Biden created some, but it was revoked by the current administration.

The real news here isn't privacy control in a consumer OS ir the right to privacy, but USA, the leader of the free world, becoming an autocracy.