Judge Rules on Phone Fingerprint Lock

[Ben]

I think we talked about this a bit in the Apple thread. Now confirmed by a judge's ruling that you can be forced to unlock your phone if it's fingerprint protected. LE can in fact duplicate your prints if you don't physically cooperate to open the phone (or, I'm guessing, anything else that's biometrically protected).

Passcodes (and I assume pass patterns) are still safe from legal coercion as they are a form of knowledge, vs physical evidence.

I'm very curious on the "stuff that's not a phone". Could I be forced to open my biometric gun safe, but not my combo gun safe?

http://www.foxnews.com/tech/2016/05/03/woman-ordered-to-unlock-iphone-with-fingerprint.html?intcmp=hpbt3

[Unisaw]

What ridiculous hair splitting.    Am I right in thinking that a touch ID is more secure unless government overreach is your biggest concern?  How many unique digits (no pun intended) are associated with a fingerprint scan in iOS?

[HeroHog]

The problem with fingerprint scanners is that they are easily spoofed. It is surprisingly easy to steal someone's fingerprint then make a usable facsimile that will fool the reader.

[brimic]

If you know that you are about to be arrested, it only takes about 5 seconds to turn the fingerprint unlock off on an iphone. 

I'll just reiterate:

[MechAg94]

The problem with fingerprint scanners is that they are easily spoofed. It is surprisingly easy to steal someone's fingerprint then make a usable facsimile that will fool the reader.

How is it done then?  I recall a Mythbusters episode where they couldn't do it with the easy solutions they had.  I am sure it is possible, but I didn't think it was particularly easy.

[HeroHog]

http://phys.org/news/2005-12-biometric-expert-easy-spoof-fingerprint.html

http://www.greenbot.com/article/2144601/samsung-galaxy-s5-s-fingerprint-scanner-hacked-by-print-spoofing.html

http://www2.washjeff.edu/users/ahollandminkley/Biometric/

http://www.businessinsider.com/researcher-spoof-fingerprint-with-inkjet-printer-michigan-state-university-2016-3?r=UK&IR=T

Google "spoofing fingerprints"

[HeroHog]

I recall a Mythbusters episode where they couldn't do it with the easy solutions they had.

The Mythbusters made many bad assumptions/misunderstandings in several of their experiments/methodologies that even I and thousands of others caught. MOST was pretty good though I must admit.

[Ben]

If you know that you are about to be arrested, it only takes about 5 seconds to turn the fingerprint unlock off on an iphone. 

I'll just reiterate:

Well, regarding the comic, there's probably a difference between being taken into a back room at the CIA and being taken into the interrogation room at the local PD with your attorney sitting next to you. :)

In the case of the OP link, they're talking about what you can legally be forced to do, versus physically forced to do.

[AJ Dual]

How is it done then?  I recall a Mythbusters episode where they couldn't do it with the easy solutions they had.  I am sure it is possible, but I didn't think it was particularly easy.

They got it to work with a fingerprint made from gelatin lifted from a co-workers mug.  Dusted it, scanned it, cleaned it up digitally, printed it, then used the printout to circuit board copper-etch a fingerprint, then cast that in gelatin. Involved, somewhat sure, but it worked. I'd say it was trivial... if the "reward" to breaking the fingerprint lock was a few million dollars in stolen money/goods, or some uber-sensitive .gov secrets.

There were OTHER hacks and cheats they had, and the Mythbusters was actually approached by a group of RFID industry and government figures asking them to NOT air the segment.

[HeroHog]

In short, biometric fingerprint readers, at least at the mid to lower end of the spectrum, are easily defeated (kept from working) and spoofed (made to work by someone other than the authorized user).

[HankB]

Special fingerprint app.

Swipe index finger of right hand, phone is unlocked.

Swipe thumb of right hand, phone is bricked.

(Finger choice optional.)

[Firethorn]

Swipe thumb of right hand, phone is bricked.

Note paranoid enough.  Thumb of right hand unlocks the 'clean' partition, which has only enough activity to make it look real.

Middle finger unlocks the real partition.

Index finger not only unlocks the clean partition, it wipes the secure one...

[RocketMan]

Note paranoid enough.  Thumb of right hand unlocks the 'clean' partition, which has only enough activity to make it look real.

Middle finger unlocks the real partition.

Index finger only only unlocks the clean partition, it wipes the secure one...

Wouldn't it be more appropriate to have the middle finger unlock the clean partition and wipe the secure one?  One last act of contempt for authority.

[brimic]

Note paranoid enough.  Thumb of right hand unlocks the 'clean' partition, which has only enough activity to make it look real.

Middle finger unlocks the real partition.

Index finger only only unlocks the clean partition, it wipes the secure one...

pinky print starts 20 second timer on small explosive charge inside the phone.

[Firethorn]

Wouldn't it be more appropriate to have the middle finger unlock the clean partition and wipe the secure one?  One last act of contempt for authority.

Perhaps, but most people use their index to unlock.  You go for the middle finger for the wipe, they might catch on and stop you, or toss you in the clink for destruction of evidence.