I’m on a relatively boring android phone and biometrics are only available in circumstances where it’s already vaguely confident it’s you.
Miss the fingerprint reader by too much? It’s now a pin unlock. Haven’t used pin recently enough? No biometrics.
It’s pretty far from being replaced, considering I seem to need to use the pin on the lock screen several times a day at least.
When you go through a border crossing or go to do something that might get you on the RADAR of a police or government entity, just wipe your phone or carry a burner.
They are looking to bypass pretty much any security you use at that point so for that threat profile and the security required to safeguard you, a password will not be sufficient and you are not going to win.
I’m not advocating for or against passwords here. I’m pointing out that A/. you can lockdown the device with key presses to make it require a password, some devices will require a password to be entered at certain intervals and when a device is restarted, and the only time you’d really need to worry about this is when dealing with law enforcement. At which point it’s likely that your particular threat profile would require you to forego biometrics entirely.
But it’s still not the same as no password. There’s still a barrier, but you can be coerced to remove that barrier.
If you don’t think they can force you to give up a pin or password, i would point you to the sheer number of incarcerated people who actually have been proven innocent who admitted to a crime because the police coerced a confession.
At least I’m assuming there’s a difference between wiping a device in preparation to go to a border crossing and wiping a device while in police custody/being detained for further screening by Border Patrol.
You can be forcibly restrained, and have your face or hand forcibly used to unlock and its completely legal.
And while I completely agree a burner is a better choice, it has precisely zero bearing on a discussion about specifically biometrics, police, and privacy in the context of the US.
It has every single thing to do with the bearing of this conversation.
If the police tried to use biometrics to search my device today they would find exactly nothing.
On the average person’s phone they likely wouldn’t find much that’s actionable in a legal sense.
The average person has a threat profile where it’s much more likely that they would worry about a snooping parent, sibling, or significant other, or even coworkers over the police.
That is who biometrics are for.
For anyone else who has a threat profile that should require them to be worried about police intervention or investigation of any kind, there’s either a burner phone or a hardened OS and both of those use cases and the people using them likely aren’t using biometrics. But that doesn’t mean they have a good password either. People aim for convenience and less friction.
So let’s think about what I am arguing here. I am arguing that a burner phone with nothing on it is likely more useful to a person worried about the police getting access to their device than a pin or password is. And that even if you do have a password there is likely a way for them to bypass it or there will be in the future.
You are arguing that even a weak password is better than biometrics, but that is in a singular instance where you are detained by or investigated by the police, and in that event you probably have a threat profile that would require more than just a password lock for your devices. Especially if you’re using a weak password.
How?
You can’t be compelled to give up your password.
A weak password they can guess.
Compared to guaranteed success, a weak password is superior.
Youre comparing a weak password to no password here and suggesting no password is better.
I’m not. I have never seen a device that can be set up without a password or pin in addition to face or fingerprint unlock.
You have to have both.
Once the biometrics are there, it replaces the pin/password in most scenarios I can think of.
Cell phone access, logging into a PC, etc.
Setting up both doesn’t mean that both are required for access.
Biometrics can be compelled (forced). So face or fingerprint can be forced, making them irrelevant to security - the same as no password.
I’m on a relatively boring android phone and biometrics are only available in circumstances where it’s already vaguely confident it’s you.
Miss the fingerprint reader by too much? It’s now a pin unlock. Haven’t used pin recently enough? No biometrics.
It’s pretty far from being replaced, considering I seem to need to use the pin on the lock screen several times a day at least.
https://immpolicytracking.org/policies/ice-notice-of-intent-to-award-contract-to-cellebrite-for-smartphone-hacking-technology/
When you go through a border crossing or go to do something that might get you on the RADAR of a police or government entity, just wipe your phone or carry a burner.
They are looking to bypass pretty much any security you use at that point so for that threat profile and the security required to safeguard you, a password will not be sufficient and you are not going to win.
I’m not advocating for or against passwords here. I’m pointing out that A/. you can lockdown the device with key presses to make it require a password, some devices will require a password to be entered at certain intervals and when a device is restarted, and the only time you’d really need to worry about this is when dealing with law enforcement. At which point it’s likely that your particular threat profile would require you to forego biometrics entirely.
But it’s still not the same as no password. There’s still a barrier, but you can be coerced to remove that barrier.
If you don’t think they can force you to give up a pin or password, i would point you to the sheer number of incarcerated people who actually have been proven innocent who admitted to a crime because the police coerced a confession.
They’re testing that in court right now. That might be “destruction of evidence” after all.
That’s not though?!
At least I’m assuming there’s a difference between wiping a device in preparation to go to a border crossing and wiping a device while in police custody/being detained for further screening by Border Patrol.
Coercion <> compelled.
You can be forcibly restrained, and have your face or hand forcibly used to unlock and its completely legal.
And while I completely agree a burner is a better choice, it has precisely zero bearing on a discussion about specifically biometrics, police, and privacy in the context of the US.
It has every single thing to do with the bearing of this conversation.
If the police tried to use biometrics to search my device today they would find exactly nothing.
On the average person’s phone they likely wouldn’t find much that’s actionable in a legal sense.
The average person has a threat profile where it’s much more likely that they would worry about a snooping parent, sibling, or significant other, or even coworkers over the police.
That is who biometrics are for.
For anyone else who has a threat profile that should require them to be worried about police intervention or investigation of any kind, there’s either a burner phone or a hardened OS and both of those use cases and the people using them likely aren’t using biometrics. But that doesn’t mean they have a good password either. People aim for convenience and less friction.
So let’s think about what I am arguing here. I am arguing that a burner phone with nothing on it is likely more useful to a person worried about the police getting access to their device than a pin or password is. And that even if you do have a password there is likely a way for them to bypass it or there will be in the future.
You are arguing that even a weak password is better than biometrics, but that is in a singular instance where you are detained by or investigated by the police, and in that event you probably have a threat profile that would require more than just a password lock for your devices. Especially if you’re using a weak password.