▲ 249 ▼ No Google, Adding Biometrics is the Opposite of Security and Privacy (infosec.pub) submitted 1 week ago by CubitOom@infosec.pub to c/cybersecurity@sh.itjust.works 109 comments fedilink hide all child comments
[–] ricecake@sh.itjust.works 2 points 1 week ago (1 child) No one can force you to give up the PIN. They can threaten, and you may give in to that threat. But that isn't forcing, that isn't against your will. That's called force, and against your will. That's just fundamentally not understanding how the terms work. A coerced action, or one taken under duress, is not taken of ones own free will. https://www.law.cornell.edu/wex/duress permalink fedilink source parent hideshow 2 child comments replies: [–] twjolson@lemmy.world 1 point 1 week ago (1 child) My comment was in reply to another saying a bad guy can force you to put your finger on the unlock sensor. There is no equivalent for pins. They can threaten, yes, and you can give into that threat. Yes, that would be against your will, but it still requires you to acquiesce or cooperate was my point. The can't get the pin without you giving it. permalink fedilink source parent hideshow 2 child comments replies: [–] ricecake@sh.itjust.works 2 points 1 week ago (1 child) Yeah, and if you're being robbed they'll probably fuck you up pretty badly if you don't. While not mind readers, they don't have to be. In most cases anyone who wants to beat your pin will just watch you unlock your phone. They don't need to see the exact numbers: you can pick most of it up just based on relative finger motion. Looking at screen smudges gives another set of hints that are pretty trivial to extract. If your goal is to keep it from the police, your best bet is to use an entirely different system than rely on your phones lock screen. I can't think of a scenario where I'm thinking both "biometrics are insufficient to safeguard this data" and "it's appropriate to keep this data on my telephone". permalink fedilink source parent hideshow 2 child comments replies: [–] twjolson@lemmy.world 1 point 1 week ago (1 child) You aren't wrong, but this discussion is mostly about edge cases. The average person, yea, they won't have anything that is end of their world if a bad guy accesses it. But, that does mean there aren't many phones that contain significantly more important data than you have. permalink fedilink source parent hideshow 2 child comments replies: [–] ricecake@sh.itjust.works 2 points 1 week ago (1 child) Given we're in a thread about biometrics being the opposite of privacy and security, it really does seem relevant to me that the threat model where they would be insufficient and the one where that would matter is basically empty. If your thought process is "I need to protect this from the police and a determined or sophisticated criminal, but I can't be bothered to use anything more than my lock screen on my phone"... Well, you're already starting from a pretty bad place. permalink fedilink source parent hideshow 2 child comments replies: [–] twjolson@lemmy.world 0 points 1 week ago Nothing in that reply is even close to anything I've said. Don't waste my time with stupidity or strawmen. permalink fedilink source parent
[–] twjolson@lemmy.world 1 point 1 week ago (1 child) My comment was in reply to another saying a bad guy can force you to put your finger on the unlock sensor. There is no equivalent for pins. They can threaten, yes, and you can give into that threat. Yes, that would be against your will, but it still requires you to acquiesce or cooperate was my point. The can't get the pin without you giving it. permalink fedilink source parent hideshow 2 child comments replies: [–] ricecake@sh.itjust.works 2 points 1 week ago (1 child) Yeah, and if you're being robbed they'll probably fuck you up pretty badly if you don't. While not mind readers, they don't have to be. In most cases anyone who wants to beat your pin will just watch you unlock your phone. They don't need to see the exact numbers: you can pick most of it up just based on relative finger motion. Looking at screen smudges gives another set of hints that are pretty trivial to extract. If your goal is to keep it from the police, your best bet is to use an entirely different system than rely on your phones lock screen. I can't think of a scenario where I'm thinking both "biometrics are insufficient to safeguard this data" and "it's appropriate to keep this data on my telephone". permalink fedilink source parent hideshow 2 child comments replies: [–] twjolson@lemmy.world 1 point 1 week ago (1 child) You aren't wrong, but this discussion is mostly about edge cases. The average person, yea, they won't have anything that is end of their world if a bad guy accesses it. But, that does mean there aren't many phones that contain significantly more important data than you have. permalink fedilink source parent hideshow 2 child comments replies: [–] ricecake@sh.itjust.works 2 points 1 week ago (1 child) Given we're in a thread about biometrics being the opposite of privacy and security, it really does seem relevant to me that the threat model where they would be insufficient and the one where that would matter is basically empty. If your thought process is "I need to protect this from the police and a determined or sophisticated criminal, but I can't be bothered to use anything more than my lock screen on my phone"... Well, you're already starting from a pretty bad place. permalink fedilink source parent hideshow 2 child comments replies: [–] twjolson@lemmy.world 0 points 1 week ago Nothing in that reply is even close to anything I've said. Don't waste my time with stupidity or strawmen. permalink fedilink source parent
[–] ricecake@sh.itjust.works 2 points 1 week ago (1 child) Yeah, and if you're being robbed they'll probably fuck you up pretty badly if you don't. While not mind readers, they don't have to be. In most cases anyone who wants to beat your pin will just watch you unlock your phone. They don't need to see the exact numbers: you can pick most of it up just based on relative finger motion. Looking at screen smudges gives another set of hints that are pretty trivial to extract. If your goal is to keep it from the police, your best bet is to use an entirely different system than rely on your phones lock screen. I can't think of a scenario where I'm thinking both "biometrics are insufficient to safeguard this data" and "it's appropriate to keep this data on my telephone". permalink fedilink source parent hideshow 2 child comments replies: [–] twjolson@lemmy.world 1 point 1 week ago (1 child) You aren't wrong, but this discussion is mostly about edge cases. The average person, yea, they won't have anything that is end of their world if a bad guy accesses it. But, that does mean there aren't many phones that contain significantly more important data than you have. permalink fedilink source parent hideshow 2 child comments replies: [–] ricecake@sh.itjust.works 2 points 1 week ago (1 child) Given we're in a thread about biometrics being the opposite of privacy and security, it really does seem relevant to me that the threat model where they would be insufficient and the one where that would matter is basically empty. If your thought process is "I need to protect this from the police and a determined or sophisticated criminal, but I can't be bothered to use anything more than my lock screen on my phone"... Well, you're already starting from a pretty bad place. permalink fedilink source parent hideshow 2 child comments replies: [–] twjolson@lemmy.world 0 points 1 week ago Nothing in that reply is even close to anything I've said. Don't waste my time with stupidity or strawmen. permalink fedilink source parent
[–] twjolson@lemmy.world 1 point 1 week ago (1 child) You aren't wrong, but this discussion is mostly about edge cases. The average person, yea, they won't have anything that is end of their world if a bad guy accesses it. But, that does mean there aren't many phones that contain significantly more important data than you have. permalink fedilink source parent hideshow 2 child comments replies: [–] ricecake@sh.itjust.works 2 points 1 week ago (1 child) Given we're in a thread about biometrics being the opposite of privacy and security, it really does seem relevant to me that the threat model where they would be insufficient and the one where that would matter is basically empty. If your thought process is "I need to protect this from the police and a determined or sophisticated criminal, but I can't be bothered to use anything more than my lock screen on my phone"... Well, you're already starting from a pretty bad place. permalink fedilink source parent hideshow 2 child comments replies: [–] twjolson@lemmy.world 0 points 1 week ago Nothing in that reply is even close to anything I've said. Don't waste my time with stupidity or strawmen. permalink fedilink source parent
[–] ricecake@sh.itjust.works 2 points 1 week ago (1 child) Given we're in a thread about biometrics being the opposite of privacy and security, it really does seem relevant to me that the threat model where they would be insufficient and the one where that would matter is basically empty. If your thought process is "I need to protect this from the police and a determined or sophisticated criminal, but I can't be bothered to use anything more than my lock screen on my phone"... Well, you're already starting from a pretty bad place. permalink fedilink source parent hideshow 2 child comments replies: [–] twjolson@lemmy.world 0 points 1 week ago Nothing in that reply is even close to anything I've said. Don't waste my time with stupidity or strawmen. permalink fedilink source parent
[–] twjolson@lemmy.world 0 points 1 week ago Nothing in that reply is even close to anything I've said. Don't waste my time with stupidity or strawmen. permalink fedilink source parent
