The recent federal raid on the home of Washington Post reporter Hannah Natanson isn’t merely an attack by the Trump administration on the free press. It’s also a warning to anyone with a smartphone.
Included in the search and seizure warrant for the raid on Natanson’s home is a section titled “Biometric Unlock,” which explicitly authorized law enforcement personnel to obtain Natanson’s phone and both hold the device in front of her face and to forcibly use her fingers to unlock it. In other words, a judge gave the FBI permission to attempt to bypass biometrics: the convenient shortcuts that let you unlock your phone by scanning your fingerprint or face.-
It is not clear if Natanson used biometric authentication on her devices, or if the law enforcement personnel attempted to use her face or fingers to unlock her devices. Natanson and the Washington Post did not respond to multiple requests for comment. The FBI declined to comment.
Another thing for an overhauled Constitution. One’s body and devices should be considered to be papers and effects.
I don’t know what it is on android, but five quick presses of the primary button on iOS will put the phone into a mode where you must enter your password to unlock it.
Also pressing the primary and a volume key for a couple of seconds.
yeah that puts my phone in SOS mode, so maybe not that on Android
Android has a feature you can turn on that adds “lockdown mode” as an option if you hold the power button, which requires a password. I just tried taking a screenshot, but I don’t think I can while in the power menu.
You can also just turn your phone off. Biometrics don’t work on a fresh boot.
You can just set it up so biometrics can’t unlock the phone but can be used to get into banking apps, password managers, etc. I’ve had this set up for a couple years and it is no less convenient than using the biometrics honestly.
It’s in: settings > screen lock and biometrics > unlock type set to PIN and then you can activate biometrics and turn off the slider that indicates unlock device.
Why? Apple and Google will just unlock it for them later.
Yeah but you might as well make them work for it.
It might save the next guy because they don’t have time.
deleted by creator
Do you mean e/is? Fairphone is hardware, but uses either e/os or android
deleted by creator
Didn’t apple go to war with the FBI over exactly this? Or did I miss where they changed their tune.
Yeah. Like 10 years ago. Not sure they would have the same stance now. MS just bent over backwards to give out bitlocker keys.
Jesus fucking christ.
I don’t use my phone for anything other than directions, phone calls, and texting my wife. Partially because I’m not going to carry around something with tons of shit that can be used against me.
This is fucking insane.
deleted by creator
For directions you can use a separate GPS navigation tool. Phone and text calls -> just get a dumb phone.
Just know that SMS and regular phone services are inherently insecure and to not use them for any conversations you wouldn’t want broadcasted to the whole world.
Fair point, what’s then the safest?
I don’t think there’s necessarily a safest, thats a moving target and everyone’s threat level is different. There’s a number of open source E2EE encrypted messaging apps though and lots of resources comparing their pros and cons. I can try to find you a link a bit later when I have more time if you’d like.
Sure, I’m always open to it. And even if it has no use for me, all the more use for other queers and demsocs :3
I’m not sure what demsoc means, but I’ve found these sites to be helpful.
https://www.privacyguides.org/en/real-time-communication/ https://eylenburg.github.io/im_comparison.htm
Simplex is probably the safest.
But I would say signal is very safe while being more convenient.
I only use a 10-digit pin number I’m guaranteed to never forget. I type it in every time. But, I don’t spend much time on my phone, sometimes I even forget it when I leave the house.
I prefer grapheneos’s numeric pin+fingerprint or alphanumeric password. Plus I get to brag that I have MFA on my phone login (even if you can use only the password).
Don’t forget the duress password and the protections in BFU state! :)
I only enable duress password when I may need it. With my luck I’ll wipe my phone putting it in my pocket.
That’s a great idea but let’s not forget that this administration and it’s poorly-trained attack dogs might try and justify the password hammer
That’s why something like the duress password exists for GrapheneOS - just keep a backup of the important stuff at a separate location away from your pockets.
*an encrypted backup
@[email protected]
or second factor PIN
What if you take your dick and use that on the fingerprint scanner, do you think the cops would make you whip it out
Probably, although they probably can’t force you to reveal it’s your dick that unlocks the phone.
What if I compromise and reveal that it’s a dick that unlocks it, but not whose?
then they’d probably punch you in the dick
iOS biometrics is on the phone on an encrypted chip, and Face ID does not work if your eyes are closed… also if you press power 5 times it disable the face id unlock.
Face ID does not work if your eyes are closed
And then they hit you with a five dollar wrench until you open them. Not good opsec.
They could do the same and ask for your password
GrapheneOS duress password says hello.
Yeah they’re kinda missing the point of the $5 wrench example there
hold the device in front of her face and to forcibly use her fingers to unlock it. In other words, a judge gave the FBI permission to attempt to bypass biometrics
This isn’t bypassing biometrics. This is using biometrics as intended. Bypassing implies this was an unexpected side effect when every security researcher ever has warned that biometrics is intrinsically vulnerable and a terrible password substitute for this exact reason.
How is current USA administration performing these clear gestapo level violations of amendments and everyone’s just like “okay”. ?!
Because there’s no resistance to follow. We have no leaders out there speaking against this. It’s a massive population of sheep being governed by wolves
Pedowolves
Here is a neat little trick if the gestapo tries to raid your phone:
Americans: wow, how neat and normal
Use GrapheneOS so you can “unlock” your phone and enter the wipe code instead.
They can prosecute you for that in many places as destruction of evidence.
(Which is weird because if they fail to convict you for whatever BS they are going for then it is the Goose meme of “evidence for what???”)
Wouldn’t power-off or lockdown mode also be “destruction of evidence”?
Wasn’t there a legal dispute around this that was trying to get them with tampering/destruction of evidence? Not sure if it’s foolproof.
If you do use GrapheneOS, quickly restarting the device means your pin is required before biometrics unlock is available. As I understand it – in the U.S. – law enforcement can legally compel you to unlock your phone with biometrics, but not a pin. Not that you can trust law enforcement to be law abiding, but at least it’s a stronger case in court.
Even better, set it to 1234567890 or 00000000 or similar easy to guess pin, and change it to the length of your actual pin, now if someone tries to bruteforce your phone it will instantly wipe and you can make a case that it was the law enforcement who destroyed any “evidence” by their own actions if in comes up In court.
Don’t they make a copy of the phone before they go about trying to unlock it?
This kind of security is only going to work against a careless or incompetent atta-- oh. I see…
that implies competence
That requires USB connection to even be possible with a locked phone.
Yes, and you can disable usb completely on graphene.
It also will not accept new USB connections while the screen is locked.
Not for state sponsored campaigns. They’ll cut the damn chips from your phone and send signals directly to the individual pins if they have to. They’ll freeze your ram into super cold state to make it nonvolatile. They’ll do some crazy shit, man.
This sounds like a convenient way to have all your locally saved photos wiped by your kid
These practices and tips are not for everyday people but for high targets and work devices
Actually, these tips are for every day people (just not people whose kids can get to their phones). High targets get their ram frozen with liquid nitrogen, their PSU spliced into a battery pack, and the entire system-state backed up for retries.
You mean you’re not having your photos automatically, immediately encrypted and backed up on remote servers? ente.io will do that for you and their free plan comes with 10G of storage which is quite a few pics.
Always back up anything you don’t want to loose.
How should I protect the backups? Same story?
Your backups aren’t nearly as likely to be subject to an immediate civil forfiture as a phone is. Cops don’t need a judicial warrent to take your phone, but they do need one to search your home legally, and if you do your offsite backups in another country, they would need the cooperation of the local authorities of that country. Strong encryption can provide a relatively safe barrier for offsite backups.
Also, it’s possible to have some things that may only exist on your phone and not your server/backup system(easy biometric unlock for a password manager, or encrypted chat logs, to name a few examples).
In this economy??!
Holy Christ, what are you guys doing on your phones to fuel this much paranoia? I have a constitutional right to privacy and i dont want my information/data (the very essence that makes me me) harvested and sold – for those reasons im opposed to most searches and i’ve never used biometrics. But the need to nuke my phone because a cop got it is so far from a necessity that I cant think of what im doing that I would need it.
deleted by creator
constitutional? never did. implicit? went away recently
I still have the right, but it’s being routinely violated and not upheld by a supreme court that’s clearly in the tank.
deleted by creator
In a situation where you are raided like the journalist, it may be worth nuking the phone. Consider the sources that could be exposed.
Having your phone available to law enforcement is the equivalent of forfeit your right to remain silent.
And more, once they have access, what is stopping them from planting false evidence? In this fascist fever that US is living… I would prefer to avoid the risks.
Other than literally everything I think and feel you mean? I think it’s perfectly reasonable to not want to allow police or especially federal agents into my own head. My note taking apps, my password manager which links to all of my online accounts, and my entire web browsing and search history are all linked through my phone. Also signal and discord and lemmy, and on and on…
Exactly this.
Read about the Hawthorne effect: https://en.wikipedia.org/wiki/Hawthorne_effect and how people change their behaviors when they are being observed. Being free of observation is vital to being able to think your own thoughts without outside influence.
If the problem is with the usage framing the hypothetical adversary as a country’s law enforcement, pretend you live in a cyber North Korea and have a cellphone. The idea of an adversary is just a means of thinking about the problem. You want to build a system so that they can’t capture your flag (your flag being some digital information that you want private).
Whatever the opposite of TL;DR is:
It isn’t intended to be read as ‘do this to avoid law enforcement so you can do crimes’.
When thinking about security/privacy (same thing), you don’t know what kind of attack you may eventually have to defend against, maybe you have a partner who has decided to stalk you and so they screen read your PIN or a strong arm robbery where they’ll try to use your phone to access your bank.
Instead of trying to imagine every single possible scenario, you imagine one model scenario. In this model scenario, the adversary has every possible capability that is available and your goal is to keep your flag safe, or be able to pass a flag between two people without it being seen, or various other scenarios (which are themselves just model problems of types of system that you need to secure).
This hypothetical adversary, in order to have these capabilities in real life, would be the equivalent of a sovereign nation with unlimited funding and access to all technologies that are possible (and some that are only hypothetical). This description fits one country pretty well and so, as shorthand, people often just write ‘the feds’. I guess they could also write ‘Eve’ but that is a specific adversary in one kind of scenario and not the general Adversary.
If you’ve got nothing to hide you e got nothing to fear…?
It’s easier if you think of it like a car. Say you get arrested while in or around your car: doesn’t mean you did anything wrong or broke a law, just that you were arrested. Now there’s a million ways for cops to do the backflip jetpack gymnastics to get to search your car.
Once arrested, some stuff happens but importantly, a prosecutor starts building a case against you.
Maybe you took the recycling out and a crumpled up beer can is in the back seat, that’s an open container. Maybe you picked up some starting fluid for the cold mornings, they found it in the glove compartment in a paper bag, better do that blood test on you to rule out inhalant use, that would give them dwi. Got a significant amount of cash in the locked center console, that’s drug money. Maybe you keep the sporterized bring back hunting rifle your uncle gave you in the trunk, now you have an unregistered firearm in your possession, intent to menace? How will that allow upgrading the charges they’re already building against you? Who can say?
And remember, they’re going to use any method they can to deny you your property if you somehow end up beating the laundry list of charges. You’re losing the gun and cash no question. Civil asset forfeiture will see to that. If there’s anything wrong with your car that would keep it from passing inspection even if it had a valid inspection at the time of impound they can choose not to return it to you and instead sell it at auction for their own gain or just crush it.
Now what lines and spirals are drawn in the cloud chamber of your life when that cop particle strikes your phone instead of your car?
But I don’t have a self destruct button on my car. I don’t know anybody that does.
You don’t have to give them your password, and GrapheneOS has a convenient feature to turn off biometric unlock for only unlocking the phone, but still lets you use it in apps
I use biometrics to access some of the apps on my phone. But my home screen requires a password to unlock.
Good advice, thanks.
What’s interesting is that the DC Circuit doesn’t allow authorities to force someone to unlock their device with biometrics. I’m assuming that Natanson’s home is not inside the DC Circuit.
It’s a legally unclear area right now whether or not authorities can force you to unlock your device with biometrics. As such, it’s better not to use them: https://decentproject.org/should-you-use-biometrics-on-your-phone
Jokes on the cops, my finger barely works half the time and I have to end up doing my doodle.
I know this was in jest but seems on topic with the post - please switch from pattern to PIN (or better still, password). Pattern is orders of magnitude easier to crack than PIN.
