Cops Told 'Don't Look' at New iPhones To Avoid Face ID Lock-Out (vice.com) 84
As Apple continues to update its iPhones with new security features, law enforcement and other investigators are constantly playing catch-up, trying to find the best way to circumvent the protections or to grab evidence. From a report: Last month, Forbes reported the first known instance of a search warrant being used to unlock a suspect's iPhone X with their own face, leveraging the iPhone X's Face ID feature. But Face ID can of course also work against law enforcement -- too many failed attempts with the 'wrong' face can force the iPhone to request a potentially harder to obtain passcode instead. Taking advantage of legal differences in how passcodes are protected, US law enforcement have forced people to unlock their devices with not just their face but their fingerprints too. But still, in a set of presentation slides obtained by Motherboard this week, one company specialising in mobile forensics is telling investigators not to even look at phones with Face ID, because they might accidentally trigger this mechanism.
"iPhone X: don't look at the screen, or else... The same thing will occur as happened on Apple's event," the slide, from forensics company Elcomsoft, reads. Motherboard obtained the presentation from a non-Elcomsoft source, and the company subsequently confirmed its veracity. The slide is referring to Apple's 2017 presentation of Face ID, in which Craig Federighi, Apple's senior vice president of software engineering, tried, and failed, to unlock an iPhone X with his own face. The phone then asked for a passcode instead. "This is quite simple. Passcode is required after five unsuccessful attempts to match a face," Vladimir Katalov, CEO of Elcomsoft, told Motherboard in an online chat, pointing to Apple's own documentation on Face ID. "So by looking into suspect's phone, [the] investigator immediately lose one of [the] attempts."
"iPhone X: don't look at the screen, or else... The same thing will occur as happened on Apple's event," the slide, from forensics company Elcomsoft, reads. Motherboard obtained the presentation from a non-Elcomsoft source, and the company subsequently confirmed its veracity. The slide is referring to Apple's 2017 presentation of Face ID, in which Craig Federighi, Apple's senior vice president of software engineering, tried, and failed, to unlock an iPhone X with his own face. The phone then asked for a passcode instead. "This is quite simple. Passcode is required after five unsuccessful attempts to match a face," Vladimir Katalov, CEO of Elcomsoft, told Motherboard in an online chat, pointing to Apple's own documentation on Face ID. "So by looking into suspect's phone, [the] investigator immediately lose one of [the] attempts."
Re: (Score:2)
The iPhone requires that you look at it or give it attention. Can the police demand through a warrant that you look at the phone? Can a warrant even demand that?
"Sir, you are hereby ordered by a court of law to look at the camera". - I don't know if this is legal. A warrant allows the search and seizure, not compelling action.
I think if the police tried to make me look at my phone by force, id just shut my eyelids. If they try and force my eyelids open, their hands would just disqualify the read, and even t
Re: (Score:2)
no it is not. the courts has ruled that a search warrant is needed to get pin numbers and passwords but one is not needed for fingerprints. The authorities believes the justification for not needing one for fingerprints is the same for face scans.
Re:Is this a joke? (Score:5, Insightful)
Yep.
There are two classes of information involved in searches: Things you have and things you know.
Bio-metrics are things you have. Pass codes are things you know.
The things you have are subject to search. The things you know are protected by the 5rh amendment.
Re: (Score:2)
Yeah, these types of cases are why I wish Apple would offer two factor authentication: Either fingerprint and PIN or facial and PIN.
Fingerprint-only you might be able to game til the phone locks because the po-po don't know what fingers are registerd...but you only have one face.
Re: (Score:3)
How about "Hey Siri, lock the phone."
No idea if this works but it would make for a reasonably simple, non-intrusive solution.
Re: (Score:2, Informative)
"Hey Siri, whose phone is this?" will require a passcode as long as the phone is locked when you ask the question.
Re: (Score:2)
This is currently built into the phone and I just tried it on my personal 6S+ running iOS 12.0.1.
"Hey Siri, who's phone is this?" immediately prevents the phone from using TouchID. It gives contact info about the owner (the phone number), but also immediately prevented me from using my fingerprint. The only way back into my phone was the passcode.
I tried this 5 different times just to make sure
Re: (Score:2)
On Android just discreetly hold down the power button for a few seconds and it will shut down, disabling fingerprint/face unlock until the passcode is entered.
Re: (Score:2)
Have to be careful.
It is a crime ti toss evidence in a car chase.
Many times, the discards are guns and drugs.
Because there is probable cause, the actor knows that she is evading.
My iPhone will brick on the 11th failed passcode.
I could change that to 3, if I'm pretty sure I'll be stopped.
However, punching numbers to induce lock-out in the presence of LEO, under some circumstances, can be illegal.
An example is the immediate presence of danger to self or police or to the public.
Re: (Score:2)
What I'd like to see is a double login: one for access, the other for self-destruct (or at least a wipe until iCloud restore).
So, for FaceID, blink three times and for touch, pinky and for PIN, an alternate.
When those are detected, it's brick time.
Re:Is this a joke? (Score:5, Informative)
the justification for not needing one for fingerprints is the same for face scans.
Correct. In Maryland v King [wikipedia.org] the Supreme Court put DNA scans in the same category. No warrant or probable cause is needed.
From the ruling: "taking and analyzing a cheek swab of the arrestee's DNA is, like fingerprinting and photographing, a legitimate police booking procedure that is reasonable under the Fourth Amendment."
Re: (Score:2)
"They" being the NSA maybe... (Score:2)
...but not local LE who have not quite that level of gear or skill.
Re: (Score:1)
If you're going to call people out as stupid, you really ought to work on your spelling.
Re: (Score:2)
To ensure people still communicate and trust their big brand device after PRISM the big brand junk crypto has to be seen to work again.
Re: Is this a joke? (Score:2)
Can't the police come up with a trivial opaque 'evidence' sticker to immediately place over the front facing camera on Iphones? They could just make certain to all carry said stickers and be ready to use them.
This is why the US needs laws like AU (Score:1, Funny)
Simply outlaw personal use of cryptography, and require manufactured to provide a backdoor code. Then we won't need police officers jumping through a lot of hoops trying to get around privacy laws.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
If you gaze ... (Score:3)
Re: (Score:2)
Re: (Score:2)
cover the camera (Score:2)
How long before LEOs are issued with devices to cover iphone front cameras
Re: (Score:2)
Just do what I do... (Score:3)
Re: (Score:3)
I use my dog's face to unlock my phone.
Sounds good - can I borrow your dog?
Re: (Score:2)
Re: (Score:1)
Re: Idiot cops go fishing in a dry well - a dumb p (Score:2)
Clash song. Not D.K.
Re: (Score:3)
The Dead Kennedys released the version that the OP was quoting. The Clash version said "I fought the law and the law won"
Re: (Score:2)
Dozens of groups have covered the Clash's song.
Re: (Score:2)
Re: (Score:2)
Then you didn't listen to the Dead Kennedys song the OP was quoting, you listened to a different version.
Re: (Score:1)
I'd like a distance lock (Score:2)
Where my phone would lock if it got more than 5 feet away from my Apple Watch.
Apple already has a system for detecting your Apple Watch for logging into Mac desktop/laptops, so this isn't much of a stretch.
So does my laser pointer (Score:1)
Narcissist (Score:2)
Re: (Score:2)
Video conferencing.
I wonder which is easier to teach (Score:2)
Police: Don't look into the subjects phone so it doesn't lock you out.
or
Non-Police: Don't use biometrics ( face-id or fingerprints ) to unlock your phone in the first place.
If you just stick to a decent password, not only will it help those forgetful law enforcement types ( because it won't matter if they look at your phone or not ) but you also cannot be forced to give up a password ( in the US at least . . . . for now ) so it's a win-win for everybody :D
Personally, I think the phones should have an emer
Re: (Score:2)
Alter your expression (Score:3)
Fnords! (Score:1)
It's almost as if the entire device was covered in s. Do not look directly at the s!
self destruct on first failure (Score:1)
SOS mode (Score:3)
- Go to Settings->Emergency SOS
Make sure "Call with Side Button" is on (that's the default) and turn off Auto-Call.
On any iPhone with Face ID, pressing the side button 5 times will now activate Emergency SOS mode, which immediately disables Face ID. There's a similar mode on Touch ID devices.
So, any time you're going through TSA, a border crossing, or see a cop heading towards you, press the side button 5 times. The phone will vibrate twice to indicate it's working. You don't even need to take it out of your pocket.
I'm sure Android has something similar, but the process would be device/skin-specific.