Stolen device protection - Biometrics in general - a "philosophical" question

[phillyman]

Dear All,

I've never quite been comfortable with adding biometrics to my phone. Some will call me crazy and I actually understand that I'm being irrational about this. But please hear me out. I get that the data is stored only on my device and one has to believe that it can't be cracked or copied by anyone that physically gets your phone.

I have not added biometrics to any of my devices because I always wonder about someone being able to force the phone in my face or holding my finger against a scanner. Whereas with a passcode they have to force it out of my head. I can see that this is not a normal scenario but why not just rob the phone from me and if they want money hold it against my face. Or if even overzealous law enforcement wouldn't just say the hell with it and put the phone in front of your face and there is nothing one can do about it.

Again I'm not special enough that any state actor would try to hack my phone, nor force me to unlock it but with more and more being tied to biometrics, do others have this fear? Or is the overall better security and convenience for most just worth the tradeoffs.? We can change our passcodes (which I do on my devices about once a year) but we cannot change our biometrics.

Everything seems to be hackable (I don't even remember how many letters I've gotten in the last year of companies admitting to my data possibly being compromised). So why not our biometric data? Again I know the basics, it doesn't store a copy of our actual biometrics but makes a unique hash. Can that not be reverse engineered?

Just curious, I was interested in the new stolen device protection feature and again asked myself should I not just go with the times and activate it?

Thank you for reading and giving me feedback if you yourself had these thoughts and why you decided to activate (most likely) biometrics or not.

Philly

 

[kitKAC]

This might answer most of your questions:

https://support.apple.com/en-gb/102381

 

[BenGoren]

I have not added biometrics to any of my devices because I always wonder about someone being able to force the phone in my face or holding my finger against a scanner. Whereas with a passcode they have to force it out of my head. I can see that this is not a normal scenario but why not just rob the phone from me and if they want money hold it against my face. Or if even overzealous law enforcement wouldn't just say the hell with it and put the phone in front of your face and there is nothing one can do about it.

If you’re in a situation where somebody could — through whatever means — force you to unlock your phone with biometrics, you’re also in a situation where that same somebody could just drug you and hit you with a $5 wrench until you just tell the password.

Security

xkcd.com

Don’t let the perfect be the enemy of the good.

There is no perfect.

Instead, load the dice in your favor as best you can — which means first chasing the low-hanging fruit and only worrying about grabbing a ladder to reach the top of the tree if it’s really worth it.

In the case of phone security, this means that biometrics are far, far superior to anything you might type.

The most obvious hypothetical exceptions are, for example, parents of kids who might flash a phone in order to unlock it and do something they’re not supposed to — but the solution to that is the same as if the kid plucked a credit card from your wallet. Or somebody in an abusive relationship … and, again, if that’s the case, even just the fact that you have a secret from your abuser is going to result in more abuse, so the secret isn’t a solution here, either.

If it’s the police you’re worried about … either you live in a country in which an officer forcing you to unlock your phone will get in such hot water for doing so they don’t even think about it, or you live in a country in which the police forcing you to unlock the phone is the least of your worries. Like, for example, China, where you probably already have state-sanctioned spyware on your phone so there’s no need to do anything as crude as have you unlock it.

The biggest thing to worry about in the States (and, generally, the West) right now is somebody stealing your phone and leveraging that to take control of your whole digital identity, including finances. With the latest stolen device protection from Apple, the only practical way a thief can pull that off now is by actually kidnapping you. And, if you’re worried about being kidnapped … don’t forget the $5 wrench …

b&

 

[phillyman]

If you’re in a situation where somebody could — through whatever means — force you to unlock your phone with biometrics, you’re also in a situation where that same somebody could just drug you and hit you with a $5 wrench until you just tell the password.

Security

xkcd.com

Don’t let the perfect be the enemy of the good.

There is no perfect.

Instead, load the dice in your favor as best you can — which means first chasing the low-hanging fruit and only worrying about grabbing a ladder to reach the top of the tree if it’s really worth it.

In the case of phone security, this means that biometrics are far, far superior to anything you might type.

The most obvious hypothetical exceptions are, for example, parents of kids who might flash a phone in order to unlock it and do something they’re not supposed to — but the solution to that is the same as if the kid plucked a credit card from your wallet. Or somebody in an abusive relationship … and, again, if that’s the case, even just the fact that you have a secret from your abuser is going to result in more abuse, so the secret isn’t a solution here, either.

If it’s the police you’re worried about … either you live in a country in which an officer forcing you to unlock your phone will get in such hot water for doing so they don’t even think about it, or you live in a country in which the police forcing you to unlock the phone is the least of your worries. Like, for example, China, where you probably already have state-sanctioned spyware on your phone so there’s no need to do anything as crude as have you unlock it.

The biggest thing to worry about in the States (and, generally, the West) right now is somebody stealing your phone and leveraging that to take control of your whole digital identity, including finances. With the latest stolen device protection from Apple, the only practical way a thief can pull that off now is by actually kidnapping you. And, if you’re worried about being kidnapped … don’t forget the $5 wrench …

b&

thank you for your very thoughtful and insightful reply. I will be setting up my biometrics. Much appreciated, Philly