Just a reminder that as Trump weaponizes law enforcement to target dissent, a lot of people need to start including law enforcement in their thread modeling. That means STOP USING FACE ID AND THUMBPRINTS. You need a long, strong passcode for your phone. This protects you AND everyone you talk to - ThreadSky

evangreer.bsky.social • 32 days ago

Just a reminder that as Trump weaponizes law enforcement to target dissent, a lot of people need to start including law enforcement in their thread modeling.

That means STOP USING FACE ID AND THUMBPRINTS. You need a long, strong passcode for your phone.

This protects you AND everyone you talk to

Comments

goddesshoneylight.bsky.social•32 days ago

Don’t you think it’s too late for this? All the app games we’ve played (tracking eye movements. My theory), for years we have used Face ID and thumbprints. In the terms and conditions, a lot of these apps have clauses to use your info, even previous info on your device.

evangreer.bsky.social•32 days ago

Yes, some companies may have collected your biometric data. But if you are arrested or detained unjustly, having a passcode on your phone will protect you whereas a thumbprint or Face ID won’t

goddesshoneylight.bsky.social•32 days ago

Example: If you are detained unjustly Apple can simply hand over your info. I’m not being hyperbolic, contrarian, or fatalistic.

goddesshoneylight.bsky.social•32 days ago

Agree /w you on premise. This tactic only works in a country where “rights” aren’t eroding hour by hour. Meta is government, Amazon is government, Twitter/X is government. Apple/Samsung are under Vanguard (I hate the term but…) world government. The time has passed for this move. All due respect.

mrnohup.bsky.social•32 days ago

Yes and maybe also worth noting that, if you want to make it harder to brute-force, the password length matters a lot more than upcase/lowercase/numbers/symbols. (e.g. LasagnaIsMyFavoriteMeal is a way better password than L0rdJ3su$.)

shootsfromhip.bsky.social•32 days ago

Add a numerical digit to that and you are completely correct.

mrnohup.bsky.social•32 days ago

Why?

shootsfromhip.bsky.social•32 days ago

You are correct, a passphrase is much harder to brute force. However, its not just the length, the randomness is just as important. For example, MugWatchPhone25 would be far more difficult to crack than say MaytHe4ssBWithU. Adding in a couple of digits just makes it that much harder to break.

mrnohup.bsky.social•32 days ago

I’m no expert but that doesn’t seem correct. Knowing nothing about a password, you must assume all 100-ish typical characters are in play. Assume 8 characters minimum, so that’s 100^8 distinct combinations. If none of those hit, they’d have to try 9 characters ands so on.

mrnohup.bsky.social•32 days ago

So a number in my passphrase is irrelevant, where forcing them to roll through a staggeringly large number of combinations is a very good strategy.

numb3r5ev3n.bsky.social•32 days ago

How about a pattern?

megamanchego.bsky.social•32 days ago

I really don’t understand why people use face/Touch ID at all. I’ve never understood the reason. Is a passcode really that tough to enter? And the risks have always been pretty big.

shinaabikwe.bsky.social•32 days ago

Also some of us have ADHD short term memory problems and too many passwords, pins and it really sucks having to have every one have to be different

askthedoctor.bsky.social•32 days ago

Speed and convenience. Typing in a long passcode hundreds of times a day gets old fast. But you absolutely want a long passcode.

onewingedsparrow.bsky.social•32 days ago

Obligatory

arrowintotheair.bsky.social•32 days ago

📌

thegreatwroggi.bsky.social•32 days ago

I just got Nordvpn and use google pixlr, will that give me some protection?

isaaccp.bsky.social•31 days ago

If you ever need to hand over your phone, etc, press power + volume up and click Lockdown.

It locks the phone and will require the passcode instead of fingerprint/face id.

askthedoctor.bsky.social•32 days ago

Bad advice. You can and still should use Face/TouchID, but you need to know how to force a passcode unlock immediately on the Lock Screen. On iPhone, all you need to do is press and hold the sleep/wake button. You’ll feel the phone vibrate and will then need to type in a passcode to unlock it.

8dx.bsky.social•32 days ago

ok what about not giving our biometrics to companies at all?

askthedoctor.bsky.social•32 days ago

If you use TouchID or FaceID, you aren’t. Biometrics stay on-device in the Secure Enclave that no other part of the OS has or can get access to. It really is well-designed and secure.

https://support.apple.com/guide/security/biometric-security-sec067eb0c9e/web

8dx.bsky.social•32 days ago

Ok, they write that, but by US law they can be obligated to break any and all security and are forbidden from talking about it. And however well implemented the device itself divulges its biometric secrets when applied to your face. (Unlike when walking around in bl bl without a phone).

askthedoctor.bsky.social•32 days ago

But US law is murky enough on biometrics that having a really strong alphanumeric passcode is a must (in combination with being able to quickly force your phone to require it, as explained above).

atomicnumber88.bsky.social•32 days ago

with all due respect, you just contradicted your own original statement. the murky law means nobody has any idea how apple (or any company for that matter) is really using this information, what relationship they have with the FBI and other law enforcement agencies, etc.

askthedoctor.bsky.social•31 days ago

What do you mean? I see no contradiction. Apple doesn’t have access to information secured in the Secure Enclave… it stays on-device, and cannot be transmitted from the phone. See my above link to Apple’s webpage.

atomicnumber88.bsky.social•32 days ago

It's not bad advice at ALL. more people should be thinking a lot harder about the ramifications of consented face/fingerprint recognition by devices.

bobsyouruncle.bsky.social•32 days ago

Why should???
I think it’s a mistake

rakhanreturns.bsky.social•32 days ago

@evangreer.bsky.social What's your opinion on Lockdown mode for phones like in GrapheneOS?

socials.metroplextech.net•32 days ago

GrapheneOS provides the best protection from forensic examination. Better than both stock iPhone and Pixel.

The best way to achieve the protection is to ensure your phone is in a BFU (Before First Unlock) state for which we provide auto reboot functionality.

socials.metroplextech.net•32 days ago

You can also make use of secondary users and End Session on them to acheive similar protection.

Then for exceptional circumstances there is also our Duress PIN/password option to completely wipe the device when input on any OS provided PIN/Password UI.

socials.metroplextech.net•32 days ago

There is also our 2FA PIN/Password + Fingerprint feature:

https://bsky.app/profile/grapheneos.org/post/3lehzq3i3d22z

socials.metroplextech.net•32 days ago

As for the claim see this

https://bsky.app/profile/grapheneos.org/post/3kxswmnukoj25

for Cellebrite Premium documentation, we do have access to the January 2025 documentation too but it's essentially the same thing with support for newer iOS versions), remote attacks and attacks from apps.

socials.metroplextech.net•32 days ago

We've much more successfully defended against extraction by Cellebrite Premium, Graykey (Magnet Forensics) and XRY (from MSAB). We've also helped Google fix issues they used.

evangreer.bsky.social•32 days ago

A cop (or ICE agent or whoever) can easily (and legally) hold your phone up to your face to unlock it. It’s much harder (and more illegal) for them to force you to tell them your passcode

invictusghost.bsky.social•32 days ago

Unless they have a warrant, and if your phone is locked, they have no right to open your phone. That is a illegal search under the 4th ammendment.

jbthrowawayy.bsky.social•32 days ago

Also worth sharing that holding the power and volume button to get to the force shutdown screen disables face/touch id if you still use it.

exnerd.bsky.social•32 days ago

5 quick taps on the power button on an iPhone will do the same.

thedougman.bsky.social•32 days ago

Just tested this and verified-- great tip to know!

jbthrowawayy.bsky.social•32 days ago

does this not just call 911 lol

exnerd.bsky.social•32 days ago

I'd forgotten about that. Seems it's the same feature as the power+volume thing, and both default to "start 911 call countdown": https://support.apple.com/guide/personal-safety/emergency-call-text-iphone-apple-watch-ips4f0cd709b/web

osmote.net•32 days ago

Five-press the side button on iOS to completely disable biometrics!

rduke02.bsky.social•32 days ago

At the deeper end of this spectrum (e.g. brute force quantum computing utilization), one should understand the logistics of true random number generators. Meaning, to use external variables with no predictability.

This was accomplished with lava lamps, for those who want an interesting read.

dealyllama.bsky.social•32 days ago

Fdroid has some good options for Android https://f-droid.org/en/packages/me.lucky.duress/

Comments

Posting Rules

Reply