I’ve seen a few spy thrillers. In one, the bad guy kills the person who has access to a highly secured door, digs the guy’s eye out of its socket, and uses it to pass the biometric lockouts. In another, the bad guy only has to cut off the other guy’s hand and use it to pass the biometric lockouts. I am not a fan of biometric locks. Perhaps the best way is to build the system with no back door what-so-ever. If you don’t know the password, you can’t get in. So when the police bring an Apple phone to Apple and ask them to break in, all Apple has to say is, “without the password, we can’t get in either”.
1 Like
Not everyone wants things to fail secure. Some people want things to fail safe or fail open.
As a matter of fact, my experience is that most people want it to fail magical. They want things to fail secure except when they want it to fail safe. (Like wanting their device to fail secure but wanting some other peoples same device to fail open).
For mobile devices I think most people lean toward fail secure especially with their devices automatically syncing most of the things they care about (pictures/video/etc) to “the cloud” in turn allowing them to not lose the data they care about in a failure case.
2 Likes
I read about a guy who put his whole company payroll in to a bitcoin account… and then he forgot the password.
1 Like
One of the first steps when creating a cryptocurrency wallet is writing the recovery seed onto a dedicated piece of paper, then storing it in a safe location. Metal plates compatible with BIP39 can also be used to punch out holes for protection against fires, floods, etc.
2 Likes
And in reality, all you need is a camera to make a photo of your eye or finger and some simple tech like printer and contact lens to fake an eye. With other low tech fingerprints can be taken everywhere - for example from your house door.
Or the police just takes your finger, put it on the smartphone and it’s unlocked. Reality is boring easy compared to spy thrillers.
4 Likes
The point isn’t spy thriller vs boring reality. The point is that biometrics aren’t secure. The methods you described mean that their security is even lower than portrayed by spy thrillers. The value of the spy thrillers is that they might get some attention and thinking from the oblivious.
2 Likes
Okay but some things, like end-to-end message encryption, would have a point. Because even if the government can lock me up and force me to give them the decryption key for either end, surveillance capitalism isn’t doing the same. So you could effectively block out the present-day stupid idea that most “direct messages” people are encouraged to use today are actually a 3-way discussion cryptographically.
This is not an endorsement of any specific application. Signal messenger deleted my post on their forums when I published a link to where in the source code they compile against Google Firebase messaging, for the purpose of sending that second metadata copy of the messages to Google. (I also included on the same post a separate link to the build process where it notifies Google indirectly – by accessing Google to download dependencies – whenever someone would try to compile the app.)
For what it’s worth, Purism seems much more lenient about allowing users to speak their minds and speak badly of Purism on their own forums, which seems nice.
2 Likes
That was my point.
1 Like
I’m sorry that I misunderstood.
1 Like