Note that pressing the power button 5 times on a Samnsung phone calls 911 rather than lock your phone. To lock an android phone like this you need to bring up the power menu and select "Lockdown mode". The only way I'm aware of to bring up the power menu is to hold the power button, and the default seems to be to not show the lockdown button; it needs to be enabled in settings. Also, by default holding the power button brings up a voice assistant rather than the power menu, leaving no way to access the power menu at all, so this needs to be changed to show the power menu in settings as well. And even after all that configuration you need to be looking at your screen to hit a little touch target to trigger a lockdown. This seems like a really poorly thought out panic button.
* Lockdown (require PIN to unlock) -- Hold power button 1 second, then tap Lockdown icon on screen.
* Call 911 -- Click power button 5 times, then don't slide to cancel in the 5 second delay.
* Camera -- Click power button 2 times. (If you invoked this while at lockscreen, you'll be restricted to Camera and recent Gallery, AFAICT.)
So, if you're at, say, a heavy-pickpocketing tourist attraction, or high-risk mugging neighborhood, then you might switch your phone to Lockdown, and use this restricted Camera mode when you want to take photos. Then someone just grabbing the phone will still get the phone, but at least not likely be able to access your accounts. (Though, if they try to force your finger or face to the screen, then you might need to calm them down, as you type in your PIN.)
On iOS, holding the power button also brings up Siri, but holding power and either volume button brings up the shutdown screen. Does this not work on android, or is it another one of those vendor-specific things?
I smile when I read info like that because you imaging to get privacy from a state actors using a device you do not really own.
Anything on a smartphone is in the hand of their vendor, if a local cop can't access stuff but have the right to, your data will go to the police, if there is no right to but some State actors do want they'll get your data as well.
Things on such devices are in the GAFAM et al hands, there is no protection.
You are right, the only way to win is not to play. Leave your cell phone at home.
But that’s not practical for most people and anybody can get talked to by authorities for any reason at all. When that time comes, folk need to know how to reduce their attack surface for anyone looking for a reason to make an arrest
I suggest something different. Do not take any phone you use for accessing anything remotely important. Carry no phone, or carry a burner phone. If you do this regularly, just have a dedicated phone for international travel with nothing except tourist basics on it (uber,etc).
For those who think this is overly paranoid: a few years ago, my partner had been in the US for years on an active visa and we had just taken a quick weekend trip out of the country. On return to the US, we went through different lines. I breezed through customs.
She was held up by CBP, detained in a holding cell for hours. She was not allowed to contact me - or anyone - during this time. They took her phone, scanned it with their software and found a conversation in a messaging app from several years ago where she had joked with a family member about crazy ways you could technically get a green card. They interpreted this as malicious intent, rejected her entry, and physically destroyed her visa paperwork and work authorization cards.
After about 6 hours, a CBP officer called me to tell me they were denying her entry and would allow me to pick which flight she left the country on as long as it left within 24 hours. I bought her a light that left in about 8 hours. I went home and cried.
2 hours before the flight was supposed to leave, I got a call from her. There was a shift change for the CBP workers and the incoming supervisor didn’t agree with what the previous shift had done. He let her into the country, with no paperwork other than a letter that stated her visa documents were “accidentally destroyed” and he recommended she leave the country permanently.
Customs and Border Patrol are no joke. That can and will ruin your life on a complete whim. In her case it all started with a random screening which led them to searching her phone for any reason they could to reject her. The only reason she didn’t leave the county is I happened to pick an outgoing flight late enough that the next shift decided to review the previous shift’s decision.
I often hear about such things, I'm curious, has anyone here on HN experienced such a thing (or know of someone who did)? At borders I might imagine wanting to check your devices if you're coming back from say some place in central Asia, but how common are random police seizures? (I'm not from the US)
In today’s climate of protests this is something everyone needs to know. Police will detain and drop charges the next day simply to clear the area, and in the meantime they can seize your devices and look through them.
In the US, border patrol has a 100 mile jurisdiction from any border. Practically this means they can seize your devices with no pretext at all, and 5th amendment protections do not apply here.
That means anyone in San Diego, San Francisco, Los Angeles, Seattle, etc can have their devices imaged and confiscated for any reason at all.
I don’t know of anyone who has had this happen but given everything going on in the world right now I wouldn’t be surprised in the least if next year we start seeing it happen everywhere
I recall seeing arguments that any airport that has international flights is effectively an "international border" too for some purposes, though I'm not sure where.
Yeah “100 miles from a border” includes the majority of people living in the west coast states. Millions of people can have their rights waived by a border patrol agent in their own homes
Twenty years ago talk like this would be whacko conspiracy talk but 2015 onwards I have seen far too many wild things happen in government that we never thought would happen…
> On iOS this clears any keys stored in the Secure Enclave and it’s much harder to get a forensic image.
Are you sure about that? I've been able to power on my phone without any connectivity and still access my keychain passwords, which should be locked behind a key in the enclave.
It can be a reasonable tradeoff to leave it enabled, even knowing that the state can compel you to present your finger or face. If you disable it, you'll need to enter your passphrase regularly, which means it needs to be short and easy to enter, which usually means 4 to 6 digit numeric, which means you're more vulnerable to offline bruteforce attacks if you lose physical custody of your device. If you leave it enabled, and deauthenticate any time you're about to interact with a police officer, then you can use a longer and more complex passphrase, and be more secure if it's seized from you.
Or, most people (reasonably) do not factor arrests into their phone security threat model at all, and can happily keep using convenient biometric unlock features.
This is eerily similar to the privacy argument "well I don't do anything wrong so I have nothing to worry about". The problem is you don't decide what should be hidden and what should be available, the state does, and things can change quickly. Having said that, it would be easy to change your security settings as known security threats become apparent.
Most people above the age of 30 are very unlikely to go to a protest. Between 18 and 30, they are just unlikely.
There is no one size fits all security best practices, you should analyze how much you are at risk before deciding what safe practices would be useful.
It’s a bit presumptuous to imply this personal choice is the default or expected norm, given the importance of peaceful protests and the like as part of the civil discourse.
I’m sure are right about the numbers, most people won’t go to a protest. But I very much want to live in a country where people can peacefully protest without fear of having their digital lives completely by the government.
And a protest is just one example situation of how this can be abused to trample on privacy rights.
Knowing how to set it to require a passcode feels like absolutely important information if you're a political dissident, a journalist with valuable sources, if you live or are visiting somewhere where the police will harass you (or worse) for your private lifestyle, if you're employed by a corporation with trade secrets the government wants to spy on, or of course if you're just a straight-up criminal.
But if you don't fall into these and similar categories, then it seems totally fine to rely on biometrics.
Because this isn't at all a case where just because I have nothing to hide, means I'm cool with eroding privacy protections. The point is that you can protect yourself when you do have something to hide. But me relying on convenient biometric unlocking isn't preventing those who need to disable it from doing so. It's not even making them seem more suspicious, since my iPhone asks me to verify my passcode every couple weeks anyways, or every time it restarts.
so this is subtle and persuasive rhetoric .. let's look more closely.. "most people" divides the public into "us vs them" .. "factor arrests" immediately and implicitly makes the dividing line into "law abiding citizens" and their implied complement, criminals.. "can happily" inserts an emotional component into the divisive classification.. "use biometric unlock features" seals the statement, firmly cementing "law abiding us people" against "those other people who obviously have something to hide"
in short - no. A broader view of human nature, and the relationship of an individual adult versus the state or corporate status quo .. says that no, an individual person with rights and privacy does not have to acquiesce to draconian surveillance state record keeping.. and asserting your rights to not participate does not make you a member of the criminal "them" class.
Secondly, snide and smug assertions made in public that do associate privacy and individual rights with criminals, might be made by exactly those who are promoting these kinds of systems, for profit.
Observation: If you click the power button of your iPhone five times quickly, it will require a passcode on the next unlock. It’s easy to do that by accident when you’re nervous.
On Google Pixel 8 (IDK about other Android phones) you can press the power button + volume up button to launch a pop-up menu with the following options: restart, power off, lockdown, emergency.
If you select lockdown you'll be required to use a pin or password to unlock the phone.
This is stupid and reckless advice. The perfect is the enemy of the good. Practically nobody will set a robust, multi-character passphrase and use it dozens of times a day.
The vast majority of people will never be troubled by law enforcement; phone theft is much more common. Shoulder-surfing someone’s password and grabbing their phone to run out the closing subway doors has been A Thing for decades now.
Even if you don't want to give up the convenience in general, it's good to know that if you're in a situation where you're likely to be arrested then if possible you should reboot your phone, or press the lockdown button if it has one, so that biometrics are disabled until you provide your PIN/password.
On iOS, click the lock button five times. The biometrics reset. A passcode is required.
If you are about to cross a border:
Power your phone off. On iOS this clears any keys stored in the Secure Enclave and it’s much harder to get a forensic image.