Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:Good for them (Score 1) 558

Fair enough on Paywave and Paypass. I had forgotten about those.

But I guess I just don't understand the rest of your points. It seems like you're moving the goalposts a bit.

Why is the inability to change a fingerprint in any way relevant to this discussion? A PIN is much easier to compromise than a fingerprint, and even if my fingerprint is compromised, it only because a threat to me if the thief has the sophisticated means necessary to lift and reproduce my fingerprint, whereas anyone at all can reproduce my PIN with the greatest of ease.

Moreover, my inability to change my fingerprint only becomes a problem if the same thief targets me multiple times. By the time they'd manage to reproduce my fingerprint after stealing my device the first time, I'd have de-authorized the device for making transactions, meaning that the only way those fingerprints they potentially acquired would ever be useful would be if they targeted me again and stole a second device that I had configured in the same way. But at that point, we're talking about someone who not only has some pretty sophisticated techniques, but is also engaging in some pretty sophisticated attacks. It's not something that 99.9999% of us will ever have to deal with, and for those among us who do have to deal with those sorts of attacks, chip-and-PIN would fare even worse at protecting you, since you'd be immediately compromised after the first theft if they had merely looked over your shoulder at the store.

Comment Re:Nonsense (Score 1) 328

I'll admit, I should have phrased that differently. I've since then clarified and explained the distinction in another comment and provided quotes from the 1966 Supreme Court case that established precedent in this area, so I'll refer you there. The gist of it is that one act—providing a passcode—is communicative in nature, whereas the other—providing your fingerprint when requested—is not.

Comment Re:Nonsense (Score 5, Interesting) 328

Nope. The distinction here is that one act is communicative, while the other is not.

Let's go back to the 1966 Supreme Court case that established case law on these sorts of issues. That case dealt with a person involved in a car accident who was suspected of drunk driving. A police officer could smell the alcohol on his breath, so when the man was in the hospital after the accident, he directed a doctor to take a blood sample over the suspect's objections. In other words, his own blood was being used to incriminate him.

Some relevant passages:

We hold that the privilege protects an accused only from being compelled to testify against himself, or otherwise provide the State with evidence of a testimonial or communicative nature

Basically, they're saying that the 5th Amendment only protects evidence of a "testimonial or communicative nature". More on that below.

"[T]he prohibition of compelling a man in a criminal court to be witness against himself is a prohibition of the use of physical or moral compulsion to extort communications from him, not an exclusion of his body as evidence when it may be material. The objection in principle would forbid a jury to look at a prisoner and compare his features with a photograph in proof."

They're quoting an earlier case here, but basically they're saying that a person's body can be used to incriminate them, without it violating the Fifth Amendment. Without that being true, you'd get all sorts of nonsensical rules, like the one they cited, where the mere act of allowing the jury to see the defendant would mean violating his right against self-incrimination, since then they could compare him against a photo taken of the suspect at the crime scene. Hell, even witnesses wouldn't be able to see defendants, since they'd be able to recognize them, potentially. Clearly the Fifth was not intended to protect against such ridiculousness.

In the present case, however, no such problem of application is presented. Not even a shadow of testimonial compulsion upon or enforced communication by the accused was involved either in the extraction or in the chemical analysis. Petitioner's testimonial capacities were in no way implicated; indeed, his participation, except as a donor, was irrelevant to the results of the test, which depend on chemical analysis and on that alone. 9 Since the blood test evidence, although an incriminating product of compulsion, was neither petitioner's testimony nor evidence relating to some communicative act or writing by the petitioner, it was not inadmissible on privilege grounds.

I.e. While compulsion was indeed involved, A) that it was compelled didn't change anything, B) there was no testimony or communication involved at all, C) the compulsion didn't relate to testimony or communication.

All of this ties back in with fingerprint locks, since your fingerprint is just another form of physical evidence, like any other that you may be asked to provide, and all three of those apply here as well. Whether it's compelled or not doesn't change anything, and it, in and of itself, does not communicate anything. By providing your fingerprint, you aren't acknowledging your guilt. You aren't testifying that you did it. You aren't indicating an awareness of anything at all. You're merely providing your fingerprint...in this case on a device they have in evidence, rather than on a piece of paper. That your fingerprint's ability to unlock the device can be used to incriminate you does not mean that your rights are being violated. It merely means that "the glove fit", so to speak.

The same is not true of something like a passcode, which is, by its very nature, communicative.

IANAL. I'm just a guy who responded with a knee-jerk reaction that of course this was wrong of them to do, gave it some more thought, found a contrary view that actually made a great deal of sense, and decided to go look up some of the case history on the subject to find out what the real answer was since I found the topic fascinating.

Comment Re:Nonsense (Score 1) 328

They can't demand that you incriminate yourself by providing the passphrase (i.e. demonstrating a knowledge and awareness of potentially criminal activity), but if they happen to know what the passphrase is, they can provide it to you and then demand that you read it back to them. Which is to say, they can demand your voice from you, but not your knowledge of the passphrase.

Comment Re:Nonsense (Score 1) 328

I'd agree, actually. I brought that example up to illustrate the fault in the AC's reasoning.

The issue here is what the Constitution protects us from. The AC's assertion was that because being compelled to provide a passcode is unconstitutional, and because providing a fingerprint gives them the same access, it must be unconstitutional as well. The problem with his assertion is that it doesn't take into account why being compelled to provide a passcode is unconstitutional.

I was pointing out that being compelled to provide a passcode is unconstitutional for reasons that have nothing at all to do with their gaining access, and everything to do with the fact that it compels you to self-incriminate. And one of the ways I illustrated that fact was by pointing out examples we're familiar with in which police officers gain access to things through alternative methods, such as the one you quoted.

Which is to say, I completely agree that it isn't what's under discussion...except that it's what the AC brought up when trying to suggest this was unconstitutional.

Comment Re:Nonsense (Score 3, Insightful) 328

Unsurprising that a judge would try to find 'clever' ways around the spirit of the constitution

Care to cite what part of the Constitution this gets around? Because near as I can tell, the constitution does not protect you from reasonable search and seizure. It never has. Police with a warrant can open doors, break chains, crack safes, pick locks, take your keys, or do pretty much anything else they want to do to get access to your private information. That's been true for as long as any of us can likely remember. That's the whole point of investigations and detective work. Did you think they just went, "Aww shucks!" every time they came across a locked door, or did you realize that if they needed to get in, they'd either find the keys or break it in?

The reason you can refrain from providing a passcode is because the 5th Amendment protects you against self-incrimination, and the very act of providing the passcode may in itself be incriminating, since it demonstrates that you have an awareness and knowledge of the device and the means to unlock it. Which is to say, while the police may have the authority (when authorized by a proper warrant) to search your phone, they do not have the authority to compel you to give up your own rights by providing a passcode.

But their authority to search your phone doesn't suddenly die just because they can't get your passcode. If an alternative method for accessing that data exists that does not involve trampling your rights, they are welcome to use it, whether it be decrypting the phone, tricking you into providing the passcode, or, yes, using your fingerprint.

Slashdot Top Deals

Real Programmers don't eat quiche. They eat Twinkies and Szechwan food.

Working...