Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
US Judge: Police Can't Force Biometric Authentication
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:57:34 PM
Re: Security vs privacy
@Stephen: What do you suggest?

Not being a jerk; I'm genuinely interested. Lots of competing interests here.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:56:37 PM
Re: Golden rule
@REISEN: Well put. We've already seen some examples of this insofar as using pictures of people to recreate images of their fingerprints/irises/etc.

As sometimes-contributor-to-Dark-Reading Terry Ray once put it (I paraphrase): Don't make your password public.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:53:59 PM
Re: Watch Out!
@Edward: It's not even necessarily gruesome in such examples. In Spaceballs, for instance, all the hero has to do is knock out the guy to use his handprint.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
2/5/2019 | 8:09:06 AM
Golden rule
Laws do so much and enforcement the same.  The safe and sane rule is to assume that whatever YOU put out there will BE hacked at some time in the future.  WE have control over what at least WE expose. Now there are data trails of life too - house sold, moved, and address databases by the score.  Employment history.  (I was surprised by the detail Georgia unemployment knew about me!!!)   But we can control SOME of it assume your history is OUT THERE and act accordingly.    Somebody somewhere knows everything about you. 
StephenGiderson
50%
50%
StephenGiderson,
User Rank: Strategist
2/4/2019 | 8:42:08 PM
Security vs privacy
In my opinion, everyone should be entitled to their own rights. This isn't just about giving them the privacy, but also making sure that they get the security that they deserve. There should be an alternative measure as a solution instead of enforcing a law that forces individuals to authenticate whenever required.
EdwardThirlwall
50%
50%
EdwardThirlwall,
User Rank: Moderator
2/1/2019 | 9:02:30 PM
Watch Out!
This is wrong on so many levels. But if you've watched as many movies as I have, if you can't crack the password to get into the data storage, it's as simple as torture. With biometrics, I'm sure you've seen what the bad guys do when they need someone's retina or fingerprint to get into the locked room right...
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
1/19/2019 | 8:16:35 PM
USDC opinion
What's being missed here is that this opinion (1) represents a split from other court opinions in the US on this issue, and (2) comes out of a lowly federal district court. Consequently, it has no binding value in and of itself. So it remains to be seen what the widespread law of the land in the US on this issue is.

(Disclaimer: The above is provided for informational, educational, and/or entertainment purposes only. Neither this nor other posts here constitute legal advice or the creation, implication, or confirmation of an attorney-client relationship. For actual legal advice, personally consult with an attorney licensed to practice in your jurisdiction.)
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/17/2019 | 12:33:37 PM
Re: Evidence?
Agree - a warrant should do the job.  No cooperation = jail time for failing to assist and hindering an investigation.  Plus bearing all costs of an unlock procedure with, say, Apple.  
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/16/2019 | 12:48:49 PM
Evidence?
I guess my question is, if you can't force a potential perpetrator to unlock their phone via warrant, can this be facilitated through a formal court injunction? If you can't, would there be any value in utilizing a phone as evidence? You would have to crack the code yourself which can take time and I would think in a criminal case that data on a phone would be valuable to the verity of the case.


How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3331
PUBLISHED: 2021-01-27
WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)
CVE-2021-3326
PUBLISHED: 2021-01-27
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.
CVE-2021-22641
PUBLISHED: 2021-01-27
A heap-based buffer overflow issue has been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
CVE-2021-22653
PUBLISHED: 2021-01-27
Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
CVE-2021-22655
PUBLISHED: 2021-01-27
Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).