Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
US Judge: Police Can't Force Biometric Authentication
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:57:34 PM
Re: Security vs privacy
@Stephen: What do you suggest?

Not being a jerk; I'm genuinely interested. Lots of competing interests here.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:56:37 PM
Re: Golden rule
@REISEN: Well put. We've already seen some examples of this insofar as using pictures of people to recreate images of their fingerprints/irises/etc.

As sometimes-contributor-to-Dark-Reading Terry Ray once put it (I paraphrase): Don't make your password public.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:53:59 PM
Re: Watch Out!
@Edward: It's not even necessarily gruesome in such examples. In Spaceballs, for instance, all the hero has to do is knock out the guy to use his handprint.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
2/5/2019 | 8:09:06 AM
Golden rule
Laws do so much and enforcement the same.  The safe and sane rule is to assume that whatever YOU put out there will BE hacked at some time in the future.  WE have control over what at least WE expose. Now there are data trails of life too - house sold, moved, and address databases by the score.  Employment history.  (I was surprised by the detail Georgia unemployment knew about me!!!)   But we can control SOME of it assume your history is OUT THERE and act accordingly.    Somebody somewhere knows everything about you. 
StephenGiderson
50%
50%
StephenGiderson,
User Rank: Strategist
2/4/2019 | 8:42:08 PM
Security vs privacy
In my opinion, everyone should be entitled to their own rights. This isn't just about giving them the privacy, but also making sure that they get the security that they deserve. There should be an alternative measure as a solution instead of enforcing a law that forces individuals to authenticate whenever required.
EdwardThirlwall
50%
50%
EdwardThirlwall,
User Rank: Moderator
2/1/2019 | 9:02:30 PM
Watch Out!
This is wrong on so many levels. But if you've watched as many movies as I have, if you can't crack the password to get into the data storage, it's as simple as torture. With biometrics, I'm sure you've seen what the bad guys do when they need someone's retina or fingerprint to get into the locked room right...
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
1/19/2019 | 8:16:35 PM
USDC opinion
What's being missed here is that this opinion (1) represents a split from other court opinions in the US on this issue, and (2) comes out of a lowly federal district court. Consequently, it has no binding value in and of itself. So it remains to be seen what the widespread law of the land in the US on this issue is.

(Disclaimer: The above is provided for informational, educational, and/or entertainment purposes only. Neither this nor other posts here constitute legal advice or the creation, implication, or confirmation of an attorney-client relationship. For actual legal advice, personally consult with an attorney licensed to practice in your jurisdiction.)
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/17/2019 | 12:33:37 PM
Re: Evidence?
Agree - a warrant should do the job.  No cooperation = jail time for failing to assist and hindering an investigation.  Plus bearing all costs of an unlock procedure with, say, Apple.  
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/16/2019 | 12:48:49 PM
Evidence?
I guess my question is, if you can't force a potential perpetrator to unlock their phone via warrant, can this be facilitated through a formal court injunction? If you can't, would there be any value in utilizing a phone as evidence? You would have to crack the code yourself which can take time and I would think in a criminal case that data on a phone would be valuable to the verity of the case.


Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-20027
PUBLISHED: 2021-06-14
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls.
CVE-2021-32684
PUBLISHED: 2021-06-14
magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, an...
CVE-2021-34693
PUBLISHED: 2021-06-14
net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.
CVE-2021-27887
PUBLISHED: 2021-06-14
Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids ...
CVE-2021-27196
PUBLISHED: 2021-06-14
Improper Input Validation vulnerability in Hitachi ABB Power Grids Relion 670 Series, Relion 670/650 Series, Relion 670/650/SAM600-IO, Relion 650, REB500, RTU500 Series, FOX615 (TEGO1), MSM, GMS600, PWC600 allows an attacker with access to the IEC 61850 network with knowledge of how to reproduce the...