Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
US Judge: Police Can't Force Biometric Authentication
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:57:34 PM
Re: Security vs privacy
@Stephen: What do you suggest?

Not being a jerk; I'm genuinely interested. Lots of competing interests here.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:56:37 PM
Re: Golden rule
@REISEN: Well put. We've already seen some examples of this insofar as using pictures of people to recreate images of their fingerprints/irises/etc.

As sometimes-contributor-to-Dark-Reading Terry Ray once put it (I paraphrase): Don't make your password public.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:53:59 PM
Re: Watch Out!
@Edward: It's not even necessarily gruesome in such examples. In Spaceballs, for instance, all the hero has to do is knock out the guy to use his handprint.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
2/5/2019 | 8:09:06 AM
Golden rule
Laws do so much and enforcement the same.  The safe and sane rule is to assume that whatever YOU put out there will BE hacked at some time in the future.  WE have control over what at least WE expose. Now there are data trails of life too - house sold, moved, and address databases by the score.  Employment history.  (I was surprised by the detail Georgia unemployment knew about me!!!)   But we can control SOME of it assume your history is OUT THERE and act accordingly.    Somebody somewhere knows everything about you. 
StephenGiderson
50%
50%
StephenGiderson,
User Rank: Strategist
2/4/2019 | 8:42:08 PM
Security vs privacy
In my opinion, everyone should be entitled to their own rights. This isn't just about giving them the privacy, but also making sure that they get the security that they deserve. There should be an alternative measure as a solution instead of enforcing a law that forces individuals to authenticate whenever required.
EdwardThirlwall
50%
50%
EdwardThirlwall,
User Rank: Moderator
2/1/2019 | 9:02:30 PM
Watch Out!
This is wrong on so many levels. But if you've watched as many movies as I have, if you can't crack the password to get into the data storage, it's as simple as torture. With biometrics, I'm sure you've seen what the bad guys do when they need someone's retina or fingerprint to get into the locked room right...
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
1/19/2019 | 8:16:35 PM
USDC opinion
What's being missed here is that this opinion (1) represents a split from other court opinions in the US on this issue, and (2) comes out of a lowly federal district court. Consequently, it has no binding value in and of itself. So it remains to be seen what the widespread law of the land in the US on this issue is.

(Disclaimer: The above is provided for informational, educational, and/or entertainment purposes only. Neither this nor other posts here constitute legal advice or the creation, implication, or confirmation of an attorney-client relationship. For actual legal advice, personally consult with an attorney licensed to practice in your jurisdiction.)
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/17/2019 | 12:33:37 PM
Re: Evidence?
Agree - a warrant should do the job.  No cooperation = jail time for failing to assist and hindering an investigation.  Plus bearing all costs of an unlock procedure with, say, Apple.  
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/16/2019 | 12:48:49 PM
Evidence?
I guess my question is, if you can't force a potential perpetrator to unlock their phone via warrant, can this be facilitated through a formal court injunction? If you can't, would there be any value in utilizing a phone as evidence? You would have to crack the code yourself which can take time and I would think in a criminal case that data on a phone would be valuable to the verity of the case.


NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This is not what I meant by "I would like to share some desk space"
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26252
PUBLISHED: 2021-01-20
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server ...
CVE-2020-26278
PUBLISHED: 2021-01-20
Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any host in the cluster. Weave Net is suppli...
CVE-2021-1235
PUBLISHED: 2021-01-20
A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read sensitive database files on an affected system. The vulnerability is due to insufficient user authorization. An attacker could exploit this vulnerability by accessing the vshell of an af...
CVE-2021-1241
PUBLISHED: 2021-01-20
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVE-2021-1247
PUBLISHED: 2021-01-20
Multiple vulnerabilities in certain REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.