Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
US Judge: Police Can't Force Biometric Authentication
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:57:34 PM
Re: Security vs privacy
@Stephen: What do you suggest?

Not being a jerk; I'm genuinely interested. Lots of competing interests here.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:56:37 PM
Re: Golden rule
@REISEN: Well put. We've already seen some examples of this insofar as using pictures of people to recreate images of their fingerprints/irises/etc.

As sometimes-contributor-to-Dark-Reading Terry Ray once put it (I paraphrase): Don't make your password public.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:53:59 PM
Re: Watch Out!
@Edward: It's not even necessarily gruesome in such examples. In Spaceballs, for instance, all the hero has to do is knock out the guy to use his handprint.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
2/5/2019 | 8:09:06 AM
Golden rule
Laws do so much and enforcement the same.  The safe and sane rule is to assume that whatever YOU put out there will BE hacked at some time in the future.  WE have control over what at least WE expose. Now there are data trails of life too - house sold, moved, and address databases by the score.  Employment history.  (I was surprised by the detail Georgia unemployment knew about me!!!)   But we can control SOME of it assume your history is OUT THERE and act accordingly.    Somebody somewhere knows everything about you. 
StephenGiderson
50%
50%
StephenGiderson,
User Rank: Strategist
2/4/2019 | 8:42:08 PM
Security vs privacy
In my opinion, everyone should be entitled to their own rights. This isn't just about giving them the privacy, but also making sure that they get the security that they deserve. There should be an alternative measure as a solution instead of enforcing a law that forces individuals to authenticate whenever required.
EdwardThirlwall
50%
50%
EdwardThirlwall,
User Rank: Moderator
2/1/2019 | 9:02:30 PM
Watch Out!
This is wrong on so many levels. But if you've watched as many movies as I have, if you can't crack the password to get into the data storage, it's as simple as torture. With biometrics, I'm sure you've seen what the bad guys do when they need someone's retina or fingerprint to get into the locked room right...
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
1/19/2019 | 8:16:35 PM
USDC opinion
What's being missed here is that this opinion (1) represents a split from other court opinions in the US on this issue, and (2) comes out of a lowly federal district court. Consequently, it has no binding value in and of itself. So it remains to be seen what the widespread law of the land in the US on this issue is.

(Disclaimer: The above is provided for informational, educational, and/or entertainment purposes only. Neither this nor other posts here constitute legal advice or the creation, implication, or confirmation of an attorney-client relationship. For actual legal advice, personally consult with an attorney licensed to practice in your jurisdiction.)
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/17/2019 | 12:33:37 PM
Re: Evidence?
Agree - a warrant should do the job.  No cooperation = jail time for failing to assist and hindering an investigation.  Plus bearing all costs of an unlock procedure with, say, Apple.  
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/16/2019 | 12:48:49 PM
Evidence?
I guess my question is, if you can't force a potential perpetrator to unlock their phone via warrant, can this be facilitated through a formal court injunction? If you can't, would there be any value in utilizing a phone as evidence? You would have to crack the code yourself which can take time and I would think in a criminal case that data on a phone would be valuable to the verity of the case.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: A GONG is as good as a cyber attack.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25660
PUBLISHED: 2020-11-23
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph...
CVE-2020-25688
PUBLISHED: 2020-11-23
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal to a...
CVE-2020-25696
PUBLISHED: 2020-11-23
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating sy...
CVE-2020-26229
PUBLISHED: 2020-11-23
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability...
CVE-2020-28984
PUBLISHED: 2020-11-23
prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.