Experts split on whether police can use dead bodies to unlock an iPhone

Posted:
in iPhone
Security and biometrics experts are said to be divided on the question of whether police -- or the FBI -- could have used the body of Sutherland Springs shooter Devin Kelley to unlock his rumored iPhone.




Nominally, the "liveness detection" features of Apple's Touch ID would have prevented that, Mashable noted on Wednesday. The company's fingerprint sensors use RF waves to test the skin underneath the outer layer, and are also capacitive, relying on an electrical charge living people generate.

"If the fingerprint technology is equipped with what is called liveness detection, or in professional terms 'Presentation Attack Detection,' it will with a high security reject false fingerprints," said Daniel Edlund of Precise Biometrics, a company making fingerprint authentication software. "It doesn't matter if it is a copy of a fingerprint, such as a rubber, silicon or plastic replication, or a dead finger."

A senior staff attorney for the Electronic Frontier Foundation's digital civil liberties group, Nate Cardozo, said that he understood Touch ID will work with dead body, but that Face ID on the iPhone X won't because of attention detection.

"Touch ID, definitely," added Phobos Group researcher Dan Tentler. "Face ID? Hard to say, you could probably get it done if you had the body, and were able to open the person's eyes. But then again, there was that one guy who shaved his beard and Face ID quit working, so it's hard to say."

UnifyID CEO John Whaley suggested that both Touch ID and Face ID could be bypassed with enough effort.

"It is certainly possible to authenticate with biometrics even without user consent, or the person even being alive," he remarked. "This is especially true if the factor they use is static, like a fingerprint or a face. One attempt to combat this is to use a liveness check, but even those are often easily spoofable."

A week ago, a report claimed that investigators failed to talk to Apple during a crucial 48-hour window before Touch ID demands a passcode to reinitialize. Instead Apple ended up reaching out after a press conference, by which time it was already too late. It's not yet known if the FBI has secured a warrant for Kelley's possible iCloud account.
«1

Comments

  • Reply 1 of 40
    mjtomlinmjtomlin Posts: 1,904member
    Well, I know for sure you can’t enter my passcode if I’m dead. If I’m a homocidal, suicidal maniac, about to kill myself after going on a shooting spree, I would hope the last though that goes through my mind isn’t, “Did I remember to turn off Touch ID?”

    These articles always present biometric security as the one and only way to get into a phone once it is set. 
    macplusplusracerhomieviclauyyc
  • Reply 2 of 40
    calicali Posts: 3,495member
    #TwinGate #MomGate #DeadGate

    Stupid FaceID has cause so many problems since release. /s
    racerhomiewatto_cobraJaiOh81
  • Reply 3 of 40
    Hell. yes, use the dead body to unlock the phone. It’s not like they can do anything more to the guy...


    jbdragonviclauyyc
  • Reply 4 of 40
    jbdragonjbdragon Posts: 2,149member
    Hell. yes, use the dead body to unlock the phone. It’s not like they can do anything more to the guy...


    They'll shoot you so that they can then turn around and unlock your phone without you trying to stop them.
    watto_cobra
  • Reply 5 of 40
    I remember in the forums when Touch ID was NEW, it was sold as a solution to the rash of smartphone thefts (sometimes by aggravated robbery) which was happening everywhere. People started commenting that thieves would just cut off your finger to unlock your stolen phone. I guess they were busy trying to come up with ways Touch ID was stupid or annoying or wouldn't work, and Apple would be doomed. Now they all defend Touch ID and Face ID is the new doom.
    king editor the gratemwhitelkruppStrangeDaysmacky the mackywatto_cobraradarthekatleavingthebiggspace2001YoSamCapsFan
  • Reply 6 of 40
    cpsrocpsro Posts: 2,474member
    A senior staff attorney for the Electronic Frontier Foundation's digital civil liberties group, Nate Cardozo, said that he understood Touch ID will work with dead body, but that Face ID on the iPhone X won't because of attention detection.

    "Touch ID, definitely," added Phobos Group researcher Dan Tentler. "Face ID? Hard to say, you could probably get it done if you had the body, and were able to open the person's eyes..."
    It's common for the eyes to remain open at death. If they're closed, they can easily be re-opened and may stay that way on their own, at least if rigor mortis hasn't yet set in.
    beowulfschmidt
  • Reply 7 of 40
    calicali Posts: 3,495member
    jbdragon said:
    Hell. yes, use the dead body to unlock the phone. It’s not like they can do anything more to the guy...


    They'll shoot you so that they can then turn around and unlock your phone without you trying to stop them.
    Resisting arrest. 
  • Reply 8 of 40
    foggyhillfoggyhill Posts: 4,767member
    cpsro said:
    A senior staff attorney for the Electronic Frontier Foundation's digital civil liberties group, Nate Cardozo, said that he understood Touch ID will work with dead body, but that Face ID on the iPhone X won't because of attention detection.

    "Touch ID, definitely," added Phobos Group researcher Dan Tentler. "Face ID? Hard to say, you could probably get it done if you had the body, and were able to open the person's eyes..."
    It's common for the eyes to remain open at death. If they're closed, they can easily be re-opened and may stay that way on their own, at least if rigor mortis hasn't yet set in.
    Well, if they need blood flow in the eye, open eyes won't be enough. Attention may be more than just eyes open.

    If you got to worry about people shooting you to get your phone, instead of stealing it from you, then I'm guessing you have way more to worry about than me.
    muthuk_vanalingam
  • Reply 9 of 40
    wizard69wizard69 Posts: 12,860member
    The thing that bothers me is ive yet to see any indication of useful information coming from any phone.   It is almost like the FBI is making a mountain out of a mole hill here.  If they want to know whom you have been calling all they need to do is contact the phone company for your records.  
    watto_cobraleavingthebiggmuthuk_vanalingampeterharthodarlongpathviclauyyc
  • Reply 10 of 40
    cpsrocpsro Posts: 2,474member
    foggyhill said:
    cpsro said:It's common for the eyes to remain open at death. If they're closed, they can easily be re-opened and may stay that way on their own, at least if rigor mortis hasn't yet set in.
    Well, if they need blood flow in the eye, open eyes won't be enough. Attention may be more than just eyes open.

    If you got to worry about people shooting you to get your phone, instead of stealing it from you, then I'm guessing you have way more to worry about than me.
    You neglected the scenario in which someone shoots you not just to possess your phone but to access it's full functionality. (Hey, another definition of body hacking!)
    Apple hasn't advertised retinal blood flow as being required.
    Our discussion here is all academic/entertainment, though, isn't it? Isn't it?
    edited November 2017
  • Reply 11 of 40
    lkrupplkrupp Posts: 7,162member
    Screw the experts. They don’t know whether it can be done or not, period. And why are they always talking about Apple’s biometric technology? Are Android phones so utterly devoid of security that it really is child’s play to break into one? I guess so. No need to ask Google for a back door as it’s wide open anyway.
    watto_cobraleavingthebiggcalirandominternetpersonlostkiwiviclauyyc
  • Reply 12 of 40
    anomeanome Posts: 1,291member
    foggyhill said:
    cpsro said:
    A senior staff attorney for the Electronic Frontier Foundation's digital civil liberties group, Nate Cardozo, said that he understood Touch ID will work with dead body, but that Face ID on the iPhone X won't because of attention detection.

    "Touch ID, definitely," added Phobos Group researcher Dan Tentler. "Face ID? Hard to say, you could probably get it done if you had the body, and were able to open the person's eyes..."
    It's common for the eyes to remain open at death. If they're closed, they can easily be re-opened and may stay that way on their own, at least if rigor mortis hasn't yet set in.
    Well, if they need blood flow in the eye, open eyes won't be enough. Attention may be more than just eyes open.

    If you got to worry about people shooting you to get your phone, instead of stealing it from you, then I'm guessing you have way more to worry about than me.

    Don't think blood flow in the eye is needed for FaceID, since it's hard to measure from a distance. Body temperature might, which could be hard to fake, depending on how long they've been dead, and whether you have access to a big enough oven. Blood flow, at least in a general sense, under the skin is easier to do, just by mapping the fluctuation in temperature and subtle movement of vessels near the surface, but I don't know if FaceID does that. TouchID is supposed to require blood flow in the finger, but I don't know how well that's been tested.

    As has been said before, if you're worried that someone might unlock your phone when your not paying attention, or use your corpse, use a passcode. At least then they have to do some actual work to get at it. And if they didn't shoot you already, they have a reason to keep you alive, at least for now.

  • Reply 13 of 40
    foggyhillfoggyhill Posts: 4,767member
    lkrupp said:
    Screw the experts. They don’t know whether it can be done or not, period. And why are they always talking about Apple’s biometric technology? Are Android phones so utterly devoid of security that it really is child’s play to break into one? I guess so. No need to ask Google for a back door as it’s wide open anyway.
    Maybe they could register a dying man, "for science"... And test it out... Seems all outlandish options now must be tested.
  • Reply 14 of 40
    foggyhillfoggyhill Posts: 4,767member
    anome said:
    foggyhill said:
    cpsro said:
    A senior staff attorney for the Electronic Frontier Foundation's digital civil liberties group, Nate Cardozo, said that he understood Touch ID will work with dead body, but that Face ID on the iPhone X won't because of attention detection.

    "Touch ID, definitely," added Phobos Group researcher Dan Tentler. "Face ID? Hard to say, you could probably get it done if you had the body, and were able to open the person's eyes..."
    It's common for the eyes to remain open at death. If they're closed, they can easily be re-opened and may stay that way on their own, at least if rigor mortis hasn't yet set in.
    Well, if they need blood flow in the eye, open eyes won't be enough. Attention may be more than just eyes open.

    If you got to worry about people shooting you to get your phone, instead of stealing it from you, then I'm guessing you have way more to worry about than me.

    Don't think blood flow in the eye is needed for FaceID, since it's hard to measure from a distance. Body temperature might, which could be hard to fake, depending on how long they've been dead, and whether you have access to a big enough oven. Blood flow, at least in a general sense, under the skin is easier to do, just by mapping the fluctuation in temperature and subtle movement of vessels near the surface, but I don't know if FaceID does that. TouchID is supposed to require blood flow in the finger, but I don't know how well that's been tested.

    As has been said before, if you're worried that someone might unlock your phone when your not paying attention, or use your corpse, use a passcode. At least then they have to do some actual work to get at it. And if they didn't shoot you already, they have a reason to keep you alive, at least for now.

    Well, the back of the eyes, when you take a picture, is red (red eye and all that), probably not the same shade of red if your dead...  So, the combination of IR and visual information likely could tell you if the eyes are dead ... Of course, you being dead it won't bother you either way. It is more of next of kin thing.

    Most people would unlock their phones if someone put a gun to their head, I know I would... Doesn't mean I'd survive (they may shoot me after), but my odds are better than those were I got the bullet in the brain.

    You likely can lock things with biometrics like you apps, so killing you to just unlock the phone is kinda unproductive ;-).
  • Reply 15 of 40
    No way it will work on a dead finger, my touch ID on my 7 doesn't like it when my finger is cold and I am very much alive just not alot of blood in fingers i guess. Happens all the time in the winter.
    watto_cobralongpathlostkiwiviclauyyc
  • Reply 16 of 40
    Epic headline
    watto_cobraviclauyyc
  • Reply 17 of 40
    MplsPMplsP Posts: 1,544member
    jmey267 said:
    No way it will work on a dead finger, my touch ID on my 7 doesn't like it when my finger is cold and I am very much alive just not alot of blood in fingers i guess. Happens all the time in the winter.
    You don't need to be awake for it to work - why would you need to be alive? I've never seen anything being presented about Touch ID sensing blood flow, and capacitive sensors "relying on an electrical charge living people generate" is BS. Why do styluses work? Capacitive sensors work because your body is conductive and changes the capacitance of the device you're touching.

    Cpsro is right regarding the eyes. Whether FaceID has any mechanism to sense life is up for debate. I haven't seen any specs indicating such capabilities, but I can't rule it out. I've seen descriptions of iris scanners that detect the pulsations caused by blood flow, but I doubt faceID has the resolution to do so. As far as warmth, Touch ID works when my fingers are ice-cold (assuming they're not shriveled up, too,) and FaceID needs to work whether you're in Arizona in the summer or in Minnesota in the winter, so I doubt that's a factor either.
    radarthekat
  • Reply 18 of 40
    What's to prevent say Chinese government from forcing you to face ID authenticate to look at your phone contents, for instance during a business or pleasure trip there?  

    Where face ID fails is intent.  Does the user have the intent to unlock by their desire to do so?  i.e. free will
    edited November 2017 viclauyyc
  • Reply 19 of 40
    foggyhillfoggyhill Posts: 4,767member
    What's to prevent say Chinese government from forcing you to face ID authenticate to look at your phone contents, for instance during a business or pleasure trip there?  

    Where face ID fails is intent.  Does the user have the intent to unlock by their desire to do so?  i.e. free will
    deactivate before entering country, all is solved. They don't force you to use it you know.

    Eventually, there will be devices to read the brain as we go by, when that happens, we'll have a lot more to worry about that this, privacy gone. Wonder what that would do to the world.
    watto_cobra2old4fun
  • Reply 20 of 40
    Rayz2016Rayz2016 Posts: 4,709member
    cpsro said:
    foggyhill said:
    cpsro said:It's common for the eyes to remain open at death. If they're closed, they can easily be re-opened and may stay that way on their own, at least if rigor mortis hasn't yet set in.
    Well, if they need blood flow in the eye, open eyes won't be enough. Attention may be more than just eyes open.

    If you got to worry about people shooting you to get your phone, instead of stealing it from you, then I'm guessing you have way more to worry about than me.
    You neglected the scenario in which someone shoots you not just to possess your phone but to access it's full functionality. (Hey, another definition of body hacking!)
    Apple hasn't advertised retinal blood flow as being required.
    Our discussion here is all academic/entertainment, though, isn't it? Isn't it?
    If they person is that desperate to unlock your phone then they will simply force you to unlock it first, then shoot you.  

    So whatever security you have set up is pretty much bypassed as soon as they pull a gun. 
Sign In or Register to comment.