[HN Gopher] Stop Using Face ID
___________________________________________________________________
Stop Using Face ID
Author : speckx
Score : 42 points
Date : 2026-02-08 17:33 UTC (5 hours ago)
(HTM) web link (www.pcmag.com)
(TXT) w3m dump (www.pcmag.com)
| runjake wrote:
| If you have Face ID enabled, you can put your iPhone in hard-lock
| mode and require a passcode by pressing and holding the side (aka
| power) button and either of the volume buttons for a couple
| seconds.
|
| It will pop up an emergency screen, but just tap the power button
| once more to cancel it.
|
| I'm fortunate to be in a position where I don't attract negative
| attention from law enforcement, but this is still muscle memory
| to me.
|
| _Edit: You can also do the same thing by quickly pressing the
| side button alone five times.
|
| Edit 2: mcc1ane beat me while I was editing!_
| mcc1ane wrote:
| or 5 times the lock (power) button only
| tessela wrote:
| ... or you can just close your eyes, and move your face
| around. The device will not unlock if you're not looking at
| it and after 3 or 4 tries will ask for the password.
| runjake wrote:
| Right, there's a multitude of ways to trigger a passcode
| requirement, but the point here is quick/immediate
| procedures that can be learned into muscle memory.
| telotortium wrote:
| Both of these methods have an undesirable side effect for me,
| which is that it immediately pops up the passcode dialog saying
| that a passcode is required to activate Face ID. Depending on
| the situation, that could be construed as an attempt to
| actively interfere with a police investigation, which could
| bring consequences of its own. It would be better if it
| silently dropped you to the normal lock screen, and only showed
| the passcode dialog when you attempt to unlock the phone
| normally.
|
| Another thing I've often wished for with kids is a mode that
| removes all notifications and widgets from the lock screen -
| the only things you should be able to do is to unlock the phone
| and emergency calls. You can remove most notifications with the
| right Focus, but not notifications to control playing
| music/video apps, for example, nor any other widgets you happen
| to put on your lock screen.
| willio58 wrote:
| > Depending on the situation, that could be construed as an
| attempt to actively interfere with a police investigation
|
| IANAL but I highly doubt this would hold up in court with
| even mildly competent attorneys. Anyone can easily
| accidentally trigger it, I do all the time.
| runjake wrote:
| 100%. But important to caveat that not everyone here falls
| under US jurisdiction.
| scottiebarnes wrote:
| The same passcode prompt appears after software updates,
| multiple previous failed Face ID login attempts, and maybe
| more.
|
| Not a lawyer, but everyone has a password locked phone and
| its standard practice for device security. I'm not optimistic
| for a prosecutor winning on an interference charge.
| 9rx wrote:
| _> Both of these methods have an undesirable side effect for
| me, which is that it immediately pops up the passcode dialog
| saying that a passcode is required to activate Face ID._
|
| Must be an iOS 26 thing? I haven't dared upgrade yet. No
| immediate passcode dialog on iOS 18 if you follow the
| instructions above. It does pop up like you describe if you
| press the cancel button on the screen, but if you are
| whipping out your phone to play with the screen you're not
| exactly acting inconspicuously anyway.
| reflexe wrote:
| Or even better: turn off the device. Cracking cold/BFU (before
| first unlock) devices is not supported in many cases by tools
| like Cellebrite [1].
|
| [1] https://discuss.privacyguides.net/t/updated-cellebrite-
| iphon... : support matrix from 2024, in many cases only AFU
| (after first unlock) is supported.
| butvacuum wrote:
| thats what the side button does.
| autoexec wrote:
| Stop using biometrics generally.
| MattDamonSpace wrote:
| Too useful
| 10729287 wrote:
| And also more secure unfortunately, when you need to unlock
| your phone in public for example.
| autoexec wrote:
| The same public where you're constantly leaving your
| fingerprints, where your face is being constantly recorded
| and scanned into multiple facial recognition systems, where
| your DNA is being constantly shed? When everything needed
| to unlock your phone can be taken off of your corpse or
| just reconstructed from what you leave everywhere you go
| you're not really "secure".
| nathanaldensr wrote:
| Exactly! Biometrics have never been _less_ secure than
| they are now. It 's approaching Social Security number
| levels of insecure. LOL
| autoexec wrote:
| It's like using a password that can never be reset,
| writing it on a stack of post-it notes, then tearing one
| off and throwing it over your shoulder every 10 feet you
| travel
| sumeno wrote:
| Nobody is going to all that trouble to unlock my phone,
| they'll just beat me with a hammer until I unlock it for
| them
| SpecialistK wrote:
| Until one person or one CCTV camera catches the code over
| your shoulder and you're done.
| gruez wrote:
| No, because for most people, the alternative to "no biometrics"
| isn't "secure password/pin", it's a weak password (eg. 1234 or
| the S pattern that half the people with a pattern lock uses)
| because the ergonomics of a secure password are terrible.
| autoexec wrote:
| Bad security, either in the form of weak passwords or
| biometrics is a choice.
| nathanaldensr wrote:
| This is the advice I give to everyone who comes to me for
| digital security advice. I let them know that building habits
| of using lengthy PINs (my own personal PIN is far more than
| four or six digits) takes some time to get used to but makes
| them immune to device seizure followed by law enforcement-
| compelled or court-ordered biometric unlock (this is specific
| to US law).
| samename wrote:
| How many times do you unlock your phone a day? For some people
| it's over 100+ times a day Face ID is convenient, useful and
| secure. The alternative? People will use short numeric passcodes
| that are easy to bypass with devices like Cellulite.
|
| Instead, we should push for laws and protections around our
| private devices. The 4th Amendment actually protects our personal
| effects and imo this biometric loophole is illegal.
|
| As the other commenter pointed out, in the meantime, practice how
| to quickly lock your phone - and better yet, when in dangerous
| situations, leave it behind or turn it off.
| willio58 wrote:
| Does anyone know how devices like Cellebrite work? Like high
| level I assume it taps the numbers and has some algorithm that
| prioritizes common passcode patterns.
|
| But how does it not get locked out the same way we do when we
| fail our passcode 5+ times in a row? Is it just super easy to
| get around that exponential lock-out for iOS?
| snailmailman wrote:
| It is not super easy to get around that tech. It used to be
| easier a long time ago. Apple patches the methods every time
| they can, and have made hardware adjustments in attempt to
| make it as hard as possible. A lot of these methods involve
| tricking the counter so it doesnt increment at all, or
| somehow rolling it back. If the phone isnt set to wipe after
| 10 attempts, tricking the timer that time has passed would be
| enough.
|
| Im not sure if anyone other than Cellebrite knows the exact
| details of what they are doing. (If they _can_ even unlock
| latest iPhones that are properly secured. I'm seeing a recent
| article that implies recently unlocked iPhones had biometrics
| enabled) I wouldn't be surprised if their techniques involved
| disassembling the phone, and tampering with every connection
| of the chips involved, or depowering them in weird ways as
| they are counting attempts, or even desoldering and
| transferring the chips to other boards. I suspect that if
| apple knew and could patch the method, they would.
|
| It's impressive that it _is_ so hard to get into iPhones imo.
| People use 6 digit passcodes to lock their entire digital
| life. That would be considered horrendously insecure for
| anything that isn't an iPhone. You _can_ (and should)
| increase it to a full password. But a lot of people don't.
| eddyg wrote:
| The iPhone automatically goes into BFU (Before First Unlock)
| after 72 hours of inactivity (it actually reboots the phone).
| This can't be disabled.
|
| In addition, there are additional restrictions where your
| passcode will be _required_. For example, if the passcode has not
| been used to unlock the device in the last six days and Face ID
| has not unlocked the device in the last eight hours, then you
| _must_ use a passcode to access the device (in other words,
| biometric unlock is automatically disabled).
|
| If you've ever wondered why you've had to enter your passcode
| after a good night's sleep and haven't entered your passcode
| recently, that's probably why!
|
| Given these built-in precautions, a click-bait headline like this
| is a bit excessive _for most people_.
| gruez wrote:
| >The iPhone automatically goes into BFU (Before First Unlock)
| after 72 hours of inactivity (it actually reboots the phone).
| This can't be disabled.
|
| But if the threat is from law enforcement, as the beginning of
| the article implies, how does that help? They just have to scan
| your face with your phone when they seize it, and slurp up all
| the data they want.
|
| >In addition, there are additional restrictions where your
| passcode will be required. For example, if the passcode has not
| been used to unlock the device in the last six days and Face ID
| has not unlocked the device in the last eight hours, then you
| must use a passcode to access the device (in other words,
| biometric unlock is automatically disabled).
|
| The conditions for triggering this is so unreliable that it
| probably exists more to prevent people from forgetting their
| pins, than meaningfully increase security.
| ADent wrote:
| For iPhones your eyes have to be open.
|
| I've got to think some cops are good at holding up the phone
| and saying look at this text message and people opening eyes
| to see it though.
| eddyg wrote:
| Not just open, but (by default) "paying attention" and not
| actively trying to "look away" from the phone:
|
| _The TrueDepth camera will provide an additional level of
| security by verifying that you are looking at iPhone before
| unlocking. Some sunglasses may block attention detection._
| butvacuum wrote:
| before apple changed it again in ios26 - tripple hitting the
| side button to bring up emergency also went into BFU. (can't
| confirm- screw you Dexcom.)
| gruez wrote:
| >before apple changed it again in ios26 - tripple hitting
| the side button to bring up emergency also went into BFU
|
| AFAIK that disables biometrics, but that's not the same as
| BFU.
| jiggawatts wrote:
| To me this article is "meta" and tells a very different story:
| "America is an authoritarian hellhole where trivial matters such
| as how you lock your phone can put you in real danger. Not from
| gangs, but from the government."
|
| I went to the US on holidays recently and several people sat me
| down before I left to give me a _very serious talk_ warning me
| about the police being deadly dangerous to anyone that doesn't
| behave "just right". You know: show your hands, don't reach for
| things unless prompted, that kind of thing that I just don't have
| to worry about over here -- where "here" is most of the rest of
| the Planet.
|
| The last time I felt like this -- that I had to _worry_ about the
| police as a law abiding citizen -- was in communist country
| behind the iron curtain.
|
| You've all managed to turn the "land of the free" into a copy of
| the enemy you made fun of.
|
| I guess Trump is right: the US and Russia should be friends.
| You're more similar than different.
| SpecialistK wrote:
| I've been thinking about this recently and I disagree. Keep
| biometrics and know how to disable them quickly (usually 5x power
| button)
|
| I think the most likely case where you'll be compelled to hand
| over your device is an airport immigration desk / room. And what
| do airports have? Lots and lots of CCTV. From the moment you step
| off the plane or jetway into the terminal there are cameras
| everywhere. Enter your PIN once in view of those cameras and it's
| on record for forensics to pick up.
|
| I actually hate when my phone requires me to enter my PIN on
| public because I have to angle it away from cameras and eyes like
| I'm looking at smut.
| csense wrote:
| Nobody should use biometric ID systems. Resetting my password
| requires plastic surgery? No thanks.
|
| Involuntary compliance [1], false positives and false negatives
| are all big, unsolvable problems with biometrics.
|
| [1] To some extent, all authentication systems are vulnerable to
| legitimate users acting under coercion. https://xkcd.com/538/
|
| Biometric systems take the choice of compliance away from the
| user, they can physically force you to unlock your phone. With a
| password you have a choice not to comply even in coercive
| scenarios; you have the option to say "I'm willing to die from
| getting hit with the wrench before I'll give up the password."
___________________________________________________________________
(page generated 2026-02-08 23:01 UTC)