1

Back in 2013, WIRED stated that using fingerprint authentication on a phone may not prevent authorities (in the US at least) to gain access to one's phone without their agreement, whereas a memorized password requires approval by the accused party.

Supposing the party protected sensible information with a U2F device (not just a phone based On Time Password (e.g. Google Authenticator)), would authorities be legally allowed to simply use that device without the accused party's consent?

migrated from security.stackexchange.com Jan 28 '17 at 18:45

This question came from our site for information security professionals.

1

If the search is otherwise legal then the U2F key would be no different than a traditional metal key to, say, a house.

As the linked article says, for something to be "testimonial" it must reveal something from your mind. So accessing OTP secrets from a phone would also be legal.

The only thing that protects information is encryption. For the reasons above, such encryption also cannot solely rely on secure elements (U2Fs, OTPs, TPMs, etc.) because you need the 5th Amendment privilege for it to hold up against the government.

1

There is a court proceeding that says not even passwords are no longer protected by fifth amendment: http://courthousenews.com/wp-content/uploads/2016/12/iPhonePasscode.pdf

The reason is that passwords are self-authenticating, and thus it does not mean the person in question does not self-incriminate. The reason why the protection of self-incrimination exists, is because a individual could then be coercied to falsely admit into have commited a crime he didn't commit, leading to a innocent person being charged with a crime.

However, a password is self-authenticating in that way that it will give access to the item, the password wont say if he is guilty or not on itself, thus, a innocent individual cannot incriminate itself by providing the password, even the correct one.

This means, a judge can by a civil contempt order, jail a person indefinitely until he provides the password. (And if the person forgets the password - jailed for life)

  • "a judge can (...) jail a person indefinitely until he provides the password" Wow. – ChrisR Jan 29 '17 at 23:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.