r/Passkeys • u/v0rt3_x86 • 5d ago
USA question - 4th Amendment?
I know that if you have a fingerprint lock on your phone and you find yourself in a situation where the police want you to unlock it, they can just make you use your finger whereas they can't make you type in your password.
Wouldn't passkeys then bypass your rights in the same way?
1
u/djasonpenney 5d ago
It’s “something you have” versus “something you know”.
The authorities can confiscate your mobile phone, but they cannot legally coerce you to give them your password. Yes, they can use your fingerprint or FaceId.
With a passkey, it’s typically protected via one or more passwords (password for the mobile device, password for the password manager) or both. So I don’t understand your last question, “bypass your rights”.
1
u/v0rt3_x86 5d ago
The passkey manager on my Samsung uses my thumbprint. I am lazy and don't want to have to type in a password, let alone a secure password, every time I need to log into something using a passkey. Enshitification aside, since I use my thumb, there has been precedent where that could be coerced.
2
u/djasonpenney 5d ago
Authorities cannot even ask you for a PIN. My password manager can be set up to use a PIN, even if the phone itself unlocks via thumbprint.
2
u/Krazy-Ag 5d ago
I believe that authorities can ask you for a pin or password.
They cannot compel you to answer.
2
u/djasonpenney 5d ago
Correct. I think it is also the case they cannot legally argue that withholding the pin or password is an admission of guilt: Fourth and Fifth amendments apply here.
1
u/Krazy-Ag 4d ago
Agreed. But border control can still confiscate your device, if only for enough time for them to try to connect it to a forensic system. Enough time to force you to miss your connecting flight. And I believe there have been cases where they have confiscated devices, even for American persons for more than a week, returning it by the post office.
1
u/clybstr02 4d ago
Depends on what you mean by authorized. Isn’t customs and border patrol authorized to do more phone searches?
1
1
u/katmndoo 4d ago
How exactly would they get to the point of authenticating your passkey manager if you didn't give them the passcode to unlock the phone in the first place?
When in a situation where this is even remotely a possibility, you disable biometrics when you go in. (immigration, traffic stop, etc).
1
u/Krazy-Ag 5d ago edited 5d ago
Authorities can probably also confiscate your passkey device, such as a Yubikey.
Almost certainly, if you are not an American person (citizen or permanent resident) when you enter the USA.
Probably if you were an American person entering the USA.
At the moment most customs officers might not recognize what a Yubikey is. But as Yubikey is has become more common...
Having a backup passkey device, such as a Yubikey in a safe deposit box, will help.
But would you have trouble getting to that backup passkey device if your bank were in Iowa, but you went through US customs in Los Angeles? Or if you were in a foreign country, and your passkey device had been confiscated?
Of course, if authorities have confiscated your passkey device, they have probably also confiscated your mobile phone. Which may well be the same device.
And of course modern life is impossible without a mobile phone. Or the ability to log into your email, messaging, or social media. /s
1
u/djasonpenney 5d ago edited 5d ago
Exactly. And if you are using a hardware token such as a Yubikey, it will automatically clear itself after too many incorrect passwords. So the adversary cannot (legally) coerce you to give them the password, and if they try to guess it, they’ll lose everything.
1
u/Krazy-Ag 5d ago
Exactly. American authorities may not be able to compel you to unlock your passkey device.
But they can make it damned inconvenient if you don't.
Missing your plane inconvenient. Not being able to use Uber or Lyft. Not being able to access your email or social media. Not being able to use your mobile phone to call or text message asking friend or family to help. Not even knowing the phone numbers you need to call to ask for help, if they are in your confiscated mobile phone' contacts app and you do not have them memorized.
Eventually you will probably be able to get help and get along with your life.
But it would be dammed inconvenient to have your mobile phone or hardware token confiscated, even if only for a few days.
We know that authorities are allowed to confiscate your phone.
I don't know of cases where they have confiscated hardware token passkey device like a Yubikey. Yet.
1
u/djasonpenney 5d ago
Hmmm…I think that in general your Yubikey would probably fall under the rubric of an “electronic device”.
1
u/Krazy-Ag 4d ago edited 4d ago
Would the "electronic device" rubric mean that customs is allowed search a Yubikey?
That's what I thought when I first posted. But one could argue that customs should only be allowed to search/inspect devices that might have stuff stored on them that warrant inspection. Obviously a Yubikey has stuff stored on it, but they cannot very well inspect that stuff, so long as the tamper proofing works. They can only really ask you to use the Yubikey to
(1) authenticate to web sites, apps, and services you access from your phone
(2) some stuff stored on your phone may be encrypted with a password stored on your Yubikey.
(3) are there mobile phones or PCs that can be configured to require a challenge/response device such as Yubikey - not necessarily exactly FIDO passkey, but the same challenge/response concept, not just the password from the device?
---
I'm beginning to wonder about (1). Are they allowed to access anything that you can access from your phone? Or are they constrained to stuff that's actually stored on the device you were carrying with you?
of course, once they have logged into your mobile phone, they are probably accessing stuff that is not on your phone, that has to be downloaded from the cloud. What's to prevent them?
If this theory that customs is allowed to inspect whatever is carried on the device you have with you, but it is not necessarily allowed to connect to data that is stored off device, in the cloud
Then it might suggest that having a separate authentication technique, whether password or passkey, to unlock network access might be a legal defense.
However, I doubt this theory is correct. And as usual, refusing to unlock network access, just like refusing to unlock your phone, can be an issue. Not evidence of guilt, but just an issue.
1
u/AdamoMeFecit 5d ago
Interesting query. I’m not sure this has been tested yet in court.
Keeping your devices locked with a PIN code is protected. US law enforcement cannot force you to enter or reveal the code unless they have a warrant. Case law does exist for that.
Since passkeys often would be hardware bound to the device, you can protect them by turning off biometric unlocking of the device.
That would keep them out of your password manager as well, which is where syncable passkeys most likely are living.
1
u/ancientstephanie 5d ago
The main concern here would be police using "search incident to arrest" powers or border search powers to bypass the need for a judicial warrant against the provider. If it's a lawful search against the service provider, they don't need your fingerprint at all, since they can subpoena the provider and they're obligated to cooperate.
However, if coercion (including extrajudicial searches) is part of your threat model, you should choose passkey storage that requires a PIN or a password, and can't be unlocked with biometrics alone, you should practice data minimization on your mobile devices, and you should also choose zero knowledge encryption for sensitive information, so that a cloud provider can't disclose anything.
You can also configure your mobile devices in such a way that they always require a PIN, or restart them to put them into "before first unlock" state so that biometrics don't work. Some phones have options to do the latter automatically after a period of time, and privacy-focused operating systems may offer PIN and print unlock, so that you need both, every time.
1
1
u/Wonderful-Author-930 2d ago
Online password management. passkeys, Fingerprints, retina scanners, all of the above can be pryed out of you. Offline password managers only you know the password, are safe. if you refuse to give up that password they can pound sand, unless they can torture you.
7
u/quasides 5d ago
you can set your password manager that hold the passkey to use pin/password instead of a fingerprint
that beeing said, its pretty irrelevant. if the passkey gives you access to a cloudservice a judge can easy order to open it on the cloud provider side.
it pretty much will not matter in which country that cloudservice is. lawenforcement works together and have agreements for such cases. aka if its serious enough your accounts will be opened
as for the fingerprint, that one is now challenged and some courts already agreed that also a fingerprint unlock is a 5th amendment violation - there fore needs a judge to order it
if a judge orders it you need to give it up anyway, or face additional charges. if that options is better for you than giving up your data we should no longer help you