Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Would be interesting if this would become popular one downside I see to this is that if law enforcement get their hands on your token they can unlock the device. Also as the token can be regarded as a key rather than a password a court would be able to legally compel you to surrender it without invoking much debate regarding laws against self incrimination (e.g. the fifth).


Can't law enforcement now just ask Google or Facebook or whoever for the information they need without needing your password (or future token)?


It's not that simple, firstly some Google and Facebook services are E2E encrypted which means that they cannot comply.

This also goes well beyond just Facebook and Google and if you use it to lock a physical device like a phone or a laptop that isn't something Google or Facebook would be able to help law enforcement with.

Also while I don't want to make a statement or start a debate on the level of compliance and attitude that Google and the rest have towards search warrants (because it's not relevant and I don't have sufficient knowledge to actually form an informed opinion on the matter). Google and Facebook's legal departments have more funding than most state attorneys yet alone local DA's if they want to fight on your behalf (or on the behalf of their business model) in court they would be able to do so much more effectively than you ever could.

Google and Facebook also require a full and lengthy process with FIDO tokens they can do it on the spot, heck they are legally able to do so if you either agree to a search or law enforcement has an alternative sufficient basis to invoke a lawful warrantless search:

https://en.wikipedia.org/wiki/Warrantless_searches_in_the_Un...

TLDR; Officer: May I search your vehicle You: Yes

At that point they are legally are allowed to take the FIDO token from your keychain and unlock your laptop.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: