Why You Should Stop Using Face ID: A Privacy Concern
The convenience of using face scans to unlock your phone and log in to accounts is undeniable, but it comes with a hidden risk. Law enforcement can compel you to use biometric data to unlock your device, but they can't force you to provide a password or passcode. This loophole was recently highlighted when an FBI raid on a Washington Post reporter's home was unsuccessful due to her iPhone's Lockdown Mode. Despite the agents' inability to access the phone, they obtained a warrant to compel the reporter to unlock her computer via a fingerprint scan.
So, are biometric scans truly secure? While face and fingerprint scans can be used against you, passwords and passcodes cannot. This is why you should consider stopping the use of biometrics to unlock your phone. Here's why.
Understanding Biometrics: Face ID, Fingerprints, and Passkeys
Biometric data refers to the face and fingerprint scanning used by devices to verify your identity. This data can unlock your device or log in to sensitive online accounts using a passkey. I've written extensively about passkeys and their importance in passwordless authentication. You can create a passkey on a lockable device using biometric data or a passcode, then use it to access your online account.
My decision to stop using biometrics was not driven by cybersecurity foresight but by inconvenience. During the COVID-19 lockdown, I found it challenging to unlock my phone while wearing a mask and glasses. However, depending on your circumstances, there may be more compelling reasons to avoid biometric data on your devices.
Assessing Your Risk: Determining Your Security Needs
Not everyone requires the highest level of device lockdown. It's easier to unlock your phone with a glance or swipe than to remember a device-specific passcode. Individuals at high risk of surveillance by governments or criminal organizations, such as activists, immigrants, journalists, and politicians, should consider using a passcode or passphrase. Law enforcement officers cannot force you to manually enter your passcode or PIN.
For those in these categories, it's wise to make accessing private data on your phone or computer more challenging. Android and iOS devices offer settings to remotely delete all phone data with a tap, as mentioned in an article about securing devices before crossing the US border.
Exploring Lockdown Modes and Advanced Protection
Apple devices offer Lockdown Mode, a setting blocking attachments, device management installations, and calls or FaceTime connections. It also enables a restrictive browsing setting, as demonstrated by the Washington Post reporter's experience. To enable this on your iPhone, go to Settings > Privacy and Security.
Android devices have a similar lockdown setting, temporarily disabling biometric unlocks. Google also provides Advanced Protection mode, requiring hardware security keys or passkeys to protect Google accounts. This setting blocks harmful app downloads and prevents unverified third-party apps from accessing your data without permission. Enable it on the web by logging into your Google account and accessing the Security and Sign-in menu.
The One Lock Law Enforcement Can't Force Open
When switching to passcodes for device locking, remember to delete existing biometric data. The good news is that biometric data is stored locally on your device, not in the cloud. Deleting it from your device ensures it's truly gone.
For Android users, go to Security and Privacy > Device unlock/Biometrics and tap the delete icon. Set a passcode to unlock your device by visiting the Lock Screen section. iOS users should visit Settings > Face ID/Touch ID & Passcode and reset Face ID or delete fingerprints. Set a passcode using a passkey or passwordless authentication method.
Privacy Beyond the Lock Screen
The incident involving the Washington Post reporter highlights the importance of protecting your personal privacy. While you may not have anything to hide, it's crucial to safeguard your private information from government officials and strangers. Take control of your digital privacy by carefully reading privacy policies, closing old online accounts, and using strong, unique passwords for all your accounts.
Explore our cybersecurity checklist for periodic tasks to enhance your online safety. For those seeking further privacy measures, read our article on how to completely disappear from the internet.
