Phone lock screen mfa with passkey and/or security key?

chillpepper

Hi everyone I apologise if this is a noob question but is there a way to use multi factor authentication with the lock screen password on your phone? If you have a high threat model and live in a country such as the UK, you can be compelled to give the authorities your password and failing to do so is a criminal offence and can be punishable with jail time (UK RIPA part 3, section 49 https://www.legislation.gov.uk/ukpga/2000/23/section/49) However in part 9 of this law it explains that: (9) A notice under this section shall not require the disclosure of any key which -
(a) is intended to be used for the purpose only of generating electronic signatures. So my reading of this is that if mfa was enabled with a security key or and/or passkey, then you could comply with a request and hand over your password but not have to hand over your secuity key and/or passkey, because such things are exempt under part 9. Meaning you could comply and avoid prosecution while knowing that the password you are handing over is essentially useless if they dont have the ability to get past the mfa. Does anyone know if this is possible please and if not can it be explained why or provide links where I can read up on why so I can keep learning please? Thank you (P.S this is my first post and I don't know how to indent paragraphs I'm sorry)

de0u

chillpepper A notice under this section shall not require the disclosure of any key which -
(a) is intended to be used for the purpose only of generating electronic signatures.

A key that is intended to unlock a phone doesn't seem like a key with a sole purpose of generating electronic signatures.

That said, I am not an attorney, and it seems as if this line of reasoning is something that would benefit from being run past an attorney qualified to practice in the UK.

LeslieFH

chillpepper

I see no scenario where the law enforcement confiscates your phone and requests your password, but you get to keep your U2F security key, if they want to check your phone, they're confiscating all your electronic devices.

chillpepper

Edit: or would tools like Cellebrite have enough info with your password to bypass the mfa anyway?

unsaltedsanctionsnowdrop

de0u A key that is intended to unlock a phone doesn't seem like a key with a sole purpose of generating electronic signatures.

I think you actually have a strong argument that it would meet the definition if the mechanism by which it unlocks the phone is only by generating signatures. Otherwise you could argue that e.g. if a key is used only to sign emails, it doesn't mean the definition, because the emails were used to authorize a transaction once the signatures were verified, which would be absurd. What another system does upon verifying the signature has no bearing on whether the key itself is only used to generate signatures.

chillpepper Edit: or would tools like Cellebrite have enough info with your password to bypass the mfa anyway?

I think it's not practical to integrate this with the BFU auth in a way that provides any real security since a pure signature auth scheme wouldn't be able to be tied to the encryption itself, so the encrypted storage would still only be unlocked by the passphrase and any MFA there would be kind of like the current AFU MFA. That is, this doesn't seem to provide enough benefit to be worth the time of the GOS devs.

wizoatk

de0u

It does appear to me to be a reach to far.

OP omitted (9)(b) which restricts further:

(9)A notice under this section shall not require the disclosure of any key which—
(a)is intended to be used for the purpose only of generating electronic signatures; and
(b)has not in fact been used for any other purpose.

Electronic Signature is also unlikely to be interpreted as broadly as was assumed. I'd guess that something closer to the definition in UK Public General Acts2000 c. 7Part II Section 7.

chillpepper

de0u my reading of this is that it means not used for any other purpose other than to generate electronic signatures, and given that the device is incapable of doing anything other than that, I am interpreting that to mean that 9a exempts the key, but like yourself I am no lawyer either I just wanted to see the opinions of others

chillpepper

wizoatk I didn't include 9b because it is a given that the key has not and cannot be used for any other purpose other than to generate electronic signatures

I have read throught the link you supplied and, again just my interpretation, I am thinking that this particular piece of legislation seems to be referring to when you sign an online document with your actual written signature, just done online and therefore being referred to as an electronic signature. A lot of this seems open to interpretation and I'm not aware of any precedent of this being tested in court to look for any case law/legal precedent

chillpepper

unsaltedsanctionsnowdrop ah right ok thank you for explaining that, yes if the mfa would not provide any extra defence against Cellebrite if they know the password then that would indeed seem to be a waste of time for the devs. I am quite new to all this so thank you all for your responses and explanations

The-Man

https://www.legislation.gov.uk/ukpga/2000/23/section/49 word soup/alphabetti spaghetti

I cant take this post seriously.. so

Little anecdote.

They can, whoever “they” are? via this act to compel you to divulge your password in the right circumstances and if you fail to comply, there are consequences.

So, name the owner profile any name you choose other than your own, even use a family name like John Smiths phone. Pack it full of all your dangerous data etc and protect it with an enormous password/pin that you realistically cannot remember.
Create a profile for you and put your name to it, use it for tame things like texting family etc, photos of pets, usual banal stuff. Password this with a usual tame password or pin.

Use your owner profile for all your spy stuff etc with the password you have stored elsewhere other than your person.

Now, you were out and about but alas.. find yourself in detention and the RIPA Act is waved at you, tell us your password they demand, so do it, give them your tame profile password, the profile with your name on it, no bother, they can have all the usual day to day banal stuff.

Aha they cry there is an owner profile, whats the password to that. Don’t know you say in all convincing honesty because its so damn long and complicated, at best you know the first six digits but that’s it. They threaten you with the RIPA Act again..

Then you point out the RIPA Act compels you to divulge your password, which you did. However the phone is John Smiths, it was loaned to you. That password is his not yours.

Don’t think for one second you have won, you have just angered them, whoever “them” are.
Your dangerous stuff is protected by a magnificent password so will remain safe for a while
in several months or years your device will be able to be broken into as it became EOL
you bought yourself time that’s all.
Perhaps, you can hide on the other side of the globe in a sheep farm or cattle ranch, if given bail etc..

Moral of the anecdote.

The best way to foil the RIPA Act is, don’t use your phone as a data bank for data that will flush away your liberty down the pan, then be daft enough to carry it on your person, then be doubly daft getting detained with it in your pocket….

chillpepper

The-Man very good point about EOL thank you. I am new to Graphene, so even if the authorities are given the password to unlock one profile, you're saying an alternate profile is still just as secure (or unsecure) as it was beforehand? With the phone then being unlocked with the password from the other profile would it not be more at risk? I appreciate if you were just making an off the cuff jokey tale and it wasn't to be taken seriously, but I am a noob here so just wanna check

The-Man

chillpepper

chillpepper , I am interpreting that to mean

And that is where the "law is an ass", if you can interpret to mean X, another person can interpret it to mean Y and a Judge may come to the conclusion its Z

The-Man

Each profile has its own password etc and is secure as the next. Passwords/pins must be more than six digits long, that's my opinion, people use four, I think in this situation as long as possible not to get in the way of using your phone.
The anecdote may be flippant, but its a fact paperwork served on you for your password not for other peoples passwords. Its up to "them" to prove you are John Smith, they may well know you are, but knowing and proving are Galaxy's apart.