Andy Burns wrote:
> My phone itself is protected by fingerprint or swipe-pattern, but it is kept
> unlocked when in proximity to certain bluetooth devices that don't leave my home.
Hi Andy,
Thank you for taking the question seriously - as it is a very serious
problem that people are hoodwinked by MARKETING to do the wrong things.
As you are smart enough to comprehend, the question was asked in a way that
points out the utter absurdity of "needing" face-id just to make constant
locking/unlocking bearable for the average phone user such as you & I are.
While my phone will do them all, I don't use _any_ of them simply because a
physical threat to my phone by my family & friends is low on my threat
scale.
That you use a proximity geofence makes sense at least in terms of the
threat not being from your own spouse, kids, and visiting friends.
But what's the physical threat _outside_ the home?
Do you have a lock around your wallet for example?
What's different between your phone and your wallet in terms of threat?
My point is that physical threats are what MARKETING wants you to think are
the threat you're protecting against - when that's simply not true.
>
> Sensitive apps (online banking and my business accounting) are protected
> individually by fingerprint,
First off, if you have sensitive "stuff" on your phone, it's trivial to
protect that sensitive stuff with encryption - so I won't delve further.
As for the banking app itself, I'm pretty sure it requires some kind of
2FA/2SV such that a common thief wouldn't have _both_ verifications, right?
Hence banking and business accounting, as far as I can tell, should NOT be
a problem because they should _already_ be protected with their own
encryption.
For example, just store the data in a Truecrypt container and ALL the data
is safe & sound no matter who yanks your phone out of your hands, right?
> but that still leaves email which someone given
> unlocked access to my phone could attempt to alter credentials of e.g. online
> shopping accounts ...
As for email, there is an issue because many people sync automatically, in
which case it would be just opening the app itself which needs protection.
But if your phone were stolen, all you'd need to do is change your
verification credentials, and, as you're well aware, "most people" (not me,
but most people) are using 2FA/2SV anyway - so the thief has nothing,
right?
If email were really the problem, then all you'd need to do is protect that
email app (which is easily enough done) and not the entire phone, right?
My whole point is that marketing has hoodwinked people who stopped thinking
about what the real threat is - and it's not somone physically grabbing
your phone.
> someone stealing a copy of my contacts could do a bit of
> reputational damage, etc
As you are well aware, I don't keep _any_ contacts in the default sqlite
database location - so I'm well aware the biggest threat is OTHER PEOPLE
uploading my contacts to their login accounts (e.g., whatsapp, facebook,
whatever).
If contacts were so valuable, people would rebel against uploading them by
default (which is what the GMail app does on Android, for example).
And yet they don't.
So I don't really believe yet that people are "protecting" their contacts
by the constant locking/unlocking of their phone lock screen.
While I'm a scientist and an engineer so I am well aware that intuition is
often wrong, I'll believe almost anything if you give me a good reason.
Having said that, you'll need a convincing logical fact-based argument for
me to believe that people are putting up with constant lock/unlock of their
phone to protect their contacts when people seem to upload those same
contacts to many web sites without even blinking.
The point is that MARKETING wants you to believe physical access to your
contacts is the threat - when that's NOT the threat in the least.
>
> So I do prefer to let the phone lock itself when it's away from home. No
> inconvenience when at home, no worry when away from home ... what's not to like?
Do you know the moral of the emperor with no clothes story?
That's what's not to like about being told the threat is X when it's not.
When you're told by the phone maker that the threat is X and the phone
maker then provides solution Y - but both the threat and the solution are
fabricated by the phone maker's marketing team - that's what's not to like.
It's an adult viewpoint, is it not?
The main question is what are you protecting?
My point, which I brought up humorously, his that marketing has hoodwinked
people who stopped thinking. You and I need to think. What's the threat?
I propose that the only people who "should" need FaceID gimmickry,
are those people who literally live in the dank slums.
Otherwise, what are they so afraid of that every second they have to lock
their phone?