Last week, Samsung announced that its Galaxy S8 phone would let you unlock it by scanning your face — a method that could be quicker and simpler than entering a passcode or even using a thumbprint. As we noted at the time, this isn’t a strong security measure; in fact, someone already fooled it with a photograph. But there’s another, less-obvious issue: one key Constitutional protection for passwords usually doesn’t apply to biometric security measures like face scanning.

The Fifth Amendment, which protects people from having to incriminate themselves, holds that passwords or passcodes are “testimonial” evidence. In other words, you can refuse to give up your PIN because doing so would mean answering a question based on the contents of…

Continue reading…