Hong Kong police can now demand phone passwords under new security rules
vidyesh
133 points
154 comments
March 27, 2026
Related Discussions
Found 5 related stories in 48.3ms across 3,471 title embeddings via pgvector HNSW
- Refusal to Give the Govt Passwords to Personal Mobile Criminalized in Hong Kong jmsflknr · 25 pts · March 26, 2026 · 72% similar
- South Korean Police Lose Seized Crypto by Posting Password Online WarOnPrivacy · 72 pts · March 01, 2026 · 50% similar
- FBI stymied by Apple's Lockdown Mode after seizing journalist's iPhone alwillis · 15 pts · March 04, 2026 · 48% similar
- Apple Requires Device-Level Age Verification in the UK Now. Is the US Next? smurda · 17 pts · March 29, 2026 · 45% similar
- Hundreds of Millions of iPhones Can Be Hacked With a New Tool Found in the Wild WalterSobchak · 115 pts · March 18, 2026 · 44% similar
Discussion Highlights (17 comments)
xvector
This shit is why I don't visit China.
tyho
Wow, what a free society! In the UK if you refuse to unlock your device you can be imprisoned indefinitely! In HK it's just one year!
mmsc
Ah, finally catching up to ... The UK, Australia, Ireland, France, the Netherlands, and probably a lot more.
vrganj
The horrible bastion of despotism that is China-run Hong Kong has now caught up to the rule of law utopias of enlightened thought in the US and UK.
jonex
Feature request: Make it default behavior on phones that you can have multiple passwords, connected to different profiles. With no way to determine how many profiles a phone have. I'm sure there's some people here working on mobile operating systems, might be worth considering?
kleiba
It would be nice if phones had a feature where you can define more than one pin, but only one is for your actual phone contents - the other ones leave you to a completely harmless but otherwise indistinguishable looking smartphone interface that contains no or only completely bogus data.
embedding-shape
"Featured" on HN just a week ago, seems GrapheneOS' "Duress pin" would be very helpful in these cases: https://grapheneos.org/features#duress ( https://news.ycombinator.com/item?id=47445931 ). Now we just have to wait N years for Android and iOS to get approval from the government to build something similar, that they can market yet somehow screw up enough to not actually help.
everdrive
No one likes when I say this but it's really past time to stop doing anything interesting on your phone. Delete all your apps, set it as minimally as possible. Leave it home when you go for walks, and power it off when you go driving or to the store, or whatever.
kevincloudsec
I think everyone's glossing over that this extends to anyone who knows the password. Your sysadmin, your business partner, your spouse. Hong Kong just turned your company's entire key management chain into a legal liability.
dev_l1x_be
Ohh no, so they caught up with US border patrol?
3yr-i-frew-up
>The US is evil >China makes you give phone passwords, China makes Apple give user data >The US wiretaps 1 person "OMG THIS IS AN OUTRAGE!" We forget because a Republikan is in charge how good we have it in the west. We forget how bad it is elsewhere.
maplant
The cops from the John Woo HK action flicks I've seen would love this
firefax
These kinds of laws worry me since I have forgotten several old passwords. Being disorganized shouldn't be a criminal offense.
chirau
What happens if you just say "I don't know it, only answer calls on it."
anonymousiam
I wonder what would happen if HK tried to force somebody to unlock their business phone. It's typically a violation of corporate policy to allow a third party to access the encrypted, confidential information on corporate mobile devices. The poor device user would be faced with a choice of losing their job and being held criminally liable for breaching their company's systems, or going to jail in Hong Kong.
davidfekke
Wow, it sounds like they are becomming a bunch of commies.
RandomGerm4n
That is exactly why a Duress Pin, like the one in GrapheneOS, should be standard everywhere. Ideally, it should also include an option to visibly destroy the device by overheating it, to ensure that no one can accuse you of not having actually deleted the data and keep asking for a password.