Universal 2 factor authentication (U2F) and pleading the fifth amendment
<p>Back in 2013, <a href="https://www.wired.com/2013/09/the-unexpected-result-of-fingerprint-authentication-that-you-cant-take-the-fifth/" rel="nofollow noreferrer">WIRED</a> stated that using fingerprint authentication on a phone may not prevent authorities (in the US at least) to gain access to one's phone without their agreement, whereas a memorized password requires approval by the accused party.</p>

<p>Supposing the party protected sensible information with a U2F device (not just a phone based On Time Password (e.g. Google Authenticator)), would authorities be legally allowed to simply use that device without the accused party's consent?</p>

<p>If the search is otherwise legal then the U2F key would be no different than a traditional metal key to, say, a house.</p>

<p>As the linked article says, for something to be "testimonial" it must reveal something from your mind. So accessing OTP secrets from a phone would also be legal.</p>

<p>The only thing that <em>protects information</em> is encryption. For the reasons above, such encryption also cannot solely rely on secure elements (U2Fs, OTPs, TPMs, etc.) because you need the 5th Amendment privilege for it to hold up against the government. </p>

<p>There is a court proceeding that says not even passwords are no longer protected by fifth amendment:
<a href="http://courthousenews.com/wp-content/uploads/2016/12/iPhonePasscode.pdf" rel="nofollow noreferrer">http://courthousenews.com/wp-content/uploads/2016/12/iPhonePasscode.pdf</a></p>

<p>The reason is that passwords are self-authenticating, and thus it does not mean the person in question does not self-incriminate. The reason why the protection of self-incrimination exists, is because a individual could then be coercied to falsely admit into have commited a crime he didn't commit, leading to a innocent person being charged with a crime.</p>

<p>However, a password is self-authenticating in that way that it will give access to the item, the password wont say if he is guilty or not on itself, thus, a innocent individual cannot incriminate itself by providing the password, even the correct one.</p>

<p>This means, a judge can by a civil contempt order, jail a person indefinitely until he provides the password. (And if the person forgets the password - jailed for life)</p>

security federal-courts