Bike crash left Spokane man unconscious, so his Apple Watch called 911 - <AUTHOR> https://www.seattletimes.com/seattle-news/bike-crash-left-spokane-man-unconscious-but-his-apple-watch-called-911 <comment><USER3> I bet this is a great feature (and I do have an Apple Watch), but can we please hold for a sec here? This piece reads like an Ad. Furthermore, many comments here are about "I want to see my kids grow up". Now please, calculate the odds of:

\- you are in a terrible accident

\- there is no one around you to call an ambulance

\- you can't call an ambulance yourself, because you are knocked out or can't move

I think the odds for such an event are rather low. If you like smart watches, sure, go ahead and buy one. But for everybody who just wants to wear it because they are afraid: I don't think it's necessary for most people, unless you ride around alone in remote areas and are inexperienced or whatever.

My point is: don't buy because of fear if your risk profile is super incredibly low.

<comment><USER4> > _\- you are in a terrible accident

\- there is no one around you to call an ambulance

\- you can't call an ambulance yourself, because you are knocked out or can't move_

Increasingly large odds after a certain age, and not small if you do certain sports (e.g. trekking, climbing, etc) regardless of age.

In fact, older people falling accidents is so common, a proverb in a European country says: "The elderly die either from falling or while shitting" \-- the original is funnier than the translation, because the two causes rhyme).

The accident doesn't have to be terrible either. Tons of run of the mill accidents leave people unconscious...

But you don't read about such cases as such.

E.g. an elder person who fell either they eventually get up in time and call for help (so you don't read any story), or they don't, and the story is "person found dead in their apartment" etc, and might or might not mention the fall...

Is it as necessary as a spare tire in your car or a fire extinguisher in your home? No. But (since the device it does other stuff too) not bad to have regardless.

Note: For certain categories, this is so needed, that there are expensive special purpose devices that are popular for certain cases (e.g. elderly with dementia, parkison, bad backs, and so on), e.g.: [https://www.medicalalertadvice.com/fall- detection/](https://www.medicalalertadvice.com/fall-detection/)

But this is a multi-purpose device, and a cool one at that, plus it has a phone attached and can call the 911 itself, and gives this ability as just another feature to everyone!

<comment><USER5> Likely your Apple Watch won't be able to call for help if you're injured trekking or climbing, unless there's a cell tower on the mountain.

Having personally been run over cycling, multiple passersby called 911 for me immediately, and I was in a ambulance in less than 10min.

<comment><USER4> > _Likely your Apple Watch won 't be able to call for help if you're injured > trekking or climbing, unless there's a cell tower on the mountain._

Don't know about the US, but in several mountains I've been on around the world (not in developing countries though), signal was just fine. It might not work for Everest, or the remotest part of the Rockies, but most hikings/treks are not in such places...

<comment><USER6> I wouldn't be surprised if Everest specifically has some coverage nowadays.

</comment></comment></comment></comment></comment><comment><USER7> My cousin died last week of a heart attack on the way from his house in a village south of Nuremberg to the bakery 10 minutes away to get bread for breakfast. His Apple Watch (presumably because of the fall detection) called emergency services for him and gave him time to call his wife.

<comment><USER8> Sorry to read your cousin died this way. I don't understand.

The Apple Watch told him his heart isn't working right - automatically calling emergency services - and he also called his wife to let him know the watch says there is an emergency with his heart?

Or was it that he too passed out, the Apple Watch called emergency services, who resuscitated him enabling him to call his wife?

<comment><USER9> I think the watch detected his fall (which was a result of the heart attack)

<comment><USER10> The specs for the watch specifically rule out heart attack detection, by the way.

> Apple Watch cannot detect heart attacks. If you ever experience chest pain, > pressure, tightness, or what you think is a heart attack, call emergency > services immediately.

<comment><USER11> "What we list for legal purposes" and "what the device actually does" might not be the same thing. I imagine saying "my device detects heart attacks" gets the FDA involved and makes everything ten times more expensive...

<comment><USER12> Well the watch isn't measuring troponin levels so it's hard to imagine how useful it could ever be at MI detection, especially given the limitations of a poor contact single lead ECG.

<comment><USER13> Even if it could check a trop, that's a pretty late indicator. If you're having the big one, you're going to be dead before your troponin spikes.

<comment><USER14> Is that right? When I worked in medical instrumentation, I was always told that TnI was a leading marker.

<comment><USER13> It will take up to 8 hours for troponin levels to rise after the onset of symptoms (typically 3-4).

<comment><USER15> ER nurse here - some STEMIs I've taken care of had negative initial trop's (not all though). The 4 hr delta should of course be positive though - I don't typically check the 4 hr repeat for STEMIs though because they're long gone out of the ED to the cath lab then to CVICU.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Tip: the fall detection feature seems to be turned off by default. I just turned mine on. [https://support.apple.com/en- us/HT208944](https://support.apple.com/en-us/HT208944)

<comment><USER17> Also of note: Fall detection is exclusive to the series 4 or above, which seems questionable.

(I would be very surprised if the series 3 and 4 have significantly different accelerometer hardware)

<comment><USER18> Consider that to detect falls reliably, you might need an accelerometer with a higher range than that was in the original watch.

<comment><USER19> Might also have needed a higher sample rate.

For battery life concerns, I can see them implementing some of the fall detection logic in hardware as well. For example, a high shock or shaking could trigger the fall-detection software to wake. Although, with the 60-second period, they probably wake the main processor often enough anyway that hardware detection might not save much power.

</comment></comment></comment></comment><comment><USER20> Well, crap. I have been avoiding smart watches like the plague but this plus the ECG may put me over the edge. My family has a history of heart disease, I commute by bike every day, and I have a young child who I want to see grow up.

One of my friends was recently killed in a motorcycle crash. A passerby found them in the morning in some bushes near the side of the road. We don't know what time the crash occurred, or even if they died right away. This feature may have saved them.

<comment><USER21> If you're in the market for a smart watch, and you're a cyclist, I'd recommend checking out Garmin. They have a massive array of sensors and record very precise data that is aggregated on Garmin Connect. It's been invaluable to me for assessing training effectiveness over time. They make Apple watches look like toys. If you want the latest and greatest, the Forerunner 945 is probably what you're looking for, but the older models can be found for cheap and are still solid watches. If you want emergency alerts, you'll have to stick with newer models though.

<comment><USER22> I think you are missing the point here completely and utterly. Compared to what the Apple Watch can do (as mention on the post and several comments) the garmin watch may be the real toy here.

<comment> sh-run That's hardly true, the two devices have very different purposes. I couldn't run an ultramarathon (or even a shorter trail race) in an apple watch. That's before we even start talking about features. The battery would die long before I finish.

The FR945 that was released this year has far more features than the apple watch (including the emergency features). Even comparing the Apple Watch 4 to my FR935 (released in 2017), the Apple watch would be a huge step down for my purposes. That's all without mentioning the fact that I'd probably break the apple watch on my first outing.

The Apple watch might be a better smart watch for day-to-day use, but next to a Garmin it's pretty obvious which is the toy.

[https://www.dcrainmaker.com/product-comparison- calculator?ty...](https://www.dcrainmaker.com/product-comparison- calculator?type=watch&ids=91895%2C102074%2C72457%2C97965#results)

<comment><USER23> When I was a kid, my next door neighbor was an ultra-marathoner and the fittest person I'd ever met. He died suddenly one day of a heart attack while out on a run.

<comment> sh-run When this happens it's typically due to undiagnosed cardiomyopathy (which is very difficult to detect). It's true that when something like that happens to someone they would've lived longer had they not been an endurance athlete, but most endurance athletes live about as long as their less-active peers.

I get a yearly physical just to be safe, but honestly running is my favorite way to decompress and I'd need some kind of diagnosis before giving it up.

<comment><USER24> > most endurance athletes live about as long as their less-active peers.

I'd venture to say they live far longer.

From the introduction of Vina & al 2016:

In longitudinal studies, physically active men and women have an approximately 30% lower risk of death compared with inactive people (Schnohr et al. 2015). No upper threshold for physical activity has ever been recommended (Pate et al. 1995). In fact, in studies performed on top‐level athletes, participation in endurance competitive sports increases life expectancy (Hartley & Llewellyn, 1939; Prout, 1972). Moreover, Karvonen and co‐workers found that Finnish champion skiers lived 2.8–4.3 years longer than the general male population in Finland (Karvonen et al. 1974). We tested the effect of strenuous exercise, performed by well‐trained humans, on their longevity. We measured average and maximal lifespan in cyclists who had taken part in the Tour de France between the years 1932 and 1964 and compared them with those of the average population in those years. Only cyclists born in Belgium, France and Italy were included in our study. The results were striking: we found an 11% increase in average longevity in Tour de France participants when compared with the general population (Sanchis‐Gomar et al. 2011). These results have been confirmed recently with the observation of a significant 41% lower mortality rate among French elite cyclists from the Tour de France, compared with the general male population (Marijon et al. 2013). Evidence from human studies supports the notion that regular, vigorous aerobic exercise might be a useful tool, with a dose–response effect, to improve the overall health status and longevity of the general population (Ruiz et al. 2010; Teramoto & Bungum, 2010). However, the controversy regarding the potential adverse effects of regular strenuous physical exercise continues (Benito et al. 2011; Schnohr et al. 2013). Schnohr and co‐workers have found that moderate‐intensity joggers have lower mortality rates that sedentary people or high intensity joggers. In other words the relationship between intensity of jogging and mortality follows a U‐shaped curve (Schnohr et al. 2015). Thus, the ideal 'dose' of exercise needed to improve longevity is not a simple linear relationship. Genetic aspects as well as lifestyle factors (smoking, diet and alcohol consumption) may be important in interpreting studies aimed at determining the effect of exercise training on longevity.

<comment><USER25> I suspect that generally only healthy people would become serious endurance athletes. Is that taken into account in these studies?

I also suspect lifting weights (and a bunch of other things) is important for long term health, how does that relate?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> I really want an Apple Watch for this and the EKG / Heart stuff. But I hate the idea of having another bit of technology on my wrist when I already have the iPhone with me. I like watches, the mechanical kind. I love them as the art of design and as fashion item to be match to what you are wearing (when appropriate). I do not want to give that up. In the end I will likely give in and get the Apple Watch just because I want to be around long enough to see my kid grow up.

<comment><USER27> Think of the Apple Watch as something that you can use to reduce your phone usage. If you get the one with cellular and GPS, you can go walking/biking/outside and be reachable while at the same time not staring at your phone all the time. Even when you are at home the justification, for me at least, to keep the phone closer was because I might get a call or message I need to respond to. With the Watch, the phone goes straight to its stand as soon as I get home knowing well that I'll get the notification on my watch. This is what's finally helping me wean off the constant need to keep my phone and pull it out to check instagram/hn/reddit repeatedly if I'm bored for even a second.

<comment><USER26> So I kicked the Reddit habit. I pretty much only read HN, BBCNews, ft.com and ArsTechnica at this point. I have stopped looking at my iPad, iPhone, etc. when watching TV, sport or a movie. The need to always look was really unhealthy. I am much happier now. I have like 5 books on my iPad that I have never quite finished over the last 2 years when before all this easy tech I would have read them quite quickly. It really bugs me. I am going back to paper books as it forces focus (no, I do not want a book only reader to carry as well). The only reason I really care about having the phone with me is for the family. Between email, slack, hangouts, AppleIM and Line it is all just to damn much.

<comment><USER28> agreed. the responder there is such classic apple. You should get the watch because it counts as not looking at your phone?? Even though you are still looking at a screen. Kind of bizarre logic to me but to each their own bud.

Also good for you man, ditchin some of the distractions for focus. I think some people get weirded out by me when i watch sports because i'm basically 100% in the zone and yelling constantly. Trying to soak up every detail of every play. not casually browsing and watching 2 / 3 screens at once. I can go hours without my phone without really noticing much honestly.

</comment></comment></comment></comment><comment><USER29> I have lots of criticisms for Apple, but this is truly an amazing thing that technology has brought us to this point. This is one of the few things that has me feeling like we "live in the future"

<comment><USER30> In the future, everyone will wear a smart watch (2015):

[https://h4labs.wordpress.com/2015/07/28/in-the-future- everyo...](https://h4labs.wordpress.com/2015/07/28/in-the-future-everyone- will-wear-a-smartwatch/)

I'm disappointed that Android Wear didn't take off.

More competition would greatly increase innovation.

<comment><USER31> _> I'm disappointed that Android Wear didn't take off. More competition would greatly increase innovation._

Android wearables have a chicken and egg problem. Manufacturers aren't innovating because nobody is buying and nobody is buying because there are no innovations.

Apple is fully vertically integrated so it can recoup the high R&D costs for new silicon and other components through the price of the unit but on Android platforms you have separate manufacturers for the vital components who are under pressure to be cost competitive as they don't get a slice of the profits of the final product so they won't invest in R&D until they see enough consumer demand which isn't there.

<comment><USER32> Apple also has the willingness (and resources, but those resources are a consequence of that willingness) to double down on tech it believes in.

If Apple Watch hadn't been an immediate success, I'd like to think they'd still be pushing hard to make it so.

Most of its competitors have far more offerings with much less commitment behind any one of them.

<comment><USER33> > If Apple Watch hadn't been an immediate success, I'd like to think they'd > still be pushing hard to make it so.

Apple Watch _wasn 't_ an immediate success - at least not in the form we see it today. WatchOS 1.0 was dramatically different from what we have today, with much less focus on health and more focus on 'connecting you with people' and stuff.

Apple kept working at it, paring out the stuff that wasn't useful (the side button was originally dedicated to a list of contacts to send messages to for example), and doubled down on the stuff that was (health). Clearly it has worked...

<comment><USER32> All true, but the original Watch brought over $1 billion in revenue in its quarter of release[1], so I'd call that a success.

[1]: [https://1reddrop.com/2019/01/07/apple-watch-sales-history- fr...](https://1reddrop.com/2019/01/07/apple-watch-sales-history- from-2015-to-2018-3-years-and-50-million-units-in-the-making/)

</comment></comment></comment></comment></comment></comment><comment><USER34> Does this feature work outside the US? Which countries are supported? [https://www.apple.com/watch/cellular/](https://www.apple.com/watch/cellular/) has a country list but not for this feature specifically.

edit: found [https://www.apple.com/watchos/feature- availability/](https://www.apple.com/watchos/feature-availability/)

<comment><USER35> Emergency SOS should work in any country, as long as you have your iPhone nearby or you have a Cellular-enabled watch.

Your second link is specific to international roaming with the cellular- enabled watch, which gets complicated for various reasons (do you need an active SIM, does the modem on the watch support bands used in that country).

<comment><USER36> The latest Series 5 watch has improved the international SOS feature - <USER2> the Ars Technica review[1]:

> The improvements to the SIP and cellular bands allows the Series 5 to make > use of its SOS feature in more than 150 countries now. If you find yourself > in a bad situation, or the Watch's fall detection kicks in when you fall off > your bike during a cycling workout, users with cellular Series 5 models can > now call emergency services in various countries.

[0] [https://arstechnica.com/gadgets/2019/09/apple-watch- series-5...](https://arstechnica.com/gadgets/2019/09/apple-watch- series-5-review-a-better-more-independent-timepiece/2/#h1)

</comment></comment></comment><comment><USER37> Great names in this article. Julie Happy from the fire service and the accident happening on Doomsday Hill. Reads like a kids story.

</comment><comment><USER38> I just got my series 5 Apple Watch a couple of days ago, and the ECG functionality is a big part of why. There's history of heart disease in my family, and I've been to the doctor a few times with symptoms but of course when I get there they find nothing wrong. Maybe I'm a hypochondriac, who knows. Anyway, last time I went my doctor asked if I could share data from my watch, so figure I'd upgrade so I can get an actual ECG – what a time to (hopefully) be alive!

<comment><USER39> I was able to ask my doctor to prescribe a halter monitor for 24 hours after similarly having intermittent "irregular heartbeat". I have fantastic insurance and have access to a major cardiac research center so ymmv but may be worth asking for the 24 hour study if you're concerned.

Ultimately what I got back was "yep you do have an irregular heartbeat sometimes. It's nothing threatening and you'll be fine." They additionally did a stress test and found that under exertion my heartbeat returns to normal so it was nice to have the peace of mind.

</comment></comment><comment><USER40> > His watch messaged emergency medical services at 12:02 p.m., and an > ambulance was there within a minute.

Talk about response time, wow!

<comment><USER41> Please do not use code blocks for quotes, it creates long side-scrolling windows.

<comment><USER42> Can someone fix this? WHERE'S DANG, he's sniffing around all the time. It has to be one line of CSS.

<comment><USER43> > Can someone fix this?

There is nothing to fix: code blocks do (almost) exactly the right thing for code. (the indentation on the right is unnecessary and counterproductive, though, but that's not the main source of the complaint here.)

They are horrible for quotes, especially on mobile, but that's not what they are for. Admittedly, quotes are vastly more common than code on HN and HN could use a good quote formatting mechanism, but that's a missing feature, not a bug in code formatting.

<comment><USER44> Even just formatting > as <blockquote> would be a good change.

</comment></comment></comment></comment></comment><comment><USER45> My friend was digging a hole in her garden. Her watch asked her, "are you ok?".

<comment><USER46> Digging is a very strenuous activity as well as shoveling. Anytime there's a major snow storm, enough people die from shoveling. So it probably detected that she was very stressed.

<comment><USER47> Can confirm, grandfather died from a heart attack when shoveling snow.

<comment><USER48> Mine slipped a disc while shovelling as well. The torso twisting motion is really bad if you have existing back problem.

<comment><USER49> Any time I see someone shovelling a sidewalk or driveway with something other than a sleigh shovel, I'm baffled at why they're not using a sleigh shovel.

</comment></comment></comment></comment></comment><comment><USER50> FTA:

> As opposed to social media or GPS tracking apps, Schaeffer said the Apple > Watch fall-detection feature offers extra reassurance by not relying on a > person to alert first responders.

We're early enough in the adoption cycle that this is an undeniable benefit. Obviously, if nobody else is around, then it's life-saving. But I do worry about the long-term ethics. What if, when such watches become common, it becomes socially acceptable to just ignore people in life-threatening distress - "I don't need to call 911, their watch will have taken care of that." Just another nail in the societal coffin of distorting individualism as insularity.

Not a reason to ban this technology (or any similar action). Just something to keep in the back of our heads as the adoption curve progresses.

<comment><USER51> I think this is nothing new to worry about. Bystander effect ([https://en.wikipedia.org/wiki/Bystander_effect](https://en.wikipedia.org/wiki/Bystander_effect)) was relevant before Apple Watch.

<comment><USER52> There was a study recently that basically debunked this theory. It was done by tracking real incidents through cameras in big cities in Europe. Long story short, the more people were there the more likely that someone offers help.

<comment><USER53> A lot of countries in Europe have Duty to rescue laws ([https://en.wikipedia.org/wiki/Duty_to_rescue](https://en.wikipedia.org/wiki/Duty_to_rescue)):

"circumstance in which a party can be held liable for failing to come to the rescue of another party who could face potential injury or death without being rescued"

<comment><USER54> In contrast, in 2007 a man in Baghdad noticed an injured man by the side of the road, and stopped his car (containing 2 children) to help. He was immediately killed by the US military for doing so; they were watching from an Apache helicopter and shot him dead for stopping to help.

[https://en.wikipedia.org/wiki/July_12,_2007,_Baghdad_airstri...](https://en.wikipedia.org/wiki/July_12,_2007,_Baghdad_airstrike)

</comment></comment></comment></comment></comment><comment><USER55> This is a simple obvious addon that every connected portable device could implement. When I bought my fist and last smartphone (Android 2 at that time) after noticing it had an accelerometer on board I immediately thought of an app that could detect a fall when going at some speed, then start beeping for like say 10 seconds and in case the user didn't stop it (as in signaling "I'm ok") it would call emergency numbers sending them coordinates through SMS. I had other things to do at that time, and it seemed so obvious that I thought it already existed or someone soon would create something similar.

<comment><USER56> This really wouldn't work for phones. The accelerometer needs to be very high precision, which is why it only works on very recent Apple Watch models. The accelerometer also needs to be running all the time, even while the main processor on the device is sleeping. Also you need a reliable way to detect that the device is firmly attached to a human; it's not acceptable to call 911 when a phone falls on its own.

</comment></comment><comment><USER57> I know that hill, used to drive it most weekdays and have ran up it several times. Its not the steepest grade, but long with gnarly pavement at the bottom. Cars zip through there at 45 though its a 30mph zone because the lanes are quite wide. He's pretty lucky.

</comment><comment><USER58> Until an Apple Watch is able to work with my ANT+ powermeter it's something I would avoid taking on a bike ride.

Garmin, Whahoo and other bike computers have had off crash alerts via a linked phone for, maybe, 10 years I think. Certainly since the Garmin Edge 1000 at least. That's a better fit for me as I'd never ride without my phone in a jersey pocket.

I'd always want a screen in front of me and not on my wrist.

<comment><USER59> Have you heard of that feature actually working? Fall detection is going to be _a lot_ less reliable from a phone than a wrist watch. In fact when I googled it one of the top three results is 'how do I turn off incident detection on my Garmin' due to false alerts.

<comment><USER58> Well I never actually used it myself as I haven't crashed for years but I know it's there. Equally though I've never heard of this working from an Apple Watch before so I don't think my anecdotal opinion on that is worth raising.

I do know I use stuff like VO2Max estimation, FTP estimation, recovery estimation, power zones analysis and hill descriptions for climbing while on the bike and those features are not available on an Apple Watch to my knowledge. I know for sure that Apple doesn't support ANT+ and that's important for me.

An Apple Watch might be a good companion if you're a runner or a cycle commuter but it appears to be pretty limited if you want to use it for cycle sport.

</comment></comment></comment><comment><USER60> Remember, only Apple Watch™ can save your life and your loved one's. Buy one now for each person you care about. You care about them, do you?

<comment><USER61> I think you would be an irresponsible monster if you did not track your family and yourself at all times.

</comment></comment><comment><USER62> I agree that in this particular use case it was beneficial to wear an Apple Watch. But never ever wear a watch on your motorcycle. The force and impact can mess up your wrist in a crash. If you land on the watch it can push the case into your wrist potentially breaking it. Or hook behind something. If you do insist on a watch, wear a motorcycle jacket and long gloves over it.

<comment><USER63> Is this based on real accident statistics? If you ride motorcycle without gloves and jacket and crash you will have much more severe injuries to care about much more certainly. So I would doubt wearing a watch is a significant risk factor.

<comment><USER64> Answer: it is not based on real statistics nor experience

<comment><USER62> I'd love to send you some pictures of the titanium plate in my wrist. Motorcycle accident, went over the bars in an angle that my wrists didn't like. Not caused by a watch but ever since I stopped wearing watches. Adding 100+ grams of steel near such a delicate bone is a recipe for disaster.

Also, as a developer, I don't care as much about losing functionality in my lower body. My wrists, hands and brains however are how I make my money. Even though I have full disability insurance, I still would much rather keep working than sit at home.

</comment></comment></comment></comment><comment><USER65> This is a great scenario where technology has been put to a good use. I've never used smart watches. This is like an eye opener for me.

<comment><USER66> Props to the engineers and PMs who implemented this feature. Well done.

</comment></comment><comment><USER67> I'd love to get my Mom and Apple Watch but getting her to switch to iPhone is probably a bridge too far. How come no Android watches have this functionality?

<comment><USER68> Or, why hasn't someone made it possible to use an Apple watch on Android?

<comment><USER67> From what I've come to understand its possible to use the Apple Watch cellular without an iPhone but its a severely gimped experience.

<comment><USER69> You need an iPhone to set it up, update it, and otherwise manage it. To whatever degree it works without the phone there you're still going to need one.

</comment></comment></comment></comment><comment><USER70> What is the saddest is that some of Apple Watch's features are region-locked, recently heard a person complain about how he can't use the EKG functionality in his country. It could save some lives and we have georestrictions :/

<comment><USER71> Likely for legal/regulatory reasons.

</comment></comment><comment><USER72> I have crash detection on my Garmin watch. It texted my wife zero seconds after I rode up a steep drainage ditch. I had not crashed.

<comment><USER73> Imagine the panic some mother is going to have when her two teenage sons get in a car to go somewhere, safely get that somewhere and for whatever reason high-five each other as hard as they possibly can.

<comment><USER70> The Apple watch has a countdown and a sound alert before alerting anyone.

<comment><USER74> Garmins give you 30 seconds to cancel the alert too.

</comment></comment></comment></comment><comment><USER75> On the flip side of this Samsung removed the oxygen saturation SPO2 feature from its phones in Canada and Cyprus (weirdly random choices). It was probably for legal reasons but you'd never find out why.

Here in Canada my dad who has COPD and IPF was using it to get a ballpark idea of his current blood oxygen percentage. It's not a medical device but it's (was) convenient for someone in his situation.

It seems fraudulent for a company to remove a feature without notice (yes probably buried on line 1,256 of an update). Not just an app but one that used a physical device/sensor on the phone removing it seems very wrong if not illegal.

<comment><USER76> Pure speculation: perhaps it wasn't reliable enough so it got yanked?

<comment><USER77> I'd think the decision should be up to the owner of the device. Who is the company to determine acceptable functionality AFTER purchase?

<comment><USER78> Who is in a better position to know if such a feature doesn't work?

<comment><USER77> It's not really related to determination of use value or other qualitative questions. If my blender, or even my blood pressure machines, gets recalled, the company doesn't break into my house to cut the wires for my safety. How is this not a basic violation of the Computer Fraud and Abuse Act?

Edit: canada and cyprus only is why.

<comment><USER78> Right. But you own your blender. It's naïve to think you own your phone just because you carry it around.

<comment><USER77> Is it? That definition of property worked pretty well. Try and take it I'll hit you, etc. Otherwise why pay for it and why not just take it by force?

Just a matter of time before these companies get too greedy and get hit with violence.

<comment><USER78> Maybe it shouldn't be, but it is. People are putting microphones in their homes that Amazon controls and that serve no purpose but to let them spend money with Amazon more conveniently. The old definition of property doesn't really capture that does it?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER79> I'd love to have this passive features, but the problems I have with smartwatches is that most of them are ugly, and I'm trying to minimize notifications in my life.

<comment><USER47> You can disable pretty much all notifications from the watch, separately from your phone. I only use my apple watch for activity tracking, music while cycling without my phone, and things like checking the weather (and time, I guess).

As for them being ugly, at least Apple has a wide selection of bands, and the watch itself is as unoffensive as a rounded rect can be, but I feel you there. It's not a work of art, but at least it's not the house arrest bracelets that fitbit sells.

</comment></comment><comment><USER80> I agree the Apple Watch is really useful this way. But can't an "independent" device do this?

It does not need to be tied to a phone or an app ecosystem (android or iOS) to work. It does need a cellular connection, and some logic on the device, but that's about it. This device would be cheaper and affordable to a larger set of people than spending upwards of $500(estimated) on an apple watch.

<comment><USER81> One could also carry around a calculator that's cheaper than their cellphone.

Not many folks under 60 walk around wearing heart monitors, fall detectors, and other health monitors. This is about those things becoming commonplace for everyone.

<comment><USER7> My cousin was 53, vegetarian, biked and ran regularly. This gave him the chance to say goodbye.

</comment></comment></comment><comment><USER82> This is one feature that Apple is certainly heading in the right direction.

</comment><comment><USER83> Curios: does Android Wear OS has none of this features?

\- Heart rate monitoring and warning when something is not right with the heart?

\- Fall detection and call 911?

<comment><USER81> Upcoming Samsung Galaxy Watch Active 2 has heart rate, ECG, warnings, and fall detection… but Samsung, so who knows how well any of it will work.

<comment><USER29> I don't think the Active 2 is an Android WearOS device. However I have the Active 1 and very much prefer it to WearOS.

<comment><USER84> It's not, it's a tizen device.

I preordered, but maybe it's because I've been off samsung so long I've forgotten

</comment></comment></comment></comment><comment><USER85> This is why I am on Hacker News. Technology can be such a terribly helpful thing.

PS If this is a PR placement, this is masterful.

<comment><USER86> There's probably a PR firm involved at some point. Possibly in the comments?

</comment></comment><comment><USER87> After using my IPad's software quality, the killer lineup for Apple Arcade, and being impressed with Apple's commitment to privacy:

As a long time Apple hater, they are doing a great job of convincing me to spend the money on their products.

( MacBook Pro is still overpriced and kinda sad tho )

<comment><USER88> MacBook Pro is _now_ overpriced and kinda sad.

It peaked in 2015, and it was a truly beautiful machine.

</comment></comment><comment><USER89> Life Alert, horrendous as their ads may be, would probably be surprised to hear that it's only now that you're finding a "device which can contact emergency services in the event of an accident" so life changing. As might OnStar, etc.

<comment><USER90> As well as what the sibling commentors have pointed out, Life Alert also never bothered to partner with a company that would put their system into a piece of consumer-electronics that the average healthy (maybe even _young_ ) adult would buy for themselves. Nobody wants to wear a LifeAlert bracelet _and_ a watch/fitness-tracker; they want their watch/fitness-tracker to just _have that functionality_. And so they make a choice, and end up dying in a ditch somewhere.

<comment><USER91> This is the key thing.

There are many good ideas that exist out there that are "unknown" because the product they are in misses some aspect of how consumers would wish to consume them. My favorite was that the Tesla Roadster wasn't the first electric car, but it was the first that I could see myself buying at some point.

The nice thing about this being a feature of the watch is that the watch brings a bunch of great stuff all on its own. That it can _also_ call emergency services or diagnose Afib is like bonus time.

<comment><USER89> > or diagnose Afib is like bonus time

Careful with that as an assumption:

> In people younger than 55, Apple Watch's positive predictive value is just > 19.6 percent. That means in this group — which constitutes more than 90 > percent of users of wearable devices like the Apple Watch — the app > incorrectly diagnoses atrial fibrillation 79.4 percent of the time. (You can > try the calculation yourself using this Bayesian calculator: enter 0.001 for > prevalence, 0.98 for sensitivity, and 0.996 for specificity).

> The electrocardiogram app becomes more reliable in older individuals: The > positive predictive value is 76 percent among users between the ages of 60 > and 64, 91 percent among those aged 70 to 74, and 96 percent for those older > than 85.

(Source: [https://www.statnews.com/2019/01/08/apple-watch-iffy- atrial-...](https://www.statnews.com/2019/01/08/apple-watch-iffy-atrial- fibrillation-detector/))

That being said, I will not at all dispute the ECG tools as very valuable.

[https://www.ajmc.com/conferences/acc-2019/giant-study- sugges...](https://www.ajmc.com/conferences/acc-2019/giant-study-suggests- apple-watch-accurately-catches-afib) \- discusses the findings in the context of the Apple Health "Study" announced at one of their events.

<comment><USER92> In this case, it's better to have a false positive diagnosis than a false negative.

<comment><USER93> Why is that? IANAPhysician, but this seems like a fairly rare malady in this age group. Do we really want all of these people rushing to the hospital? If no one trusts the Apple Watch's diagnosis, how useful could it be?

<comment><USER92> I think the rate is low enough that most people are not getting multiple spurious notifications to rush to the hospital, so trust is probably not the issue. The only problem I see is hospitals being overwhelmed, but again, I'm not sure if we're really overloading them.

<comment><USER93> Sure, most people are not going to hospital at the suggestion of their Apple watch. However, of those who _do_ go to hospital, nearly all are false positives. This will lead hospital staff to distrust the Apple watch. It may not have that effect on Apple watch owners...

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER94> It's amazing and all I get it. But let's not stop helping people because we think technology will always do it's job.

I can see in time people will say they didn't stop to help because they thought his car, watch, phone could've saved him.

</comment><comment><USER95> How long before the other watch makers (Samsung, Fossil, Casio, Seiko etc) starts to have these type of features?

I am asking this because these type of features should be pervasive and be widely adopted by those at risk.

The more watch makers that has these features the better.

</comment><comment><USER96> I bought an Apple Watch when a friend of mine showed me the EKG function. Also bought an iPhone. Realized that this is the future for us all, so I bought a lot of Apple stock.

</comment><comment><USER97> Can Apple watch be programmed to call relative in case of hard fall / unresponsiveness like this?

I have elderly father in Eastern Europe and he would really benefit from this.

<comment><USER98> It looks like it also sent a text to his son.

<comment><USER97> Also does Apple Watch require ownership of iPhone?

<comment><USER99> As I mention above, the way I did this was to buy a low- cost/locked/unactivated iPhone 6s and paired the watch to it. It thus provides in-home monitoring of such events; I can confirm that it works well since it got inadvertently activated a couple of times (the first watchOS version with this feature seemed to be prone to false positives) and I had to talk to the emergency agent on her behalf to state that everything was ok for now.

<comment><USER97> Can I have one iPhone (in USA) and two watches - one in USA (me), another in Europe with my dad attached to local European SIM card to call local European number if he falls?

<comment><USER99> I don't think so unfortunately - the cellular watches are weird in that they must be on the same cellular network as the associated iphone. The recipe I suggested above works with the non-cellular version of the watch and counts on being on the same wireless network as the phone. So imo, you will need one iphone per watch. However, I have been able to get refurbished iphone 6s devices for as little as $60; you probably don't want anything older than 6s as it is the oldest device that can still run iOS 13 and thus future proof for just a little bit.

<comment><USER100> And iPhone SE ? Mine runs 13.1

<comment><USER99> You are right - that should work well as well I believe due to its 6s internals. It's a good idea too: in the US the SE can be found even cheaper than the 6s.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER101> This is wonderful.

Now - I just want that hydration sensor that was teased a while back. So many health conditions that accurate information about hydration could assist.

</comment><comment><USER102> Boy I'm sure he was relieved he had his APPLE WATCH™ with him. I am sure we are all imagining right now how horrible things would be for us and our families if we were in such circumstances without an APPLE WATCH™. Good thing black friday and Christmas are coming up so I can gift all my loved ones an APPLE WATCH™ just in case, not doing so would clearly be negligent and uncaring on my part.

<comment><USER103> Why is it so bothersome that technology that helped someone has a brand?

<comment><USER102> It's not that, my problem is it's an article which is basically an advert which at the time of writing is top of the front page with +800 upvotes and full of comments talking about how great the product is. Talk about "Hacker" "News".

</comment></comment></comment><comment><USER104> One nice thing about GMs "On Star" is it will call for help automatically if there's been an airbag deploy. I was very surprised that other car manufacturers didn't start doing the same thing when GM did (they've had this feature for at least 15 years) given how cheap cell phone technology is and how the sensors to deploy airbags are reliable and in every car.

</comment><comment><USER105> What if you come home after a bad day in a bad mood and throw your watch down on the nightstand? Will an ambulance show up at your house?

<comment><USER106> Yeah or like, what if you just fall and decide to stay laying down for a minute but you're actually fine?

I wonder if the fall has to happen in combination with some other health metrics that it senses? Does there even need to be a falling down? What if you have a heart attack while you're strapped into your parked car and you don't fall? Does it call then?

<comment><USER107> WSJ tested some of these scenarios: [https://www.youtube.com/watch?v=G7xI2dUPN3A](https://www.youtube.com/watch?v=G7xI2dUPN3A)

Seems very hard to trigger inadvertently, so it makes sense to me that they use an algorithm that factors in the heart rate and the fall trajectory and velocity.

</comment></comment></comment><comment><USER108> Keep your DocWagon(tm) contract paid up, chummer!

<comment><USER109> Best healthcare provider in the UCAS!

</comment></comment><comment><USER110> I saw this story, but didn't know it was in my hometown and current city of Spokane, WA (~200k people, growing city). Very cool. The hill where he fell is the crux of our annual Bloomsday race (running/walking/wheelchair, 12km) which ~50k participants each year. Hence the name "doomsday hill" in the article.

</comment><comment><USER111> If you get into an accident, and the connection to your phone is lost, this wont work.

Phone destroyed or dead battery and no call correct?

</comment><comment><USER112> Apple watch seems to be a decent device but not supporting android means it's not an option for most of us.

<comment><USER78> Samsung, Xiaomi, or Huawei will catch up on features eventually.

</comment></comment><comment><USER113> Someone should post about how many lives the car safety measures have saved. I bet it will get 800 upvotes too

<comment><USER103> "Appreciate mundanity: after all, a pencil is high technology." -Alan Kay

</comment></comment><comment><USER114> If you live in country where emergency services number is not 911 there is sometimes a forward from 911 to the local number like 112 or phone may detect the local emergency services number. Problem is that not all countries have location detection for emergency calls.

</comment><comment><USER115> Side story: I just bought an iPhone 11, and proceeded to put it into a new case. During this process the phone tried to call 911 two times. The process was only stopped when I hurriedly cancelled. I can't imagine I'm the only one.

</comment><comment><USER116> Annual [https://en.wikipedia.org/wiki/Transthoracic_echocardiogram](https://en.wikipedia.org/wiki/Transthoracic_echocardiogram) tests are the best way to prevent heart attacks

<comment><USER49> Compared to exercise and diet? How is getting an TTE actionable to prevent heart attacks?

</comment></comment><comment><USER117> Am I the only one concerned about the possible repercussions (to the wearer, I mean) of triggering a law enforcement response?

There have been multiple cases now where (American, obviously) Law Enforcement have brutalized and injured people experiencing diabetic shock.

And what if the fall and unconsciousness is the result of illicit drug use? Surely the wearer doesn't want a call to 911 to be the default behavior in that case.

Does Apple act with greater discretion in jurisdictions where law enforcement are known to be criminally brutal or corrupt? I suspect that the answer is "no."

Since people of color experience a greater proportion of negative outcomes from law enforcement contact, I surmise this feature is far more useful for white people.

Don't get me wrong - it's a cool feature for sure. But until we untangle law enforcement (and state brutality) from medical and fire response, it's potentially a dangerous one for some users.

<comment><USER118> > _There have been multiple cases now where (American, obviously) Law > Enforcement have brutalized and injured people experiencing diabetic shock._

Those incidents are reprehensible and should never be forgotten, and I don't intend to excuse them or the culture that enables them, but statistically they are extremely rare. Even in the worst parts of America, in a medical emergency you are better off with emergency treatment than not.

And if you don't want the watch to call 911, for whatever reason, you can turn that feature off.

</comment></comment><comment><USER61> Why would people buy an expensive watch like this when a simple bicycle helmet could save their life? Especially if it is a MIPS helmet (because the previous non-MIPS ones apparently did not work despite all the claims they did)

</comment><comment><USER119> Can anyone tell me if this is a standard feature in all smart watches these days, or just an Apple thing?

I have the Series Zero, which is now state of the ark, so I'm not really up on what's widespread anymore.

<comment><USER120> There is an absolute gulf in quality and functionality between the Apple Watch and other smart watches. It's not like the smartphone industry at all. Nobody can compete with the Apple Watch and nobody is even vaguely trying.

<comment><USER121> There's one distinguishing flaw in the Apple Watch; you can only pair it with an iPhone.

</comment></comment></comment><comment><USER122> My girlfriend has an Apple Watch. We wrestle and practice jiu-jitsu in bed sometimes. When I was squeezing her wrists, the watch buzzed and asked if she wanted to call 911.

<comment><USER61> OK, Mr.{Ep|Wein}stein.

</comment></comment><comment><USER123> This is an Apple product that literally sells itself

</comment><comment><USER124> Is this US only, or does it work in EU countries too? F.i. if I have a similar accident in Poland, would it call 112?

</comment><comment><USER125> Anyone know of any force alarm emergency service automatic dials from a watch or app (Apple or otherwise?).

<comment><USER47> I am having a hell of a time trying to parse that sentence. Can you rephrase?

<comment><USER126> they're trying to ask if there's a chance for false alarm (i think)

<comment><USER99> The first watchOS version that had this monitoring built-in seemed to be prone to false positives. However, the watch first asks you if you are ok and if you do not acknowledge so in a few seconds, then it dials out.

<comment><USER69> Right. The other day I accidentally slammed my watch into the wall and it started asking me if I was OK. You have a chance to say that everything is fine and that you don't need help before it starts calling emergency services and telling people you're in trouble.

</comment></comment></comment></comment></comment><comment><USER127> I know apple watch can do such things, I just dont like how they hype this, I do think this is a soft sell, somehow apple is evil because they sent the message that Apple watch can save your life, so people will buy it or discuss it , it kind of become viral. while actually it doesn't guarantee it will behave the same when you have a heart failure.

</comment><comment><USER128> So he already got unreleased Apple Watch? I thought that feature was just announced.

<comment><USER129> Fall detection has been available since Series 4 [https://support.apple.com/en-us/HT208944](https://support.apple.com/en- us/HT208944)

</comment></comment><comment><USER130> Curious - does Apple Watch call 911 if you flop onto bed and start napping away?

<comment><USER131> It also considers your cardiac rhythm so I would think they trained their model to consider it.

<comment><USER7> My understanding is they are very specific about this not being able to detect heart attacks - hence why I'm hesitant to speculate about the exact sequence of events above

</comment></comment></comment><comment><USER132> so how does this work? does the apple watch use siri to say something via phone or does your watch only starts a call and you need to speak? how is your location transmitted technically?

</comment><comment><USER133> I genuinely wonder what it said when the 911 operator picked up.

<comment><USER134> Me too, though it was probably an SMS, not a call. US emergency services accept text messages.

The article says: "His watch messaged emergency medical services at 12:02 p.m., and an ambulance was there within a minute."

Though this seems to be contradicted by the previous paragraph: "His Apple Watch had called 911 through the fall-detection feature, which sends out an alert if the wearer is immobile for 60 seconds after a fall."

Edit: It makes a call, according to Apple's docs [0].

[0] [https://support.apple.com/en-us/HT208944](https://support.apple.com/en- us/HT208944)

<comment><USER33> > Me too, though it was probably an SMS, not a call. US emergency services > accept text messages.

Point of clarification - US Emergency services _can_ accept text messages. Currently it's only available in certain areas, and it's up to each local ESD/911 call center to implement it if they choose.

And yes - the apple watch does _call_ 911.

<comment><USER134> Thank you for clarifying. I didn't think of the potential consequences of my statement

</comment></comment></comment></comment><comment><USER135> couldn't any phone do this? they have so many sensors

</comment><comment><USER136> I am happy that Bob is safe. We still need a smart watch that can function using a battery or at a capacity of a normal watch to make this event a bigger success.

</comment><comment><USER137> An important system - reminds me of how where the F1 safety + medical car is automatically scrambled if a crash is > 20G on impact.

</comment><comment><USER138> are there other devices that do this that don't cost an arm and a leg?

</comment><comment><USER139> so i guess the watch made it?

</comment><comment><USER140> "It just works"

</comment><comment><USER141> We got a call recently from my elderly grandmother's Apple Watch letting us know that she'd fallen. This feature was the main reason we bought the watch for her, and it worked when it mattered. (She's fine.)

<comment><USER142> What did it say? Was it using Siri's voice?

<comment><USER141> I actually didn't get the call myself, so I couldn't say. I'm sure there are examples of it on YouTube or whatever though.

</comment></comment></comment><comment><USER143> > Then his helmeted head hit the ground so hard it knocked him unconscious — > hard enough for his Apple Watch to feel it.

> "A hit that hard could have killed me if I weren't wearing it," Burdett > said. _He had to replace the helmet._

Letter to the editor: the last sentence is a non-sequitur. You have to replace a bike helmet any time it takes an impact, even if it isn't "so hard," because even if it doesn't look damaged the foam may be compressed and useless for a future crash.

<comment><USER144> Same goes for child car seats. Some manufacturer actually replace them for free last time I checked.

<comment><USER145> If in a car accident, your auto insurance will cover the replacement cost. Ensure you include it in the claim.

<comment><USER146> Speaking of car seats, Steven Levitt did this talk eleven years ago.

[https://www.youtube.com/watch?v=um5gMZcZWm0](https://www.youtube.com/watch?v=um5gMZcZWm0)

The gist of it is that car seats do not help nearly as much as we hope. I got the impression that there ought to be a car with a built-in, non-removable car seat would work better. I'd imagine this would be an instant hit in the SUV market. However, no automaker seems to take up on the challenge. Is there a legislative obstacle that prevents automakers from doing this?

<comment><USER32> Unless you're leasing, I don't think parents would be thrilled to have a seat unusable after a few years. And even if you are, sometimes you're transporting people or large items other than your child.

People want safety, but they also don't expect to actually be in a serious accident.

</comment></comment></comment></comment></comment><comment><USER147> Why does everyone who praises Apple on HN qualify it with the fact that they don't like Apple for other reasons? Also, Apple is probably the best corporate citizen of any company its relative size in history.

<comment><USER148> It's not specific to this place. It's an effective persuasive argument technique. Say you want to praise Apple for something. Since praising Apple to Apple fans is preaching to the choir, your target is people who are not currently huge Apple fans. So, you begin by saying "hi, I am one of you, a person who isn't a big Apple fan." Now that you've established yourself as a member of the in-group, you drop your argument, "this aspect of Apple is good." Maybe you qualify it with "pretty good" to keep from tripping any alarms.

Note: that's not to say that the speaker is being in any way deceptive. People naturally evolve and reinvent more effective speech patterns, often unconsciously.

<comment><USER149> aka, virtue signaling.

<comment><USER73> It isn't technically virtue signing since it's meant to be persuasive.

The post further down (well, up now) that's calling attention to the fact that the guy should replace his helmet because he used it (something that is common knowledge for most people young enough to only have worn single use helmets and is literally printed on the helmet and packaging) is a better example of virtue signaling since it states something basically everyone already accepts as fact and is only tangentially related to the article in the first place.

Unfortunately, the term virtue signaling has taken on a political meaning so you can't say it and expect the internet even if you mean it in the technical sense.

</comment></comment></comment></comment><comment><USER150> You say it's a non sequitur and immediately restate the necessity to replace a helmet that's taken an impact.

I don't reckon that's how a non sequitur works:

A non sequitur is a conclusion or reply that doesn't follow logically from the previous statement.

<comment><USER143> In TFA, the (quoted) preceding sentences are repeatedly accentuating the _severity_ of the crash and directly implying that the severity is the reason for the replacement. The severity has has nothing to do with the need to replace the helmet, i.e., it does not follow logically.

<comment><USER150> No, a non sequitur would go something like this:

Bob was plantings some flowers. He had to replace his helmet.

Not a non sequitur:

Bob crashed his motorbike. He had to replace his helmet.

It might have been better if they'd written something about how a helmet needs replacing after any impact, sure.

<comment><USER151> This is an interesting logic discussion. :-) Does the term _non sequitur_ apply to correctly formed statements where the conclusion of the statement is incorrect? I would be inclined to agree with TheSpiceIsLife and say no. Because the article is based on limited sources, the article's conclusion about helmet replacement is incorrect, even if it's well-formed.

EDIT: Here's an interesting list of non sequiturs, many of which fit the same pattern as the article. I think loeg is probably right after all.

[https://examples.yourdictionary.com/non-sequitur- examples.ht...](https://examples.yourdictionary.com/non-sequitur- examples.html)

</comment></comment></comment></comment><comment><USER152> I'm amazed we don't have more of this already. I suspect some day everyone will have a biometrics device uploading data constantly.

<comment><USER153> That's the difference with Apple - I think health data can sync with iCloud but it's e2e and is opt-in, not opt-out. By default, it's on-device only.

</comment></comment><comment><USER154> Arf I want one now

</comment><comment><USER155> and ill still be this bitter dude who doesn't want the 911 call to happen even when im unconscious. :(

<comment><USER13> You probably won't enable this feature then...

</comment></comment><comment><USER156> All the more reason for Apple to do everything it takes to make the Apple Watch work with Android.

<comment><USER157> This makes little sense. You're imposing your sense of morality on an entity that is not beholden to the public good of mankind. If you want that that kind of service for everyone for betterment reasons, then demand your legislators to have the government invest in such a technology and have them distribute it. If Apple wants to do something for more reasons, that's their prerogative. It's no different than demanding that drug companies relinquish all patents on life saving drugs so that availability is greater and the product is cheaper while being dismissive of the development costs and efforts to get there.

</comment></comment><comment><USER158> This kind of story that leverages tragedy to build brand value is repulsive to me. The intent is arguable but it reeks of manipulative advertising.

<comment><USER158> Dear downvoters, why is this an article about Apple watch and not wearable tech generally?

<comment><USER159> Because that was Apple watch and not wearable tech generally? I had and loved my Withings Steel HR watch, but it cannot do this. Nor can most of the "wearable tech".

</comment></comment></comment><comment><USER160> Headline is misleading.

The watch detects falls and calls 911 based on that, not based on "unconscious".

<comment><USER80> I disagree. When Apple Watch detects an event that it considers as a fall, it asks the wearer if he/she is ok. Failure to respond then triggers the 911 call. So being unconscious had a lot to do with it.

</comment></comment><comment><USER161> Alternate headline: "Potentially Life-saving Tech Works as Advertised". I know, I know, it's a human interest story _and_ the regular folks might not know this. But my first thought reading the headline was, "it better call, or I'm going to be puzzling how to get a refund in the afterlife."

<comment><USER162> This is one seemingly tiny, new feature of the device. He might not have bought the device for this feature, or even have known that it was there. Or rather, the people reading might have not bought the device for this feature, or even have known that it was there. I think this is what makes the story popular enough to be going around.

<comment><USER163> FWIW, unless you are over 60 it's not enabled by default. Presumably this is to minimize false alarms, but if you want this feature enabled, you should make certain it's enabled.

Here's how: [https://support.apple.com/en- us/HT208944](https://support.apple.com/en-us/HT208944)

<comment><USER92> s/over 60/under 65/?

<comment><USER13> The correct answer (per the docs) is "over 65".

<comment><USER92> Right, I missed the "unless" in my replacement.

</comment></comment></comment></comment></comment></comment><comment><USER164> Don't forget to wear your watch! You've got wife and kids for cryin' out loud! Never leave home without wearing a watch! Or maybe just get a really good helmet and don't bike down "Doomsday Hill" lmao

</comment><comment><USER165> and soon, people will be scared to even consider going for a jog without a device like that on their wrist.

The more time passes the more i realize how much the saying « the road to hell is paved with good intentions » is true.

<comment><USER61> It seems highly likely to me that the Culture of Fear that pervades affluent western societies will exactly lead to what you predict.

And those of us that do not wear a permanent tracking device will have some sort of financial (insurance rates) and emotional punishments (peer pressure/blackmail) inflicted on us.

Speaking for myself, I'm ready to die when its time. If my body is so weak and knackered that I cannot even go for a bike ride without medical assistance then I reckon it's time to shuffle off this mortal coil and make way for someone else.

<comment><USER166> I can understand why you'd feel the risk of such an event is sufficiently low that it's not worth buying/charging/wearing a "permanent tracking device", particularly if you also feel it doesn't respect your privacy adequately. And I agree our collective tolerance to risk is going down over time. But I'm curious about this part of your comment:

> Speaking for myself, I'm ready to die when its time. If my body is so weak > and knackered that I cannot even go for a bike ride without medical > assistance then I reckon it's time to shuffle off this mortal coil and make > way for someone else.

This could happen because of a hit-and-run driver or because of some other temporary medical condition; either might be completely resolved with the right treatment. I think a better way to look at it is about your quality of life afterward. If you're terminally ill or of very advanced age with a poor prognosis for recovery, then I can see why you'd want a "do not resuscitate" order, would disable this feature, etc. Otherwise why not get help?

<comment><USER61> Agree about the quality of life afterwards being the most important issue. I have seen too many people who have lingered "alive". I suspect that if I get knocked down then there is a dichotomy of outcomes: 1) unpleasant, painful, survivable, not time-critical, not life-changing 2) major trauma, life can be saved with a time-critical intervention. Prognosis post-event is for a decreased quality of life. Would probably die if left without unusually quick ER.

I can only see the watch being useful for #2: the exact situation where I think it would be better that I die.

</comment></comment></comment></comment><comment><USER61> _Then his helmeted head hit the ground so hard it knocked him unconscious — hard enough for his Apple Watch to feel it.

"A hit that hard could have killed me if I weren't wearing it," Burdett said. He had to replace the helmet._

Sigh. Bicycle helmets prevent neither concussions nor death: by design, according to all epidemiological studies and according to the manufacturers of bicycle helmets.

[https://www.badscience.net/2013/12/bicycle-helmets-and- the-l...](https://www.badscience.net/2013/12/bicycle-helmets-and-the-law-a- perfect-teaching-case-for-epidemiology/)

Bike helmets are probably useful in reducing a tiny subset of head injuries.

And this is yet another anecdote proving the opposite of what the true believers think.

Sometimes I despair, then I think of this [https://www.youtube.com/watch?v=ZCL4dXUtblg](https://www.youtube.com/watch?v=ZCL4dXUtblg)

<comment><USER167> You are misrepresenting the research. The research is regarding the effect of public policy (making it illegal to bike without a helmet) on bicycle accidents.

> With regard to the use of bicycle helmets, science broadly tries to answer > two main questions... "what is the effect of a public health policy that > requires or promotes helmets?" and... "what is the effect of wearing a > helmet?"

> __The linked paper by Dennis and colleagues investigates the policy question > __and concludes that the effect of Canadian helmet legislation on hospital > admission for cycling head injuries "seems to have been minimal

<comment><USER61> I am not misrepresenting the paper: it attempts to explain why countries with mandatory helmet laws see _no_clearly_measurable_reduction in KSI (Killed, Seriously Injured) rates.

More cyclists wear helmets in those jurisdictions (parts of Canada, all of Australia and N.Z.) and yet ecological studies fail to clearly demonstrate any benefit from helmets. If you sprayed a field with RoundUp and saw no difference in the number of weeds compared to an unsprayed field you would start to wonder about the effects of the treatment.

<comment><USER118> > _I am not misrepresenting the paper: it attempts to explain why countries > with mandatory helmet laws see _no_clearly_measurable_reduction in KSI > (Killed, Seriously Injured) rates._

And in doing so, it goes to some effort to explain why you cannot, from that, conclude that helmets have no effect on individual accident outcomes, all other things being equal. (Mainly because all other things _aren 't_ equal, and it's very difficult to devise a methodology that makes them so.)

<comment><USER168> > it goes to some effort to explain why you cannot, from that, conclude that > helmets have no effect on individual accident outcomes

Right. A friend who's an ER doctor once put it this way:

"I'm going to hit you in the head with a hammer; you can wear a bike helmet or not, your choice."

Statistics are all well and good, but it would take a rare allegiance to epidemiology to skip the helmet.

I've also heard it said that statistics look different when you are the statistic...

<comment><USER169> Nobody is saying that you shouldn't wear a helmet. The point is that Helmets are at best only a marginally effective public policy to make cyclists safer.

> an emphasis on helmets reflects a seductively individualistic approach to > risk management (or even "victim blaming") while the real gains lie > elsewhere. It is certainly true that in many countries, such as Denmark and > the Netherlands, cyclists have low injury rates, even though rates of > cycling are high and almost no cyclists wear helmets. This seems to be > achieved through interventions such as good infrastructure; stronger > legislation to protect cyclists; and a culture of cycling as a popular, > routine, non-sporty, non-risky behaviour.

</comment></comment></comment></comment></comment></comment><comment><USER170> How probable is it that Apple planted this article? Its great marketing after all.

EDIT: to the downvoters: question everything.

<comment><USER171> > "question everything"

Man, when I was an edgy teenager I questioned everything. But then I grew up, had a family and you know what.... I ain't got time to question everything. Even if I spent all my time questioning everything, what would I gain? I couldn't possibly get answers to 99% of the things I question. I can't be an expert in everything.

So whats the point in questioning everything? Who gives a shit if this was a "stealth article" by Apple, the CIA or the Coca Cola Bottling Company. What difference does it make to me? None whatsoever.

These days I try to be very careful what things I spend my time & energy on.

</comment></comment><comment><USER172> Apple marketing machine in action: get local press to write up as a novelty feature that main competitor has had for ages.

<comment><USER173> Please name this competitor that had fall detection ('for ages') that automatically messages emergency services for you?

<comment><USER172> Garmin. You know, the brand that is 100x more popular among bicyclists.

<comment><USER174> This reads as though Apple did it first: [https://fortune.com/2019/01/07/garmin-vivoactive-cellular- sm...](https://fortune.com/2019/01/07/garmin-vivoactive-cellular-smartwatch/)

<comment><USER89> Kinda. The part that they're referring to is it being Garmin's first device with cellular capability. But it's definitely vague around fall monitoring too.

<comment><USER174> I'm referring to this sentence, which has nothing to do with cellular capability:

> Like the latest Apple Watch, which has a built-in fall detection system, the > new Garmin watch also has a safety monitoring feature, which the company > calls incident detection.</comment></comment></comment></comment></comment></comment>


Anthropological/Artificial Intelligence and the HAI - <AUTHOR> https://ali-alkhatib.com/blog/anthropological-intelligence <comment><USER2> For those of us not in Stanford's orbit, HAI stands for "The Stanford Institute for Human-Centered Artificial Intelligence", [https://hai.stanford.edu](https://hai.stanford.edu)

</comment><comment><USER3> I'm thinking about applying to HAI with a proposal for an AI that can generate paper proposals which would be accepted at HAI</comment>


Hacking your body:  Special Forces IamA on Reddit - <AUTHOR> http://www.reddit.com/r/IAmA/comments/b7d0x/i_have_drowned_twice_in_special_forces_training/

<comment><AUTHOR> This may be off topic, and may not. I think it has hacker content in that it is about hacking our own bodies, but I will happily submit to flagging. It is, no matter what, a very interesting look into the US armed forces, and to be honest, into the capabilities of the human body.</comment>


The CSS Value Transparent Isn't as Transparent as You Might Think - <AUTHOR> http://joshnh.com/2011/09/the-value-%E2%80%98transparent%E2%80%99-isnt-as-transparent-as-you-might-think/

<comment><USER2> Things were so much simpler back when transparent colors were always premultiplied.</comment>


Show HN: Clean Statistics on Covid-19 in the US - <AUTHOR> https://vexed.io/covid <comment><AUTHOR> I had been having trouble finding clean up to date info on the ongoing coronavirus, so I made this. Wanted to share it out in case other were looking for the same.

<comment><USER2> thanks!</comment></comment>


[PYTHON] Command line utility for automating subtitle downloading - <AUTHOR> A command line utility that allows you to download subtitles for your media files i.e., Anime, TV-Series and Movies. It's written in python, fast and extremely light-weight. It's time-consuming to open a browser, search subtitles for a movie and then download them. Subgrab is a utility that allows you to automate this process and save time. Allows you to download subtitles for a custom movie, movies contained in a directory, specify language in which the subtitles should be downloaded and specify number of subtitles to be downloaded for a file. It's open-source and can be found at:-
https://github.com/RafayGhafoor/Subscene-Subtitle-Grabber
Currently supports subtitles downloading from two sites which are subscene and allSubDB.
Suggestions/Critiques and contributions are welcome :). <comment><USER2> How does it differ from [https://github.com/mamins1376/Subscene- API](https://github.com/mamins1376/Subscene-API) ?

And from [https://github.com/Diaoul/subliminal](https://github.com/Diaoul/subliminal) ?

In regard to Subscene, does it hammer the server as the former supposedly does?

<comment><AUTHOR> The first one is an API, this is a script, it also allows you to select title for the media if the search string you provided has multipoe match or doesn't match - as well as a silent mode for suppressing the prompts. It also supports allsubdb site and is going to support other sites too. There alot of other things like supporting subtitles downloading for a complete directory.

About second one, Read here:- [https://github.com/RafayGhafoor/Subscene- Subtitle-Grabber/is...](https://github.com/RafayGhafoor/Subscene-Subtitle- Grabber/issues/2)

</comment></comment><comment><USER3> This likely should be a Show HN if it meets the guidelines:

[https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)</comment>


Darkwinds 1.0: Fully-featured trading card game with ERC721 tokens - <AUTHOR> https://playdarkwinds.com/development/2018/11/13/darkwinds-first-edition-released.html <comment><USER2> I tried it today and played against the A.I. several times and couldn't win but I had a fun time playing it. Rules are easy to understand and the game is very familiar. I just want to say that the bot kicked my a __!

</comment><comment><USER3> Looks amazing</comment>


It's Time to Fix HTTPS - <AUTHOR> https://docs.google.com/present/view?id=df9sn445_206ff3kn9gs&pli=1 <comment><USER2> I think it's important to know that, whether you agree with this deck that key continuity ("tofu/pop") is a better approach than PKI or not, what we're talking about here is a misconfiguration of SSL caused by a political quandary, not a fundamental problem with SSL/HTTPS.

The fact is, if your browser trust roots contain only trustworthy CA's, and you look to make sure you're using a secure site when you expect to, SSL isn't broken. Those sound like two big "ifs", and they may be, but consider: they are both user interface issues:

* There is no collaborative interface for community-rating CA trustworthiness, or even a reasonable interface for pruning CA's out of your browser --- let alone "do I trust certificates delegated from this CA, or just the CA itself". We are still using an interface for this functionality designed in the mid-'90s.

* The "first introduction" problem that key continuity suffers from is, in the SSL case, caused by the fact that the SSL cues in the browser are subtle. But why should that be the case? Is there really no interface anyone can come up with that appropriately signals "this page should be and is secured by SSL"? Because if you have that (or STS), sslstrip doesn't work.

Key continuity's problems, on the other hand, _aren't_ user interface issues. In key continuity schemes, when your browser is first introduced to a new website, you simply are insecure. If at that moment you are MITM'd by an attacker, you might never again be secure. This isn't a UI issue: key continuity protocols don't have the information available to them on first connection to make that decision.

Think to yourself, if you ran the great firewall of China, which system you'd rather have: the flawed one we have now, or the one that _explicitly allows your connection on the first and subsequent connections to a new service to be hijacked_?

I am our resident SSL/TLS apologist. But let me be clear that this deck is good, and raises a lot of valid concerns. I think SSL/TLS is a good system, but I share the (implied) disgust at the way our PKI has been managed. Some kind of reform is needed. I just don't think it needs to come with additional engineering sacrifices.

<comment><USER3> _In key continuity schemes, when your browser is first introduced to a new website, you simply are insecure. If at that moment you are MITM'd by an attacker, you might never again be secure. This isn't a UI issue: key continuity protocols don't have the information available to them on first connection to make that decision._

What if you add that information to a key continuity system? I feel like this is an obvious idea, but I've never heard of a system using it. It's simple: when you first see a certificate you send it to a trusted third party to check. That third party doesn't need to be or even know about the CA who originally issued the cert; all it has to do is make its own connection to the server and make sure it gets the same cert you did. That protects against any MITM on your end of the connection.

To succeed, a MITM would have to control either the server's connection (which becomes the server operator's problem), or both your connection and the trusted third party's connection (which becomes the trusted third party's problem). I'd rather trust a single third party of my choosing than a huge list of CAs chosen by an opaque and somewhat arbitrary process.

<comment><USER4> There are multiple hops from you to the server. That scheme would only verify that BOTH your and the third party's initial hops haven't been simultaneously MiTM'ed. It's very possible the routes overlap for several hops.

And even if they didn't, I wouldn't consider hackers getting my bank info-- or governments reading my email-- the server operator's problem.

<comment><USER3> The middle hops are much ( _much_ ) harder to MITM than the initial hops. If hackers control the bank's internet connection then they get _everyone's_ bank info, which is absolutely the bank's problem (and as such they would take measures to prevent it, like third-party monitoring of their certificates from other points on the Internet). As for governments reading email, the current CA system hardly prevents that. Under this system, you could detect MITM after the fact by using a trusted channel to compare the client's saved cert with the server's real cert. That would expose large-scale MITM tampering.

<comment><USER4> I don't see any reason why it would be much harder to hit the middle hops for a MiTM attack.

It certainly wouldn't be worth setting up a MiTM attack between my house and the first Comcast router my cable hits. That approach doesn't scale. Sure maybe if I'm Warren Buffet (or some mobster if we're talking about the government) it might make sense. And if they did do that, then NO source I connect to is a trusted channel, as they could MiTM any and all connections.

The scheme wouldn't (always) protect you from an attacker setup somewhere in between you and your destination, like the NSA servers at AT&T, or the Firewall of China. Your trusted source could hit the same bad path.

And by your own acknowledgment, the scheme doesn't protect you from a hacker breaking into a bank's data center. If a hacker is smart, and only grabs say every 100,000th credit card, how long will it take to isolate the location of the exploit?

So the scheme doesn't really protect against anything with any level of confidence.

<comment><USER5> You are getting out of scope. A hacker breaking into a bank's data center is not at all releated to the discussion at hand.

</comment></comment></comment></comment></comment></comment><comment><USER6> YES. Please somebody make this.

Paint me paranoid, but CA-assisted man in the middle attacks is a real source of concern for me. I would absolutely love to have the SSH-style trust model for my HTTPS connections and I will pay good money for an implementation. A simple browser plugin that implements TOFU/POP _on top_ of PKI would be an excellent start.

<comment><USER7> You can have it today! No money or plugins needed. And it only takes a minute to get started.

Just delete your CA list.

Go into your browser's preferences. Find the "security" section. It should have a button to open up the list of trusted certificate authorities.

Delete them all.

Now, every time you connect to a secure page, one of two things will happen:

1\. If you've never visited that page before, your browser will prompt you for instructions. Use whatever means you like (second browser, remote server, call them, etc) to verify the server's SSL fingerprint. If it checks out, mark it as valid (aka "add an exception").

2\. If you _have_ visited that site before, its exception will already be present in your browser, and it will work like normal.

After a few days of this, you'll see why the SSH model hasn't seen widespread adoption for HTTPS.

<comment><USER8> What you describe is exactly the behavior the author calls "Firefox' war on self-signed certificates". The actual proposal calls for a browser that does _NOT_ prompt the user all the time. It would just prompt when something extraordinary happens (such as the server's already known certificate changing).

> _After a few days of this, you'll see why the SSH model hasn't seen > widespread adoption for HTTPS_

That's not really true. It has simply never been done for browsers, because many people think it's an abomination and, to paraphrase well-known HNers from previous discussions, supposedly useless and little more than obfuscation instead of encryption.

It's not the first time TOFU/POP has been suggested on HN, too. I find it curious this proposal got so many upvotes here today. I don't remember that many people coming to mine and other people's defenses when we suggested the exact same thing a few months back and crypto gurus were rending their hair like we had committed the most stupidly blasphemous act conceivable to modern computer science.

<comment><USER7> The first time you connect to an SSH server, your client will display that server's key, and prompt for instructions.

Notably, SSH will _not_ automatically connect. It asks first. That's why it's useful. Additionally, SSH is such a niche tool that its users can be expected to be security-minded -- for example, by checking that the fingerprint matches the expected string instead of just clicking through.

If browsers automatically trusted a page the first time they hit, attackers can just redirect the user to <http://paypa1.com/> and feed them a fancy, green-url certificate.

<comment><USER8> Replicating SSH's UI is not the point here.

> _Notably, SSH will not automatically connect. It asks first. That's why it's > useful._

How many sysadmins really do check their newly installed server's fingerprint? They just type "yes" on first connect and grab the server's certificate. I believe very few people actually do manual loopups when SSH pops the first- connection warning.

Most hosting providers will send you cleartext passwords for your server by email. When you log onto that server for the first time, there is no easy way to tell if you're the victim of an elaborate MITM attack. So that's happening right now.

> _If browsers automatically trusted a page the first time they hit, attackers > can just redirect the user to<http://paypa1.com/> and feed them a fancy, > green-url certificate._

Indeed they can. Nobody's suggesting otherwise. By the way, I can do that today, by registering a cert for paypa1.com, just to see how many people actually take a second look at the content of the certificate.

<comment><USER2> You really need to start looking more carefully at those SSH messages. In particular, the fact that you get an SSH warning when a site's key suddenly changes is 99% of the security value of SSH.

It was an old Usenix conference trick --- I think it's Dug Song's, but I'm not really sure --- to snarf people's SSH logins by capitalizing on their lack of interest in those messages. It's a trivial attack.

<comment><USER8> I wasn't talking about ignoring any SSH warnings that occur when a site's key suddenly changes. Really, look at my comments, that's not at all what I said, is it?

You are misrepresenting my position and then attacking me for it.

<comment><USER9> There is not a difference between your fingerprint changing, and you not having existing knowledge to compare it to. Your action in either case should be the same.

<comment><USER10> I disagree. If I get a warning out of the blue, yeah, I take it seriously: something unexpected is going on, and I'm not going to trust the server until I know what it is. But if I know there's going to be a server upgrade overnight and I get an SSH warning in the morning, I figure odds are good that it's because of the new server rather than a coincidentally timed MITM attack. That's not perfect security, certainly, but as long as MITM attacks are rare it doesn't cost you _that_ much of SSH's value.

(All bets are off if someone is targeting your organization specifically, of course: they'd presumably have heard about the server changes in advance and take that opportunity to attack. If I considered that a serious concern in my circumstances then I'd ramp up my security level across the board.)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Let's think rationally. Who can add to certify that your site is, indeed, yours?

\- First, hosting provider. They can say "yeah, that stuff's on our network". There's IPsec, but no public keys float around, so it's only for VPNs now.

\- Second, DNS registrar. They can say "yeah, that's the domain registered with us". That's already invented and called DNSSEC, although browsers should query for CERT records.

\- Third, the notary. That's the current X.509 PKI with CAs. It is _NOT_ broken, it's just insufficient and misunderstood.

\- Fourth, yourself. Self-issued certificates can be, in fact, highly trusted, if you met site owner personally and verified the fingerprints. Or they can mean virtually nothing, if you don't know their source.

\- Fifth, others. "We cooperate with those guys, they provide us nice stuff, everything works smoothly, and we trust them", "Been there, had everything I wanted, seen nothing weird, trust those guys". WoTs are extremely powerful, as they correspond to natural human trust networks. Implementation, is, of course, hard.

Obvious part of solution would be to allow _multiple signatures_ , so the trust diagram would be a graph, not a tree.

</comment><comment><USER12> At first I thought "The title is bait.... what a waste of time, etc...". Clearly the problem isn't HTTPS, it is the current CA structure. I then went on Chris' site (<http://noncombatant.org/>) and there he summarizes it well: "The problems are social and economic more than technical. The technical problems are in usability, not in cryptography. In general, security people should start learning about usability."

I still argue that the is no 'usability' problem, but rather 'ignorance'. The fact that https has been hailed as 'secure' to the user (who has no formal understanding of what 'secure' is) is what has led up to the problem he is venting about...

<comment><USER13> I'm not sure that _usable security_ is possible. In general, it's the pattern that security requires less than ideal user experiences. For example, being emailed your password when you forget it would be "nicer" than getting a password-reset link, but requires breach of server-side best practice; not having to use a password at all would of course be the very easiest and least secure "solution" for authentication; the most secure measures require two- factor authentication and are necessarily the most annoying.

The observation of this pattern is perhaps obvious, but important.

</comment></comment><comment><USER14> I like the ideas presented in here.

Summary of what I think the main points are:

\- certificate authorities are not trustworthy currently. It is deceptive and potentially dangerous to pretend that they are.

\- the solution is actually a shift in what we think security is: rather than saying "this site is trustworthy" or "this site is not", we consider multiple factors to decide whether it is likely to be trustworthy or not.

My thoughts: I think the second point is an excellent idea, and I would take it farther by presenting that information to the user.

It would be great if there were a little meter in my URL bar that was more full (or changed color, or whatever) when a site used more secure practices. It would be even better if I could click on that meter and get a list of things the site did, with a note by each one saying "a trustworthy site would do this" or "a trustworthy site would probably not do that".

This would have the benefit of making the security model transparent to the user, which would let them make better decisions.

It would also allow for experimentation with new security ideas, if we allow many possible factors and not expect each site to use all of them. You could easily add a factor for sneakernet key-signing, for instance - if you happen to have a cert directly from the company (i.e. your bank gave you a USB key), your browser could take that into account.

Edit: it would also allow for a gradual transition from the old model. You could make having a CA-signed key a factor. It just wouldn't be the only factor.

</comment><comment><USER15> I'll chime in on this.. Some buddies and I have been debating this since the comodo stuff first started leaking out.

First off, there is a different sort of modern attack that's far worse than most others, and it's attacking the trust model. TLS and PKI hasn't been broken, the way it is used and managed has raised some questions though. The thing that can happen here, a lot of people will just jump ship on it all (and quite honestly, there isn't an alternative right now, the alternative is no security) and that's not good. This is happening a couple different ways, first people don't understand it, second people are raising fears over foreign CAs being included in browsers and OSes.

It seems like the bigger problem to me is that PKI is a dynamic system and the implementations are all static. When a web site is authenticated, the browser could establish a connection to the CA provide, signed by another CA even, and check to see if it has been revoked, if it has been signed, etc.. It could actually verify the third party authentication, live in real-time. To fake a site you'd need to compromise 2 different CA's in that case. And revocation certificates could be sent and honored, in real-time.

It seems to me like it's all rooted in the pay for security model. CAs need to verify each other and the distribution of a new CA needs to be a fairly steep and difficult thing to do (not impossible, but maybe face-to-face contact is required) and any hint of mis-use needs to result in revocation.

</comment><comment><USER16> Should Firefox throw a generic warning for a 5 minute expired certificate for Wikipedia?

I think it's time to split encryption protocols. The defacto default of non- encryption instead of encryption due to big browser warnings are preventing web developers from implementing any encryption at all. The browsers are indirectly allowing anyone to snoop on what you view on the non-encrypted websites.

I want to use some basic encryption on my connection rather than no encryption when visiting websites like Wikipedia.

<comment><USER7>
      > Should Firefox throw a generic warning for a 5 minute
      > expired certificate for Wikipedia?

Absolutely.

      > I want to use some basic encryption on my connection
      > rather than no encryption when visiting websites like
      > Wikipedia.

Then use Wikipedia's secure URL at <https://secure.wikimedia.org/wikipedia/en/wiki/Main_Page>

Encryption without authentication is useless. If mybank.com only supports encryption, I have no idea whether I'm _actually_ connected to mybank.com , or to the guy running tcpdump in the next booth.

Firefox gets a lot of grief (from idiots) for refusing self-signed certificates by default, but it's a huge credit to their security team that they've resisted the pressure to ease up.

<comment><USER17> _Encryption without authentication is useless._

It's _mostly_ useless. Anyone trying to eavesdrop needs to expend slightly more resources, and needs to take the risk that there was some out-of-band authentication that they aren't aware of.

 _Firefox gets a lot of grief (from idiots) for refusing self-signed certificates by default, but it's a huge credit to their security team that they've resisted the pressure to ease up._

No, it mostly gets grief (from sane people) for not also refusing plain HTTP under the same pretenses.

<comment><USER7> An invalid certificate is _far_ more likely to be an attack than a misconfigured server.

If Firefox silently accepted self-signed certificates, and presented the same UI as an unencrypted page, attackers could intercept requests to <https://paypal.com/> and very few users would ever notice.

Additionally, automatically accepting self-signed certificates would render ideas like "HTTPS-only cookies" useless, because now the browser would happily send them to anyone who asks.

<comment><USER18> > An invalid certificate is far more likely to be an attack than a > misconfigured server.

I don't believe that. I've run into _tons_ of self signed/invalid certs that weren't attacks. If you're implicitly limiting your statement to large sites (paypal, amazon and the like) then you're probably right. But unqualified, it is definitely not the case.

</comment></comment></comment></comment></comment><comment><USER19> Am I the only one who is frustrated by Hacker News' domain abbreviation with links like this? It makes the link look like it's from Google, and not just a hosted google doc. Could the URL abbreviation change to include subdomains as well?

</comment><comment><USER20> It was in the slides, but for those who are too lazy to go through them all: install Certificate Patrol if you are using Firefox.

It adds TOFU/POP style behavior to Firefox and really should be a default feature of all browsers.

</comment><comment><USER18> Maybe it's time to give D. J. Bernstein's CurveCP (<http://curvecp.org/>) another look. I quite liked the private "key as endpoint" technique that allowed moving a connection across IP addresses without disconnecting.

</comment><comment><USER21> Even if the CA is cheap and sloppy, an effective attack requires MITM through subverting DNS. This requires the attacker to either have access to the machine or access to the routing equipment. If the attacker owns the machine then it is already game over.

So the remaining threat is if the attacker gains access to the routing equipment, for instance a public WiFi access point or a government.

In the case of a government doing a MITM attack, then the easiest way is to subvert the download sites, so that firefox, MSIE etc includes CAs that the government is in control of. There is no solution for this attack, since both TOFU/POP and CAs are subverted.

In the second case, where public WiFi is under control of criminals, then TOFU/POP has more general applicability. In fact, a change of CA is probably a sign that the connection has been tampered.

</comment><comment><USER22> _It's time to fix ppt-misuse._

Please don't present a complex topic with 87 slides.

</comment><comment><USER23> There is also a longer paper (mentioned in the presentation) dealing with this issue from a specific point of view:

<http://files.cloudprivacy.net/ssl-mitm.pdf>

Certifi ed Lies: Detecting and Defeating Government Interception Attacks Against SSL (Christopher Soghoian and Sid Stamm)

It makes it very clear how every trusted CA in the world currently has the power to circumvent the security of any https-protected website; by themselves or compelled by someone else.

</comment><comment><USER24> TOFU would be a lot nicer if certificates were hierarchical, ie. I could say that trust this CA for all *.citibank.com certs. Wildcard certs mitigate the need for that a little, but they are bit more insecure (imho. with wildcard cert attacker needs to gain access to any of your servers to impersonate any other server. With individual certs, attacker needs to either gain access to your CA or is only able to impersonate the compromised server).

Of course transition period would be bit painful if everybody would begin signing their own certs. Tracking individual certs allows much nicer transition, as the certs can continue to be signed by global CAs, but then citibank-like solutions would be problematic.

</comment><comment><USER25> "If people don't understand it, we engineered it wrong."

Indeed.

<comment><USER26> Yes. To clarify: if people don't understand __how to use it __, it's engineered wrong.

</comment></comment><comment><USER27> I'm not convinced that tofu is the correct solution, but every criticism of https is true. In addition, it requires a public ip, something that may become scarce soon. I think that tofu combined with sites that poll is possibly a solution. Then you can crosscheck, and revoke authorities without bringing the whole system down. It would also make it harder for governments to mitm, since they would have to subvert many places instead of just one.

</comment><comment><USER28> I am not a big fan of more government involvement in just about anything, but I can see a role for government here. They are in the best position to establish identity, have little profit incentive, and have ample experience with comparable trust processes like issuing passports and bank notes.

Yes, it will be done less efficiently and with less innovation than the market. That trade off would be worth it.

</comment><comment><USER29> If like me, you live or travel to China and were horrified at the idea of having CNNIC be an accepted CA in your browser, check this link out: <http://www.imminentweb.com/technologies/remove-cnnic-ca>

</comment><comment><USER30> Digital Signatures are only good for specifying identity, not authenticity. Perhaps this fact should be explained in colloquial English for users.

</comment><comment><USER31> I must agree... Heres an sisue. 99% of the time there are no CAs for a https of a regular site that usually uses http. HOWEVER there is no problem with the certificate.

What does that mean? It means that when looking at the fun little multi step accepting certificates bells and whistles that FF throws I have absolutely no way of knowing if there is a 3rd party. There is nothing helping me out. And I am a "power user". Put those messages to a regular user and you get 3x as dumbfounded. So if 99% of the people don't understand WTF is going on, how can we help prevent any fraud?

</comment><comment><USER32> Mind: "No sire, that right now would be procrastination! Lets just use HTTPS as it is..."</comment>