Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

Post by Waterluvian » Wed, Dec 28, 2016, 5:26 PM UTC

colah3 wrote: post #29

Waterluvian wrote: post #11

Earlier quoted context omitted.

I disagree. Fingerprints are privacy locks, not security locks. The lock in your bathroom isn't meant to secure the bathroom. It's just a way to ensure that people get the message, "please don't enter". A fingerprint on a phone is a way of saying the same thing. This phone isn't meant for common use, please don't enter.

That's a really nice distinction. It feels like there's a bit of a spectrum, though. The lock on a houses door won't prevent a determined criminal, but it sends a very strong signal and is inconvenient to break. Perhaps we should thing of there as being multiple dimensions to locks, such as security, signaling, effort to circumvent, and convenience? (Perhaps also conscientiousness in disabling, in relation to @saoseb…

Post by dragonwriter » Wed, Dec 28, 2016, 5:27 PM UTC

saosebastiao wrote: post #7

I get relatively annoyed about the facile pedantry of this argument, but this is exactly the poster case for it, so here goes: fingerprints are usernames, not passwords.

Post by colah3 » Wed, Dec 28, 2016, 5:28 PM UTC

saosebastiao wrote: post #28

Waterluvian wrote: post #11

Earlier quoted context omitted.

I disagree. Fingerprints are privacy locks, not security locks. The lock in your bathroom isn't meant to secure the bathroom. It's just a way to ensure that people get the message, "please don't enter". A fingerprint on a phone is a way of saying the same thing. This phone isn't meant for common use, please don't enter.

I mostly cringe at the argument I quoted because it is often misapplied due to how we have historically misapplied passwords. A username is an identity. Historically due to the difficulty of verifying identities online, we have used passwords as a way to do so. And when all we need to do is verify an identity or control basic access levels (the bathroom lock!), a fingerprint is absolutely good enough. But a password…

Post by Clubber » Wed, Dec 28, 2016, 5:30 PM UTC

jenamety wrote: post #24

i'm seeing two (obvious) bigger picture trends here that this story reinforces. 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin ) 2. Goods of all kinds are being delivered faster The scary thing for me is that thieves love goods delivered quickly, so they can turn them quickly, and cut down on their ability to get intercepted. So…

Post by Waterluvian » Wed, Dec 28, 2016, 5:32 PM UTC

colah3 wrote: post #35

saosebastiao wrote: post #28

Earlier quoted context omitted.

I mostly cringe at the argument I quoted because it is often misapplied due to how we have historically misapplied passwords. A username is an identity. Historically due to the difficulty of verifying identities online, we have used passwords as a way to do so. And when all we need to do is verify an identity or control basic access levels (the bathroom lock!), a fingerprint is absolutely good enough. But a password…

The "deliberateness" or "conciencousness" of a lock is an interesting dimension. A laser cutter I used to work with had two switches, one of which was a safety switch (like [1]) to prevent accidental activation. The goal here isn't security. It's a design decision to prevent accidents. It's almost a kind of intentional inconvenience. [1] Safety switch with cap prevent accidental switching: http://acuteelectrical.com.…