Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

Post by saosebastiao » Wed, Dec 28, 2016, 5:56 PM UTC

justinkramp wrote: post #45

saosebastiao wrote: post #28

Earlier quoted context omitted.

I mostly cringe at the argument I quoted because it is often misapplied due to how we have historically misapplied passwords. A username is an identity. Historically due to the difficulty of verifying identities online, we have used passwords as a way to do so. And when all we need to do is verify an identity or control basic access levels (the bathroom lock!), a fingerprint is absolutely good enough. But a password…

Identity Authentication Authority I deal with this in my industry (telecommunications). Just because you've provided proof of identity (eg your phone number, account number), there are still things you're not allowed to do until you've authenticated your identity--and the system determines your authority, to perform an action. This is accomplished through a password, a PIN, etc. On a phone, it's an interesting shift…

Post by [deleted] » Wed, Dec 28, 2016, 6:00 PM UTC

justinkramp wrote: post #45

saosebastiao wrote: post #28

Earlier quoted context omitted.

I mostly cringe at the argument I quoted because it is often misapplied due to how we have historically misapplied passwords. A username is an identity. Historically due to the difficulty of verifying identities online, we have used passwords as a way to do so. And when all we need to do is verify an identity or control basic access levels (the bathroom lock!), a fingerprint is absolutely good enough. But a password…

Identity Authentication Authority I deal with this in my industry (telecommunications). Just because you've provided proof of identity (eg your phone number, account number), there are still things you're not allowed to do until you've authenticated your identity--and the system determines your authority, to perform an action. This is accomplished through a password, a PIN, etc. On a phone, it's an interesting shift…

Post by SixSigma » Wed, Dec 28, 2016, 6:04 PM UTC

saosebastiao wrote: post #7

I get relatively annoyed about the facile pedantry of this argument, but this is exactly the poster case for it, so here goes: fingerprints are usernames, not passwords.

Post by baldeagle » Wed, Dec 28, 2016, 6:08 PM UTC

gpderetta wrote: post #56

allThumbs wrote: post #38

Earlier quoted context omitted.

They'd need your whole hand, since any finger can be used for a smartphone biometric scanner. Truthfully, lots of different scannable areas will unlock a phone. I've successfully and reliably configured my toes, the knuckles on my hands, and the tip of my nose. All of them work pretty good. Unless observed using biometric security in a specific manner, an adversary might have a hard time deducing what kind of print w…

It will very satisfying to know they can't unlock your device after they hack off your fingers. Tongue only slightly in cheek.

Post by sandworm101 » Wed, Dec 28, 2016, 6:13 PM UTC

jenamety wrote: post #24

i'm seeing two (obvious) bigger picture trends here that this story reinforces. 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin ) 2. Goods of all kinds are being delivered faster The scary thing for me is that thieves love goods delivered quickly, so they can turn them quickly, and cut down on their ability to get intercepted. So…