Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I recommend against using biometric identification

medium.freecodecamp.org

Post reply on HN
Print view View original

131–140 of 239 posts

Re: I recommend against using biometric identification

#131

Post by imron »

bodz wrote: post #50
kenjackson wrote: post #32

Earlier quoted context omitted.

Ehh... it's not the same as a username. It's more like fingerprints are door locks. Any determined thief can get around it. But it protects you from people who aren't really all that determined. And for most people door locks are sufficient. But if you are a major crime lord, protecting something extremely valuable, or just really into security then door locks are not enough.

The "door lock" analogy ignores the biggest flaw with fingerprints: they're forever. If your door lock is compromised, you can change the key. If someone steals your password, you can change the password. If someone steals your fingerprint, you can never change your fingerprint (same with your face). The other stuff is dead-on: its a "good enough" security measure for phones. But as a security practitioner, the bigge…

> ignores the biggest flaw with fingerprints: they're forever.

The second biggest flaw being your phone is covered in your fingerprints!

Re: I recommend against using biometric identification

#132

Post by ricardobeat »

w8rbt wrote: post #36

"And if you really want a random number, paste this into your browser’s JavaScript console..." I would suggest rolling dice instead. The PIN that produced would be truly random.

RNGs shipped in browsers today are pretty good, and there is also crypto.getRandomValues().

Re: I recommend against using biometric identification

#133

Post by BenjiWiebe »

I use face unlocking (just the builtin(?) Android one) and I am well aware that it isn't secure. I use it because I'd rather have an insecure way of locking my phone, then no way of locking my phone. I try not to keep to important of info on my phone, and also I need my phone a lot when it isn't safe/easy to unlock it, and just pointing it at my face is pretty simple.

Re: I recommend against using biometric identification

#134

Post by raides »

The Surface Book has had facial recognition for almost two years now and it is actually impressive. Short of a full latex mask that has padding to shape the wearer's face it is pretty impossible to break into it. We did tests with iPad pictures and depth options, straight camera prints and a 3d printed model. None of it worked. It is also not easy to access latex custom latex masks.

I feel my only issue with FaceID is that when you are in handcuffs all it takes is for the phone to be held in front of you. It will be interesting what safety regulations are used to prevent illegal entry by police or captors.

Re: I recommend against using biometric identification

#135

Post by nimchimpsky »

castis wrote: post #107
driverdan wrote: post #34

> And to be clear, a court in the US cannot force you to give up your passcode. That passcode exists in your head, and yours alone. It is your property, and won’t be used to incriminate you or strong-arm access to your data unless you voluntarily give it up. While technically true this is false in practice. While they can't force you to provide your passcode they can force you to unlock your phone. Francis Rawls has…

That man may still be in prison, but that drive is still encrypted. If you are unwilling to give something you know to someone, no amount of force can take it from you. Had that drive been encrypted using facial biometrics, they could have just knocked him out, glued his eyes open, and taken what they wanted. What works, and what has been deemed legal, as you probably already know, are not mutually exclusive.

Which is torture, so they could do that until he tells them the passcode aswell.

Re: I recommend against using biometric identification

#136

Post by billhathaway »

DaiPlusPlus wrote: post #100
djrogers wrote: post #37

Earlier quoted context omitted.

Case 1 and 2 are covered with FaceID - you have to be actively looking at the phone, drugged/eyes closed/looking away/etc. won't cut it.

Case 1: "Look at the phone straight-ahead with your eyes or we'll beat you with the rubber-hose again" Case 2: Hold open the eyelids with tape. Even if the eyes have rolled-back in their sockets they can be re-positioned with some manual adjustment enough to get the system to work.

Isn't Case 1 an attack on every possible method?

Re: I recommend against using biometric identification

#137

Post by maddyboo »

otterpro wrote: post #38

I'd like to add a feature to the FaceID, requiring the user to wink instead of looking with both eyes open, or have a customized facial gesture, which only the user knows. It adds an extra layer of security. Not only that, you get to wink at your phone often as a sign of affection (LOL). Instead of winks, one might choose to do other facial gestures such as stick their tongue out, do a duck-face, etc.

It would be nice to have two gestures. One to unlock, and one to force passcode mode.

Re: I recommend against using biometric identification

#138

Post by KGIII »

daenney wrote: post #116
KGIII wrote: post #58

Earlier quoted context omitted.

I am not sure why phones haven't been made with different profiles. Yesterday (?), someone here mentioned they wanted to be able to give the (presumed) cops a phone that was blank. I pointed out that was a horrible idea, but didn't really explain why. If it is a totalitarian regime, they'll just kill you. If you're ever really in such a situation, a blank phone is probably the worst thing you can give them. Instead,…

> Instead, why not a dummy profile that's complete with user activity, social media presence, and showing active harmless use? Why not multiple profiles? And where do you suppose this data will come from? Maintaining something of a plausible and active social media presence is not without it's efforts, nor is creating a profile that would stand up to some scrutiny. If people aren't really looking it won't matter much…

Presumably, if the person thinks it is an issue then they will make an effort to create and maintain it. It'd not be much use for most of us, but it might be invaluable to someone else.

Re: I recommend against using biometric identification

#139

Post by BenjiWiebe »

panopticon wrote: post #99
bodz wrote: post #88

Earlier quoted context omitted.

No security is going to keep "determined" intruders out. But the point is that you should still strive to achieve "good enough" security. The problem is that while the actual ranking from least secure to most secure is "nothing < touchid/faceid < passcode", Apple's marketing and implementation gives people the false impression that its "nothing < passcode < touchid/faceid", which is bad for security.

I think "nothing So Touch/FaceID isn't better than a good passcode, but maybe it's better than a crappy passcode.

I could be wrong, but doesn't a passcode actually encrypt the data (for sure on password manager/banking/etc apps) whereas FaceID/TouchID/ doesn't? And what about hashing? AFAIK you can't really hash biometrics.

Re: I recommend against using biometric identification

#140

Post by BenjiWiebe »

raides wrote: post #134

The Surface Book has had facial recognition for almost two years now and it is actually impressive. Short of a full latex mask that has padding to shape the wearer's face it is pretty impossible to break into it. We did tests with iPad pictures and depth options, straight camera prints and a 3d printed model. None of it worked. It is also not easy to access latex custom latex masks. I feel my only issue with FaceID i…

Maybe it permanently disables the phone if it recognizes you and you have your eyes crossed? Or tongue stuck out? :)
Post reply on HN