Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID, Touch ID, No ID, PINs and Pragmatic Security

troyhunt.com

Post reply on HN
Print view View original

51–60 of 314 posts

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#51

Post by hellofunk »

comstock wrote: post #12

Nice article. However: > It's alarming not just because the number is so low, but because Dropbox holds such valuable information for so many people. I'd suggest that Dropbox users somewhat self select for those not as concerned about security as others. And more concerned about availability. Dropbox does not encrypt your data server side (or at the very least, can easily decrypt it). And they have proponents of warr…

> Dropbox does not encrypt your data server side (or at the very least, can easily decrypt it).

I think claims like this need to be backed up.

Now, obviously a biased source, but Dropbox itself says this:

"Each file is split into discrete blocks, which are encrypted using a strong cipher. Only blocks that have been modified are synced. Each individual encrypted file block is retrieved based on its hash value, and an additional layer of encryption is provided for all file blocks at rest using a strong cipher. Both dedicated internal security teams and third-party security specialists protect these services through the identification and mitigation of risks and vulnerabilities. These groups conduct regular application, network, and other security testing and auditing to ensure the security of our back-end network. In addition, our responsible disclosure policy promotes the discovery and reporting of security vulnerabilities." [0]

So we have files that are broken apart, each part encrypted, then the whole combination encrypted again, then lots of security auditing in-house and outside, and with incentives for people that discover flaws to report them. That seems pretty industry-standard to me, but I'd like to know more.

I really have some difficulty imagining a company like Dropbox, which knows how important the documents it stores are, being careless with security. Not saying they may not be, but it's going to take more than an HN comment that includes some politicized perspective about the Bush administration to convince me.

Furthermore, this article [1] claims that Dropbox encrypts files on the server even stronger than Google does. It also points out that user behavior is usually the main security hole, which will always be true with any service.

[0] https://www.dropbox.com/security [1] https://www.virtru.com/blog/dropbox-encryption/

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#52

Post by mrmondo »

dredmorbius wrote: post #25
mrmondo wrote: post #7

Earlier quoted context omitted.

Slightly ironically the TLS is broken on that nfcring website.

Yeah. I ... had to edit the URL, as I'm used to specifying https rather than http these days. There are a few other flags raised about that particular implementation, though the concept itself is the key point. The idea of a signet ring to authenticate, sign, access, pay, claim, and/or decrypt seems useful.

You’re not alone - I do that every time I copy or share a URL too, it’s a good habit to get people into and sites that fail to provide working HTTPS don’t really have an excuse these days.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#53

Post by kevincennis »

Cthulhu_ wrote: post #49
madmoose wrote: post #36

Earlier quoted context omitted.

TouchID was removed because it took up space on the front of the phone and Apple wanted the screen to be bigger. There's no deeper reason than that. > Will Apple continue progress and built in PinchID - a tiny needle that sting you to test if you are you based on your blood/DNA? I struggle to believe you when you say that's a serious question... > Im also concerned about the data Apple will collect. The FaceID data w…

Second, facial features are more unique than fingerprints - according to apple's own presentation, there's a 1 in 10.000 chance that prints from different people would unlock it. With face ID, this becomes 1 in 50.000 (iirc).

I believe they said 1:50,000 and 1:1,000,000.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#54

Post by calvinbhai »

dredmorbius wrote: post #5

Near-field worn devices. http://nfcring.com is an example of what I have in mind. What I'd like to see is this tied into an identity system, such that the ring (or other very-hard-to-misplace, but replaceable and discardable) token is not itself an identity, but rather an access token to an identity store which can present any given identity to any given system. That might be a consistent identity across multiple ses…

So, someone steals the NFC ring and then own the phone? Ring + heat detection of PIN tap pattern will end up giving a false sense of 2FA. (not sure how the ring auths on being worn, didnt see it on the website).

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#55

Post by dredmorbius »

calvinbhai wrote: post #54
dredmorbius wrote: post #5

Near-field worn devices. http://nfcring.com is an example of what I have in mind. What I'd like to see is this tied into an identity system, such that the ring (or other very-hard-to-misplace, but replaceable and discardable) token is not itself an identity, but rather an access token to an identity store which can present any given identity to any given system. That might be a consistent identity across multiple ses…

So, someone steals the NFC ring and then own the phone? Ring + heat detection of PIN tap pattern will end up giving a false sense of 2FA. (not sure how the ring auths on being worn, didnt see it on the website).

You can repudiate the device.

Stealing physical data itself is far harder than password appropriation.

And a PIN or password / passphrase, plus rate limiting, might still thwart scale attacks.

You're raising attack costs significantly.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#56

Post by vlozko »

jowiar wrote: post #50
joering2 wrote: post #31

Earlier quoted context omitted.

But wht was wrong with TouchID ? Were there any examples of it being weak security. What will be after Touch ID? Will Apple continue progress and built in PinchID - a tiny needle that sting you to test if you are you based on your blood/DNA? This is a serious question. Because of there was noting wrong with Touch then why is it removed from new phone and replaced with Face ID. Im also concerned about the data Apple w…

TouchID also is problematic if you're wearing gloves, which people who don't live in San Francisco do during non-trivial portions of the year.

Also fails constantly when you're doing certain physical tasks. It becomes nearly useless after a few hours of doing landscaping work.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#57

Post by kbutler »

Cthulhu_ wrote: post #49
madmoose wrote: post #36

Earlier quoted context omitted.

TouchID was removed because it took up space on the front of the phone and Apple wanted the screen to be bigger. There's no deeper reason than that. > Will Apple continue progress and built in PinchID - a tiny needle that sting you to test if you are you based on your blood/DNA? I struggle to believe you when you say that's a serious question... > Im also concerned about the data Apple will collect. The FaceID data w…

Second, facial features are more unique than fingerprints - according to apple's own presentation, there's a 1 in 10.000 chance that prints from different people would unlock it. With face ID, this becomes 1 in 50.000 (iirc).

Unless you have a twin.

Twins have different fingerprints.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#58

Post by vlozko »

jlebrech wrote: post #6

what about FaceID + pin? that would mean someone would have to know your pin as well as have access to your face. you also wouldn't have to look so paranoid while entering the pin. and pin by itself would be of little value.

The author started off saying how less than 1% of Dropbox users use two-factor authentication. What good is such a scheme when nobody is going to use it?

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#59

Post by yinghang »

kevincennis wrote: post #53
Cthulhu_ wrote: post #49

Earlier quoted context omitted.

Second, facial features are more unique than fingerprints - according to apple's own presentation, there's a 1 in 10.000 chance that prints from different people would unlock it. With face ID, this becomes 1 in 50.000 (iirc).

I believe they said 1:50,000 and 1:1,000,000.

https://www.reddit.com/r/answers/comments/1ggc2q/why_do_euro...

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#60

Post by hellofunk »

Angostura wrote: post #42
dx034 wrote: post #30

Earlier quoted context omitted.

> I'd suggest that Dropbox users somewhat self select for those not as concerned about security as others. And more concerned about availability. I would rather say that Dropbox is being used by many people without tech knowledge. And while they might be concerned about security, they often just don't know how improtant 2 factor authentication is. At least that's what I can see for some friends & family.

I have tech knowledge, but I had absolutely no knowledge that Dropbox offered 2-factor. I don't keep confidential stuff in DB because, I know that the company effectively has access to everything. Nonetheless, 2 factor sounds interesting. So I look at this: https://www.dropbox.com/help/security/enable-two-step-verifi... Right. Now I understand why so few people have it enabled.

Explain? You read a page about two-step and say that explains why no one has enabled it? You claim to have tech knowledge, but are not able to turn on this simple security setting (or even know it exists, despite that it's listed very clearly in your Dropbox settings page)?

I use two-factor/two-step verification on every single service I have, including all social media accounts, email accounts, etc. Most major services/sites these days provide it. The way Dropbox does it is no different than any others; it takes 2 minutes to set it up. What did you find difficult about it?

Post reply on HN