Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID, Touch ID, No ID, PINs and Pragmatic Security

troyhunt.com

Post reply on HN
Print view View original

201–210 of 314 posts

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#201

Post by phire »

cmsj wrote: post #194
ernsheong wrote: post #166

Earlier quoted context omitted.

I'm calling it that Touch ID will make a comeback: https://twitter.com/ernsheong/status/908018119595003904 How bout: Touch ID + Face ID. Hahaa

I'm not sure that Touch ID can come back in its current form. Phil stood on stage and told us Touch ID is 50,000 secure and Face ID is 1,000,000 secure. I think the only way for Touch ID to come back is for it to cover the whole display, so it can authenticate every touch.

Agreed. If you could make it so every single tap was scanned, you could make the phone so secure, yet so simple to use.

The phone could constantly monitor both Face ID and full-screen Touch ID at the same time, and if it detects anything funky going down it can panic and lock. Would close down attacks where someone grabs your phone off you while it's unlocked and quickly disables security.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#202

Post by tony101 »

irq-1 wrote: post #199
joombaga wrote: post #189

Earlier quoted context omitted.

You can achieve the same effect on some Android devices by exploiting the password lock from scanning the wrong finger repeatedly.

If a judge issues a warrant allowing the police to compel the use of biometrics, can a person use the wrong finger? Courts can't compel someone enter their PIN. So can a court compel not only biometric "use" but the correct biometric? My Android forces PIN entry after 5 wrong fingerprints.

If you refuse to tell them which finger you used, and comply by only pressing whichever finger they ask you to press, they will have a 10% chance of getting in each time.

So if you chose only 1 finger and you chose it randomly, they will have a 50% chance of getting in after 5 attempts.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#203

Post by irq-1 »

> a thread emerged about abusive spouses. Now if I'm honest, I didn't see that angle coming and it made me curious - what is the angle? I mean how does Face ID pose a greater threat to victims of domestic violence than the previous auth models?

If someone has the PIN and the phone, they can get in without the person (without their biometrics.) Fingerprints and Face recognition increase the chances that an abusive spouse needs the other person every time they access the phone.

Parents who have their childrens passwords are in the same situation -- they can't snoop on their kids biometrically secured phone (like reading a kids diary in the old days.) They have to have the kids open the phone, which means the kids know that it's happening.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#204

Post by graphitezepp »

liberte82 wrote: post #159
emilfihlman wrote: post #154

The only secure thing is a thing that only you know and only you can verify even if you are freely observed. That is, shared secrets between you and your trusted device (meaning passwords) are the singular thing that provide authentication securely. Your password cannot be extracted from your head (yet). That being said, if your risks are mundane then the benefits of biometric authentication far outweigh constant pas…

I wonder if you could hack a person's password from their mind by forcing them to go through the alphabet and monitoring their heart rate / brain activity for each letter of their password. There must be a way to detect based on their reaction when you're on the right character, like a lie detector. I mean, I guess at that point you could just torture it out of them, but I wonder if this could work as a method that w…

I severely doubt that anything like that is feasible. Lie detectors don't really work so well too, afaik.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#205

Post by bodz »

apeace wrote: post #177

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN This is what has been missing from every discussion of this issue that I've seen so far. The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get i…

> The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get in the security line! Pin will be required on start.

As far as border searches go, border officers have the authority to request your PIN just as they have the authority to request your thumbprint/faceprint/etc. If you don't give it to them, you can be detained and/or your phone confiscated [1]. Rebooting your phone won't help.

1: https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#206

Post by irrational »

irq-1 wrote: post #203

> a thread emerged about abusive spouses. Now if I'm honest, I didn't see that angle coming and it made me curious - what is the angle? I mean how does Face ID pose a greater threat to victims of domestic violence than the previous auth models? If someone has the PIN and the phone, they can get in without the person (without their biometrics.) Fingerprints and Face recognition increase the chances that an abusive spo…

I'm not sure, but I know with my spouse and I, we always put each others Biometrics into each other's devices (I add her fingerprints to my phone and vice versa), share a lastpass account so we know each other's passwords, add our email accounts to each other's devices so we can always look at each others email, etc. If you are married to someone and don't trust them enough to do the same I have to question the foundation the marriage is built on. As for kids, we just don't allow them to have a phone or other device until they are old enough to buy it with their own money, which so far has never happened until they are nearly 18 and getting ready to leave for college anyway.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#207

Post by ernsheong »

cmsj wrote: post #194
ernsheong wrote: post #166

Earlier quoted context omitted.

I'm calling it that Touch ID will make a comeback: https://twitter.com/ernsheong/status/908018119595003904 How bout: Touch ID + Face ID. Hahaa

I'm not sure that Touch ID can come back in its current form. Phil stood on stage and told us Touch ID is 50,000 secure and Face ID is 1,000,000 secure. I think the only way for Touch ID to come back is for it to cover the whole display, so it can authenticate every touch.

Authenticating every touch sounds way overkill. And your friend can't help you navigate around anymore :( Some human element is lost.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#208

Post by Jeremy1026 »

pertymcpert wrote: post #190
danjoc wrote: post #183

Earlier quoted context omitted.

>All biometric security mechanisms are bad They are though, if bad == insecure. Customs can make you unlock with fingerprint or face. If you can't lock yourself out, it's not secure.

Customs can do that anyway if you have a password.

Constitutionally, an individual can not be forced to enter a password for law enforcement (including customs agents).

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#209

Post by SirZimzim »

irrational wrote: post #206
irq-1 wrote: post #203

> a thread emerged about abusive spouses. Now if I'm honest, I didn't see that angle coming and it made me curious - what is the angle? I mean how does Face ID pose a greater threat to victims of domestic violence than the previous auth models? If someone has the PIN and the phone, they can get in without the person (without their biometrics.) Fingerprints and Face recognition increase the chances that an abusive spo…

I'm not sure, but I know with my spouse and I, we always put each others Biometrics into each other's devices (I add her fingerprints to my phone and vice versa), share a lastpass account so we know each other's passwords, add our email accounts to each other's devices so we can always look at each others email, etc. If you are married to someone and don't trust them enough to do the same I have to question the found…

What the hell

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#210

Post by JoshTriplett »

tony101 wrote: post #94

Given that the authentication methods are "differently secure," wouldn't it be good if we were offered the option to combine them and require both for unlock? I would love to use Face ID + PIN or Touch ID + PIN for better security.

Exactly what I'd like as well. I'd like to be able to use one of two methods to unlock: a fingerprint and a modest PIN (with lock-out after a couple of tries), and a long passphrase (also required at boot).
Post reply on HN