281–290 of 333 posts
Earlier quoted context omitted.
> It should be fine for people who have nothing to hide. There are no people that have nothing to hide. There are only people that don't know what they should be hiding.
Just a clumsy way of saying "not within my threat matrix"
My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)
My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)
How would liveliness be faked?
Earlier quoted context omitted.
wait it's based on birth month/year/place? is there an algorithm to generate it or something?
There's not quite an "algorithm"; SSN's are so short (it's just a 9-digit number, so max 1 billion unique SSNs) that they have a very simple procedure for assigning them. The Social Security Administration explains it here: https://www.ssa.gov/history/ssn/geocard.html - The first set of three digits is called the Area Number - The second set of two digits is called the Group Number - The final set of four digits is t…
Also remember, in the USA, the police can legally force your finger onto a reader to defeat the lock, without violating your 5th Amendment right against self-incrimination.
Remember (on an iPhone) you can squeeze the power button and one of the volume keys for a few seconds. This disables biometric authentication until a passcode is entered. This can protect you against this "attack vector".
Earlier quoted context omitted.
On Android (don't know about iOS) you can take photos without even unlocking - double press on the power button opens the camera. You can't access anything else (including existing photos in the camera roll).
It works the same way on iPhones. The lock screen includes a camera button. When tapped, the phone enter a camera-only mode in which only photos taken during that session are accessible.
The huge advantage of biometrics (fingerprints, FaceID, etc.) is the ease with which a user can unlock their phone. A passcode may be better than a fingerprint, but a fingerprint+longer passcode is better than a shorter passcode (or no passcode at all). Having a 12 character alphanumeric passphrase you enter each time you want to unlock is not something most users want to do. See e.g.: https://www.businesstoday.in/te…
However, you are correct that a fingerprint is faster than even a 4 digit pin. And even a TPM does not solve the problem of pin/password reuse and being easy to guess, it just makes it harder by giving you much fewer guesses.
My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)
I’m waiting on a court case with a fingerprint as key evidence for conviction, in which the defendant brings this up. Might not pass reasonable doubt muster, but what if somebody sold fingerprint forgery kits online that made it push-button simple? Just supply an image or two, run it through some ML to reconstruct the print, laser etch a latex glove or similar… I wonder if you could use CRISPR or “lab-grown meat” tec…
It's already trivial - $500 consumer grade resin printers have sufficient resolution, and creating the model from photographs is super easy.
Same for facial recognition - you can do Mission Impossible style masks, and the most significant investment is in time spent learning makeup and wig work.
Biometrics are not secure, just like a vast majority of locks. All it takes is tools, knowledge, and motive to bypass them.
Earlier quoted context omitted.
On modern FaceID phones you need to hold the power and down volume key to bring up the Reset/PowerOff and cancel. Just clicking multiple times will bring up wallet, siri, or do nothing.
Just clicking multiple times will bring up wallet, siri, or do nothing. On my iPhone 13, just now, I rapidly clicked the power button 5x. The phone immediately made a loud sound and put up a screen that said "Emergency SOS". There was an option to "cancel" it, but I assume that the phone would have contacted 911 in short order unless I quickly cancelled. So the correct description is probably "it depends".