Live data from Hacker News

Fingerprints are Usernames, not Passwords

blog.dustinkirkland.com

21–30 of 261 posts

Re: Fingerprints are Usernames, not Passwords

#21
post #8
post #2

Above is by a "maintainer of eCryptfs" noting that we would otherwise leave our passwords on everything we touch and without option when that password is compromised. I wonder though, is there a biometric facet that can surmount the bar of unreplicable uniqueness? Contact lenses can fool iris scanners. Perhaps we should make a dental impression sensor?

Unique? Maybe. Unreplicable? I can't imagine so, we're all just a bunch of molecules. At some point in the perhaps-not-too-distant future, we will likely have very sophisticated brain-scanning technologies, and combined with advances against biometric methods, basically any form of authentication will be useless. I have absolutely no idea how to get around this, and can only hope that our society has advanced enough…

That's an rather interesting idea. If you could get Cory Doctorow to write "The Day the Password Died" from your prompt, I'd be very happy.

Synopsis: an evil government steals the private thoughts and passwords of its citizens, most of whom are unaware of the threat. A few paranoid individuals come up with increasingly bizarre biometric passwords, but the government has secretly approved unauthorized (and speedy) cloning to bypass these protections.

Finally, the freedom fighters use the government's own technology against it, replicating the president's bio-metrics in order to shutdown and disclose the program.

No meaningful political change occurs.

Re: Fingerprints are Usernames, not Passwords

#22
post #13
post #3

A very good point. One of the most important things about strong authentication schemes is the revocation protocol. When things go bad, how easy and secure is the process of changing the auth mechanism? The trouble with fingerprints is that you're stuck with them for life, even if somebody else gets their hands on them .

Wouldn't the revocation process be very simple? If some one has acquired your prints, just stop using touch ID? I mean, there are still 2 other authentication options on the iPhone.

There are also 9 other fingers. Granted, not all of them are convenient to use.

Re: Fingerprints are Usernames, not Passwords

#23
post #13
post #3

A very good point. One of the most important things about strong authentication schemes is the revocation protocol. When things go bad, how easy and secure is the process of changing the auth mechanism? The trouble with fingerprints is that you're stuck with them for life, even if somebody else gets their hands on them .

Wouldn't the revocation process be very simple? If some one has acquired your prints, just stop using touch ID? I mean, there are still 2 other authentication options on the iPhone.

That's a bit like saying "if someone has compromised your SSL certificate, stop using SSL; how about Kerberos?"

Re: Fingerprints are Usernames, not Passwords

#25

Alternatively, fingerprints should be used as 2FA. They're something you have. Supplement it with something you know (or that your encrypted password store knows) and you're golden.

Not quite right. Finger prints are considered "something you are". Always with you, can be impersonated, but can't be changed. Something you have have would be a key or a token, that can be changed if compromised.

Agree with the rest of your comment. Cocktail "something you are" with "something you know" and "something you have" for potent results.

Re: Fingerprints are Usernames, not Passwords

#26

Alternatively, fingerprints should be used as 2FA. They're something you have. Supplement it with something you know (or that your encrypted password store knows) and you're golden.

> They're something you have.

And the police have them. And the US government has (flew there twice) them. Isn't the "something you have" in 2FA ideally meant to be something that only you have?

Re: Fingerprints are Usernames, not Passwords

#27
post #24
post #9

Something you have. Something you know. Something you are. The point is to have more than one, not switch one for the other.

You are just repeating a dogma, not explaining why it is not good to think of a fingerprint as a username.

It's not a username. It's a fingerprint.

Usernames are how we indicate an identity to a computer. (Note "an" identity; identities do not one-to-one map to humans.) Identity is what we are trying to establish in the first place; if we simply knew you were authorized to use an identity we wouldn't need auth in the first place. Having a matching fingerprint is evidence that an authorized user is authorized to use that identity. Knowing a username is not. They are not the same thing. Fingerprints are not perfect auth, but they are auth of a sort; usernames aren't auth at all.

Re: Fingerprints are Usernames, not Passwords

#28

#66 on the Evil Overlord list: My security keypad will actually be a fingerprint scanner. Anyone who watches someone press a sequence of buttons or dusts the pad for fingerprints then subsequently tries to enter by repeating that sequence will trigger the alarm system. Why not have the sequence remain the password, but also scan fingerprints? If you have the wrong fingerprints (username), the right password still won…

If the scan doesn't leave collectable fingerprints on the keys, it'd work!

Re: Fingerprints are Usernames, not Passwords

#30

#66 on the Evil Overlord list: My security keypad will actually be a fingerprint scanner. Anyone who watches someone press a sequence of buttons or dusts the pad for fingerprints then subsequently tries to enter by repeating that sequence will trigger the alarm system. Why not have the sequence remain the password, but also scan fingerprints? If you have the wrong fingerprints (username), the right password still won…

If we assume the attacker is going to (be capable/mindful enough to) dust for fingerprints, they're going to get a very small potential keyspace for a passcode.
Post reply on HN