Fingerprints are Usernames, not Passwords • Hacker News Board

Re: Fingerprints are Usernames, not Passwords

#31

Post by wtbob » Tue, Oct 01, 2013, 6:57 PM UTC

sillysaurus2 wrote: post #6

I'm not so sure. How many people are motivated to dupe your fingerprints to get into your iPhone? How many of those people could conceivably get into your iPhone through other ways? Fingerprints are a nice way to keep almost everyone out of your device. And for the rest, well, I really doubt some other locking mechanism would've kept them out.

> How many people are motivated to dupe your fingerprints to get into your iPhone?

I'd suggest that someone would just access the data storage, bypassing the fingerprint mechanism.

Re: Fingerprints are Usernames, not Passwords

#32

Post by wtbob » Tue, Oct 01, 2013, 6:59 PM UTC

jk211e wrote: post #4

then don't use it. For me, it far outweighs having to type my password in everytime.

> For me, it far outweighs having to type my password in everytime.

I'd rather type my password in every time than leave my data unencrypted--and using a fingerprint is essentially leaving it unencrypted.

Re: Fingerprints are Usernames, not Passwords

#33

Post by transfire » Tue, Oct 01, 2013, 6:59 PM UTC

A fingerprint is a perfectly acceptable means of authentication for low security needs (read: most needs). For higher security it serves well as one of multiple authentication layers, e.g. a fingerprint AND a pin code.

Re: Fingerprints are Usernames, not Passwords

#34

Post by gfodor » Tue, Oct 01, 2013, 7:01 PM UTC

All these academic arguments about the security of fingerprints are interesting but completely are detached from the day-to-day use of TouchID.

I've been using it for about a week or so now. It's incredibly convenient. It unlocks my phone almost instantly. It prevents random people near by phone from being unable to unlock it. If a thief got their hands on it, they'd have a few attempts to unlock it with a fake fingerprint, and then they'd have to enter my code. And if they fail to enter my code 10 times, the phone is wiped.

All in all TouchID basically removes almost the entire burden from the security of having a locked phone. It's actually faster to unlock my phone with TouchID than codeless swipe to unlock, so it's a no-brainer to turn it on. It doesn't matter that the NSA probably has my fingerprints, in practice it prevents most people from getting into my phone in a way that is transparent and easy to use. If the spooks want my data, they can already get it.

Re: Fingerprints are Usernames, not Passwords

#35

Post by ajross » Tue, Oct 01, 2013, 7:01 PM UTC

sillysaurus2 wrote: post #6

I'm not so sure. How many people are motivated to dupe your fingerprints to get into your iPhone? How many of those people could conceivably get into your iPhone through other ways? Fingerprints are a nice way to keep almost everyone out of your device. And for the rest, well, I really doubt some other locking mechanism would've kept them out.

This is right. Fingerprint scanning prevents casual snooping in the same way that a PIN or face unlock does. It's lightweight authentication. It can't be used as a hard security feature (e.g. as input to a PBKDF) so it can't provide security against hard attacks like stealing the device and reading the flash.

It's cute. Honestly I don't see what this adds over face unlock which is reasonably mature now and equally yawnworthy IMHO.

Re: Fingerprints are Usernames, not Passwords

#36

Post by mixmastamyk » Tue, Oct 01, 2013, 7:03 PM UTC

Uhhh, what?

    Of course, there are civil liberties at issue as well, since Apple could
    potentially share the information collected with governments.
    http://truthseekerdaily.com/2013/09/exclusive-apple-admits-iphone-5s-fingerprint-database-to-be-shared-with-nsa/

This link has many of the hallmarks of bullshit, but it still spooks me.

Re: Fingerprints are Usernames, not Passwords

#37

Post by ajross » Tue, Oct 01, 2013, 7:04 PM UTC

gfodor wrote: post #34

All these academic arguments about the security of fingerprints are interesting but completely are detached from the day-to-day use of TouchID. I've been using it for about a week or so now. It's incredibly convenient. It unlocks my phone almost instantly. It prevents random people near by phone from being unable to unlock it. If a thief got their hands on it, they'd have a few attempts to unlock it with a fake finge…

s/TouchID/Face Unlock/g and back up about 2 years and you can find all the same things said about Ice Cream Sandwich.

It's a cute feature. It's not going to change the world, sell another billion phones, push other companies out of the market, or save anyone from serious attacks. It's probably a good idea to enable it anyway.

Re: Fingerprints are Usernames, not Passwords

#38

Post by gfodor » Tue, Oct 01, 2013, 7:04 PM UTC

ajross wrote: post #35

sillysaurus2 wrote: post #6

I'm not so sure. How many people are motivated to dupe your fingerprints to get into your iPhone? How many of those people could conceivably get into your iPhone through other ways? Fingerprints are a nice way to keep almost everyone out of your device. And for the rest, well, I really doubt some other locking mechanism would've kept them out.

This is right. Fingerprint scanning prevents casual snooping in the same way that a PIN or face unlock does. It's lightweight authentication. It can't be used as a hard security feature (e.g. as input to a PBKDF) so it can't provide security against hard attacks like stealing the device and reading the flash. It's cute. Honestly I don't see what this adds over face unlock which is reasonably mature now and equally ya…

I haven't used face unlock but I am going to guess TouchID is much faster and easier. It unlocks almost instantly, you don't have to be in view of the camera, and it doesn't require any extra effort since your finger is already on the home button to wake up the phone.

Re: Fingerprints are Usernames, not Passwords

#39

Post by gfodor » Tue, Oct 01, 2013, 7:05 PM UTC

ajross wrote: post #37

gfodor wrote: post #34

All these academic arguments about the security of fingerprints are interesting but completely are detached from the day-to-day use of TouchID. I've been using it for about a week or so now. It's incredibly convenient. It unlocks my phone almost instantly. It prevents random people near by phone from being unable to unlock it. If a thief got their hands on it, they'd have a few attempts to unlock it with a fake finge…

s/TouchID/Face Unlock/g and back up about 2 years and you can find all the same things said about Ice Cream Sandwich. It's a cute feature. It's not going to change the world, sell another billion phones, push other companies out of the market, or save anyone from serious attacks. It's probably a good idea to enable it anyway.

I don't think you can call something a cute feature when it's turned on on most phones and is used to unlock them. I would guess that by far the majority of iPhone 5S's have TouchID enabled. I wouldn't be surprised if it's more than 90%. The feature is just that well executed.

Re: Fingerprints are Usernames, not Passwords

#40

Post by deckiedan » Tue, Oct 01, 2013, 7:06 PM UTC

One issue here is that there is no way to give out unique username/password pairs to each service.

If apple uses this, and google follows, and facebook, twitter, linkedin, my paypal and CoolAppForYorFone(TM) and everything else, then if CoolAppForYourFone(TM) scans my fingerprints, then they have access to everything on all other accounts which use this info.

Once it becomes common, then on street corners, salespeople will ask your opinion on things, "Hi! We're doing a survey this week for Vodaphone - just a quick question - do you think people with android phones or iPhones have sex more often?" and ask you to give a fingerprint to sign it. And most people will.

Or "Hi! We're giving away 20 euros free credit today at PhonesForYou! Just place your finger on the scanner here, and tell us your phone number and we'll send it through!"

We're already trackable enough, why make it easier for scammers with scanners?