Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fingerprints are Usernames, not Passwords

blog.dustinkirkland.com

Post reply on HN
Print view View original

81–90 of 261 posts

Re: Fingerprints are Usernames, not Passwords

#81

Post by gfodor »

devx wrote: post #55
gfodor wrote: post #34

All these academic arguments about the security of fingerprints are interesting but completely are detached from the day-to-day use of TouchID. I've been using it for about a week or so now. It's incredibly convenient. It unlocks my phone almost instantly. It prevents random people near by phone from being unable to unlock it. If a thief got their hands on it, they'd have a few attempts to unlock it with a fake finge…

And I think that's the main problem with it. People think that it's actually a true replacement for a password, even though it's not.

Give me a real world scenario where this distinction matters and affects real outcomes. For real users, not people who are trying to protect themselves from the CIA.

Re: Fingerprints are Usernames, not Passwords

#82

Post by wooster »

evan_ wrote: post #61
wooster wrote: post #45

Flagging due to him pointing to an obviously fake story to support his position.

Maybe you should say what story he's pointing to that's obviously fake? I'm sure you mean the "Apple is sharing fingerprints with the NSA" link...

Clearly.

http://www.theguardian.com/technology/2013/sep/27/no-nsa-iph...

Re: Fingerprints are Usernames, not Passwords

#84

Post by mikestew »

ajross wrote: post #37
gfodor wrote: post #34

All these academic arguments about the security of fingerprints are interesting but completely are detached from the day-to-day use of TouchID. I've been using it for about a week or so now. It's incredibly convenient. It unlocks my phone almost instantly. It prevents random people near by phone from being unable to unlock it. If a thief got their hands on it, they'd have a few attempts to unlock it with a fake finge…

s/TouchID/Face Unlock/g and back up about 2 years and you can find all the same things said about Ice Cream Sandwich. It's a cute feature. It's not going to change the world, sell another billion phones, push other companies out of the market, or save anyone from serious attacks. It's probably a good idea to enable it anyway.

Except TouchID, from what I gather, actually works. Not "works" in the sense of keeping bad people out, but "works" in the sense that when I use it my phone unlocks. I tried face unlock briefly on the Google Nexus I've got and disabled it shortly after when I found that it was unreliable. Poor lighting, too much lighting, a bad hair day, it wasn't even at 80% for successful unlocks.

Re: Fingerprints are Usernames, not Passwords

#85

Post by slantyyz »

mendocino wrote: post #16
mangoman wrote: post #10

Earlier quoted context omitted.

I'm sure 5s's are fetching at least $400 on the conservative side. If all I have to do is spend like $5 and follow a how-to on a website, I think a lot of people would be willing to make the investment.

If your objective is to sell a stolen iPhone then you still have to know the owners Apple ID and password due to activation lock. Being able to bypass Touch ID isn't going to help you.

But what if the objective isn't to steal the phone but to surreptitiously collect or plant information?

I can think of some examples:

* jealous spouses who want to look at call logs, emails, text histories

* unscrupulous managers looking to see if you've been talking to headhunters, competitors, etc.

* stalker coworkers who are looking for "private selfies"

* frenemies who want to post inflammatory messages using one of your social media accounts

Re: Fingerprints are Usernames, not Passwords

#86

Post by bitserf »

blah32497 wrote: post #78
ajross wrote: post #58

Earlier quoted context omitted.

Depends on scenario. If you steal a phone from a bag on the subway, you'll never be able to get that photo but can probably lift the print right off the phone itself. So maybe iOS has better-yet-still-mediocre protection against snooping yet inferiorly-mediocre guards against identity theft. Yawn. In neither case is the phone meaningfully protected against serious attack. Why must we have this argument? It's a cute f…

Okay, but if you steal a phone on the subway, why would you even bother unlocking it? Just sell it on ebay as a locked phone. Some bored teenagers will buy them up, unlock them, wipe them and then resell them for a few dollars more.

If Find My iPhone is on, that locked phone is essentially a brick, it cannot be activated even if completely wiped, since its still associated with your Apple ID on the server side.

You need to be able to sign in with the Apple ID to remove the association.

Re: Fingerprints are Usernames, not Passwords

#88

Post by nobodyshere »

mikestew wrote: post #84
ajross wrote: post #37

Earlier quoted context omitted.

s/TouchID/Face Unlock/g and back up about 2 years and you can find all the same things said about Ice Cream Sandwich. It's a cute feature. It's not going to change the world, sell another billion phones, push other companies out of the market, or save anyone from serious attacks. It's probably a good idea to enable it anyway.

Except TouchID, from what I gather, actually works. Not "works" in the sense of keeping bad people out, but "works" in the sense that when I use it my phone unlocks. I tried face unlock briefly on the Google Nexus I've got and disabled it shortly after when I found that it was unreliable. Poor lighting, too much lighting, a bad hair day, it wasn't even at 80% for successful unlocks.

To be honest, I disabled face unlock the moment my brother unlocked it with his face... Yeah, touch id won't let that happen.

Re: Fingerprints are Usernames, not Passwords

#89

Post by foobarbazqux »

mikestew wrote: post #84
ajross wrote: post #37

Earlier quoted context omitted.

s/TouchID/Face Unlock/g and back up about 2 years and you can find all the same things said about Ice Cream Sandwich. It's a cute feature. It's not going to change the world, sell another billion phones, push other companies out of the market, or save anyone from serious attacks. It's probably a good idea to enable it anyway.

Except TouchID, from what I gather, actually works. Not "works" in the sense of keeping bad people out, but "works" in the sense that when I use it my phone unlocks. I tried face unlock briefly on the Google Nexus I've got and disabled it shortly after when I found that it was unreliable. Poor lighting, too much lighting, a bad hair day, it wasn't even at 80% for successful unlocks.

> Not "works" in the sense of keeping bad people out, but "works" in the sense that when I use it my phone unlocks.

I think that's the key distinction here. In any given authentication scheme it's important not to have false positives (incorrectly identifying a bad guy as you) or false negatives (incorrectly identifying you as a bad guy). In this case false positives break security, false negatives break usability. However, false positives won't outright stop adoption whereas false negatives will.

Re: Fingerprints are Usernames, not Passwords

#90

Post by Steko »

ajross wrote: post #35
sillysaurus2 wrote: post #6

I'm not so sure. How many people are motivated to dupe your fingerprints to get into your iPhone? How many of those people could conceivably get into your iPhone through other ways? Fingerprints are a nice way to keep almost everyone out of your device. And for the rest, well, I really doubt some other locking mechanism would've kept them out.

This is right. Fingerprint scanning prevents casual snooping in the same way that a PIN or face unlock does. It's lightweight authentication. It can't be used as a hard security feature (e.g. as input to a PBKDF) so it can't provide security against hard attacks like stealing the device and reading the flash. It's cute. Honestly I don't see what this adds over face unlock which is reasonably mature now and equally ya…

Can you buy content with Face Unlock?
Post reply on HN