Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fingerprints are Usernames, not Passwords

blog.dustinkirkland.com

Post reply on HN
Print view View original

121–130 of 261 posts

Re: Fingerprints are Usernames, not Passwords

#121

Post by eeeeeeeeeeeee »

gfodor wrote: post #46
hayksaakian wrote: post #41

Earlier quoted context omitted.

Please don't delude yourself into thinking this is any safer against the typical kind of smartphone theft. Thieves will offload the phone to someone using software explicitly designed to wipe electronics to be resold. Whether they are wiping an iphone that happens to have touch ID or not is only relevent towards the resale price once it's wiped. Clearly Apple marketing works, as it's somehow convinced a member of (I'…

Uh, no. Of course it's doesn't prevent theft. (Though the new 'wipe the phone in 10 tries' thing may deter it, separate from TouchID, I'm not sure.) The point is that with TouchID (as opposed to no passcode) the thief will not be able to send porn to my mom or read my text messages before they wipe the phone.

And with iOS7 they're going to have a harder time wiping it because phones are now locked to your Apple account. So they need your Apple account ID and password to wipe it.

Re: Fingerprints are Usernames, not Passwords

#122

Post by bbatchelder »

brianpgordon wrote: post #98
ISL wrote: post #54

Earlier quoted context omitted.

It is more difficult to defeat a touch sensor than face unlock. With face unlock, I just need a photo of the phone's owner. With a fingerprint unlock, I need to go to at least a little trouble to fake the fingerprint.

My Samsung phone has a feature that requires you to blink in order to unlock the phone to ensure that you're not a still photo. Of course, I don't actually use it because the face recognition is so bad, and nonexistent in the dark.

Apparently that can be defeated with Photoshop.

Re: Fingerprints are Usernames, not Passwords

#123

Post by eeeeeeeeeeeee »

sillysaurus2 wrote: post #6

I'm not so sure. How many people are motivated to dupe your fingerprints to get into your iPhone? How many of those people could conceivably get into your iPhone through other ways? Fingerprints are a nice way to keep almost everyone out of your device. And for the rest, well, I really doubt some other locking mechanism would've kept them out.

Fingerprint authentication is just like a door lock on your house. It's not going to stop a determined criminal (because they can just smash your window), but it's a pretty good way to stop casual attempts at intrusion.

I agree that the touchID shouldn't be used for authentication with everything and I think Apple agrees, which is why they haven't opened it up to 3rd party developers.

Re: Fingerprints are Usernames, not Passwords

#124

Post by r00fus »

adventured wrote: post #19
sillysaurus2 wrote: post #6

I'm not so sure. How many people are motivated to dupe your fingerprints to get into your iPhone? How many of those people could conceivably get into your iPhone through other ways? Fingerprints are a nice way to keep almost everyone out of your device. And for the rest, well, I really doubt some other locking mechanism would've kept them out.

What are people going to do when, in the all-too-near future, criminals begin sharing and selling databases of stolen high resolution finger prints? One theft isn't practical? How about a million? Driven by a never-ending pursuit of monetary gain via crime; with criminals always happy to conquer the latest technology wave. There's absolutely no reason to think that criminals won't amass substantial finger print recor…

You handwave around the fact that obtaining high-res photos of the finger (i.e., lab setting) is not exactly easy. How would you propose this occurs? It's not like this is some widely-licensed implementation - the devices are highly personal/coveted and don't store the image in-device (just hashed representation that can't recreate the print).

The CCC could have used a stray fingerprint (say on a glass or the phone itself) but didn't. I suspect they would have demo'd that if they could have made it work reliably or even at all.

Your slippery slope argument seems faith-based and doesn't answer the big questions I posed above. I don't see Samsung or Moto going fingerprints anytime soon - and if they do, Apple is there with patented tech waiting to sue them if it's at all similar. Widely varying implementations of the same thing with possibly different exploit angles - does that seem like a security epidemic to you?

Re: Fingerprints are Usernames, not Passwords

#125

Post by bbatchelder »

praptak wrote: post #51

Not essential to the main thesis of the article, but still: "But let's just say you're okay with Apple sharing your fingerprints with the NSA, as I've already told you, they're not private at all." Ok, they are not private but I'd still not willingly put them on anything controlled by an US corporation. Govt sending their agents to collect my fingerprints from glasses? Not feasible, too costly. Agency asking Apple to…

A lot of people have already given their fingerprints to the US Govt - children whose parents enrolled them in "kid safety" programs, teachers, anyone that ever applied for a position of public trust or any kind of background search, people that have applied for concealed carry permits...

The US Govt probably has 3-4 sets of my fingerprints in various data stores across several agencies...and I'm no one special.

Re: Fingerprints are Usernames, not Passwords

#126

Post by clauretano »

tedunangst wrote: post #96
selectodude wrote: post #52

Earlier quoted context omitted.

An iPhone that is wiped, even in DFU mode, requires the Apple ID and password immediately after it is booted for the first time. Basically, a stolen iPhone is only worth the sum of its parts so they can be used to repair other phones.

How does this work? I sold my old iphone to amazon. I never reported it "unstolen" or whatever to apple. Amazon paid me $200 for iPhone parts?

With iOS 7, when you select "Erase All Content and Settings", it will disable Find My iPhone after prompting you for your Apple ID password.

http://support.apple.com/kb/HT5818

Re: Fingerprints are Usernames, not Passwords

#127

Post by sologoub »

ajross wrote: post #37
gfodor wrote: post #34

All these academic arguments about the security of fingerprints are interesting but completely are detached from the day-to-day use of TouchID. I've been using it for about a week or so now. It's incredibly convenient. It unlocks my phone almost instantly. It prevents random people near by phone from being unable to unlock it. If a thief got their hands on it, they'd have a few attempts to unlock it with a fake finge…

s/TouchID/Face Unlock/g and back up about 2 years and you can find all the same things said about Ice Cream Sandwich. It's a cute feature. It's not going to change the world, sell another billion phones, push other companies out of the market, or save anyone from serious attacks. It's probably a good idea to enable it anyway.

TouchID has some tangible implications for markets where some security is needed and convenience is already compromised. For example, my corporate policy disallows pattern lock and requires I use a pin. This is majorly annoying and is enough for me to consider a different device.

The big enterprise market is an awesome place to get a foothold in - they are not really price-sensitive and hate change. Not that Apple has any problems in that segment, but extra lock-in doesn't hurt.

Where this becomes semi-dangerous is in assuming that now your phone is ironclad and you can store whatever on it totally unprotected. The best route to safety is to make informed decisions based on your own risk-tolerance and not be a lemming.

Re: Fingerprints are Usernames, not Passwords

#128

Post by praptak »

twoodfin wrote: post #66
praptak wrote: post #51

Not essential to the main thesis of the article, but still: "But let's just say you're okay with Apple sharing your fingerprints with the NSA, as I've already told you, they're not private at all." Ok, they are not private but I'd still not willingly put them on anything controlled by an US corporation. Govt sending their agents to collect my fingerprints from glasses? Not feasible, too costly. Agency asking Apple to…

As others have joked: Imagine how much people would freak out if Apple devices had a microphone or a camera capable of recording you surreptitiously! If you're worried that Apple will roll over for the NSA, and that the NSA will, at some point, be out to get you, the quantity of information they could gather through backdoors on your phone is so astounding that it's hard to understand why hashed fingerprint feature a…

To be clear - it's not about the scenario where NSA is already out to get me. Obviously in this case the cost of getting my fingerprints the traditional way doesn't matter anymore. It's the scenario in which NSA gets interested in me because a) I made it easy for them to mass-harvest my fingerprints and b) they happen to get a false match on a terrorists' ashtray or whatever. I'm not convinced that the (hypothetically mass-harvested) material from the camera and microphone has comparable potential for such a false match.

Re: Fingerprints are Usernames, not Passwords

#129

Post by eddieroger »

mikeash wrote: post #59
hayksaakian wrote: post #41

Earlier quoted context omitted.

Please don't delude yourself into thinking this is any safer against the typical kind of smartphone theft. Thieves will offload the phone to someone using software explicitly designed to wipe electronics to be resold. Whether they are wiping an iphone that happens to have touch ID or not is only relevent towards the resale price once it's wiped. Clearly Apple marketing works, as it's somehow convinced a member of (I'…

I'm not protecting my phone , I'm protecting my data . It does a pretty good job of that. Don't think we're somehow deluded for thinking that the data is the more valuable part of the thing.

The most important distinction. Someone who wants your hardware doesn't care about the data, and will wipe the phone (although this is where iOS 7's Activation Lock comes in). And, if they want your data, they will figure that out, too. Touch ID is just a deterrent, same as a password or PIN, just to varying degrees.

Re: Fingerprints are Usernames, not Passwords

#130

Post by Steko »

Touche wrote: post #117
Steko wrote: post #90

Earlier quoted context omitted.

Can you buy content with Face Unlock?

The point the parent is making is that you shouldn't be able to buy content with a fingerprint.

No, to him Touch ID is the same as Face Unlock and both are just cute lightweight toy features.

He asks: "I don't see what this adds over face unlock."

I answer: "You can use Touch ID to buy things."

Post reply on HN