Fingerprints are Usernames, not Passwords • Hacker News Board

Re: Fingerprints are Usernames, not Passwords

#241

Post by the_watcher » Wed, Oct 02, 2013, 2:53 PM UTC

hayksaakian wrote: post #41

gfodor wrote: post #34

All these academic arguments about the security of fingerprints are interesting but completely are detached from the day-to-day use of TouchID. I've been using it for about a week or so now. It's incredibly convenient. It unlocks my phone almost instantly. It prevents random people near by phone from being unable to unlock it. If a thief got their hands on it, they'd have a few attempts to unlock it with a fake finge…

Please don't delude yourself into thinking this is any safer against the typical kind of smartphone theft. Thieves will offload the phone to someone using software explicitly designed to wipe electronics to be resold. Whether they are wiping an iphone that happens to have touch ID or not is only relevent towards the resale price once it's wiped. Clearly Apple marketing works, as it's somehow convinced a member of (I'…

No one thinks it will deter thieves. It will make it more difficult for thieves to offload the phone (however marginally), and will give you time to use Find My iPhone, wipe it remotely, or brick it before your data gets compromised. As someone who did not use a passcode who recently had a phone stolen, I can tell that this is valuable. Also, why don't people focus on the real convenience - purchases by fingerprint scan.

Re: Fingerprints are Usernames, not Passwords

#242

Post by robomartin » Wed, Oct 02, 2013, 3:19 PM UTC

lucozade wrote: post #240

robomartin wrote: post #209

I can't help but think that there's a whole segment of HN readers who are thinking as single men. In the context of a family with kids this is a very different thing. My kids have access to my phone and my wife's --which are not locked in any way. I have access to my kid's iphones, ipods and ipads. Having devices locked to fingerprints in any way would be a nightmare. If you have really young kids, its a logistical m…

Funny, I have teen/pre-teen children and my reaction is the exact opposite. I, mostly unsuccessfully, ban the children from having passcodes on their devices so that I can do backups, act as communal spy for various parents etc. They, on the other hand, mostly add passcodes (then change them regularly) so that their siblings don't go onto their phones and change the wallpaper to amusing photos, delete Minecraft etc.…

Perhaps I am missing something. Are you saying TouchID aalows you to register multiple fingerprints for access to a device?

With regards to the kids ignoring your requirement to not have passcodes. Well, what can I say, my kids do as i say, perhaps a different approach is in order? For example, my kids know they should not play any computer games during the week. On Saturdays they can play as much as they want. During the week it's academics, mindstorms and good old-fashion go outside and get dirty play. I've never had to enforce the rule. In general terms i think kids respond well to rules and schedules so long as these things are fairly and consistently applied.

Re: Fingerprints are Usernames, not Passwords

#243

Post by msbarnett » Wed, Oct 02, 2013, 3:34 PM UTC

esolyt wrote: post #234

threeseed wrote: post #169

Earlier quoted context omitted.

Protection against what ? That is the desired behaviour of most people. And if it isn't then you can simple disable the behaviour. It's not like you will lose data since it is backed up to iCloud.

> Protection against what ? Um, protection against random people wiping your phone maybe?

How do you expect the phone to distinguish between "password entered 10 times incorrectly by asshole" and "password entered 10 times incorrectly by thief"?

If this is a problem with your circle of friends: find new friends, or disable this feature.

Re: Fingerprints are Usernames, not Passwords

#244

Post by Aldo_MX » Wed, Oct 02, 2013, 4:03 PM UTC

xenophanes wrote: post #167

gfodor wrote: post #34

All these academic arguments about the security of fingerprints are interesting but completely are detached from the day-to-day use of TouchID. I've been using it for about a week or so now. It's incredibly convenient. It unlocks my phone almost instantly. It prevents random people near by phone from being unable to unlock it. If a thief got their hands on it, they'd have a few attempts to unlock it with a fake finge…

> a few attempts to unlock it with a fake fingerprint, and then they'd have to enter my code. And if they fail to enter my code 10 times, the phone is wiped. Are you saying that random people can pick up your phone when you go to the bathroom, touch the home button 3 times, and then enter "1111" 10 times, and wipe your phone? Is there some protection against this?

Yes, backup your data.

Re: Fingerprints are Usernames, not Passwords

#245

Post by unfamiliar » Wed, Oct 02, 2013, 4:12 PM UTC

stephengillie wrote: post #11

#66 on the Evil Overlord list: My security keypad will actually be a fingerprint scanner. Anyone who watches someone press a sequence of buttons or dusts the pad for fingerprints then subsequently tries to enter by repeating that sequence will trigger the alarm system. Why not have the sequence remain the password, but also scan fingerprints? If you have the wrong fingerprints (username), the right password still won…

"fingerprint or pin" means that when the fingerprint scanner doesn't work, you can use the pin to unlock your phone. "fingerprint and pin" means that when the scanner stops working, you are locked out. Apple has obviously decided this is more of a risk/inconvenience than the extra security justifies.

Re: Fingerprints are Usernames, not Passwords

#246

Post by balabaster » Wed, Oct 02, 2013, 4:22 PM UTC

superuser2 wrote: post #201

twistedpair wrote: post #198

Earlier quoted context omitted.

Consider the thorny issues of courts forcing people to turn over passwords to decrypt phones to implicate themselves. Typically, it's a constitution tarpit as you should not be forced to implicate yourself. However, your fingerprint is a username in that case because it is all over the place. The police already have it. Don't be fooled, there are certainly kits being sold to law enforcement to dupe TouchID. You're da…

This is a disadvantage only when you are on trial. That's a pretty extreme contingency, and I think most people who aren't internet privacy advocates wouldn't be particularly worried about their phones , of all things, after they've been arrested and indicted. Outside the HN bubble, this is an acceptable tradeoff. People who are concerned can continue to use passwords.

It's easy to say that now while you're not on trial. What happens if the day comes where you are on trial, for something you may or may not be guilty of and what you have on your phone could potentially incriminate you, corroborating false accusations? We see it all the time, information is translated out of context and used in ways it was never supposed to be interpreted. It happens all over the media, it happens in smear campaigns in politics, it happens any time someone wants to get ahead of you on the promotional ladder. It's too late to come back after the fact and say "Well shit, I guess I should have considered the implications of that technology being used against me when I considered it just as a convenience." Sure, it's convenient. I get that, we all do. But if you don't consider the price of that convenience up front, you can't come back and complain that it was used against you afterwards.

Re: Fingerprints are Usernames, not Passwords

#247

Post by saalweachter » Wed, Oct 02, 2013, 4:24 PM UTC

Steuard wrote: post #236

nnnnni wrote: post #229

Earlier quoted context omitted.

This is completely unrelated, but why do people say "12 months", "18 months", and "24 months" rather than 1 year, 1.5 years, and 2 years? I don't get it. I'd understand if they're younger than a year old (eg "My son is seven months old!"), but not once the age can be expressed in years.

It's a really neat question, and as a new-ish parent I've given it some thought. In fact, there's even another layer to it: shortly after birth, people tend to count in weeks rather than months. My guess at an answer is that human beings are more comfortable thinking about numbers that are small integers (between 1 and 20 or so?), and that (roughly speaking) we often want to be able to give a bit more precision than…

Chains & rods are what first sprang to mind, but I don't think they were ever common. The definition of 'furlong' from http://physics.info/system-english/ makes it seem like it could have been in common usage:

  Literally, the length of a furrow. A sensible length for
  farmers that later evolved into the acre, which is discussed
  later in this section. A standard furrow is 220 yards long
  or ⅛ mile

Google's ngram tool makes it seem like it was never a contender with the yard, mile, or league.

Re: Fingerprints are Usernames, not Passwords

#248

Post by saalweachter » Wed, Oct 02, 2013, 4:31 PM UTC

mbrubeck wrote: post #91

mikeash wrote: post #63

Earlier quoted context omitted.

Let's say criminals manage to build a database of everybody's fingerprint. Now, I steal a phone, and have access to that database. How do I query it?

Based on a partial print from the screen or body of the phone? (It wouldn't work every time, but it might be feasible often enough to be worth trying.)

Call every phone number until the phone you've stolen rings. Then it's a simple reverse directory lookup to get the name of person who owns the phone.

Re: Fingerprints are Usernames, not Passwords

#249

Post by LargeWu » Wed, Oct 02, 2013, 4:34 PM UTC

nnnnni wrote: post #229

jedbrown wrote: post #226

Earlier quoted context omitted.

My friend's 12-month old baby reset the unlock code on her mother's phone and they ended up having to wipe it completely in order to recover.

This is completely unrelated, but why do people say "12 months", "18 months", and "24 months" rather than 1 year, 1.5 years, and 2 years? I don't get it. I'd understand if they're younger than a year old (eg "My son is seven months old!"), but not once the age can be expressed in years.

Because there's a lot of difference in development even from month to month, so the extra resolution is needed.

Re: Fingerprints are Usernames, not Passwords

#250

Post by LargeWu » Wed, Oct 02, 2013, 4:37 PM UTC

Steuard wrote: post #236

nnnnni wrote: post #229

Earlier quoted context omitted.

This is completely unrelated, but why do people say "12 months", "18 months", and "24 months" rather than 1 year, 1.5 years, and 2 years? I don't get it. I'd understand if they're younger than a year old (eg "My son is seven months old!"), but not once the age can be expressed in years.

It's a really neat question, and as a new-ish parent I've given it some thought. In fact, there's even another layer to it: shortly after birth, people tend to count in weeks rather than months. My guess at an answer is that human beings are more comfortable thinking about numbers that are small integers (between 1 and 20 or so?), and that (roughly speaking) we often want to be able to give a bit more precision than…

Blocks is a good one, although it's not a formal unit, I generally tend to associate it with about a 1/10 of a mile.