Fingerprints Are Usernames, Not Passwords (2013)
blog.dustinkirkland.com
Fingerprints Are Usernames, Not Passwords (2013)
1–10 of 106 posts
Re: Fingerprints Are Usernames, Not Passwords (2013)
#2I don't think many (outside of perhaps Apple PR?) have argued that fingerprint security is great, absolutely speaking. Relatively speaking, however, it is great, as many phone owners would otherwise not have any sort of locking security on their devices at all. Yes a fingerprint unlock is hackable, but it's a lot less hackable than your phone being open from the get go.
Re: Fingerprints Are Usernames, Not Passwords (2013)
#3I don't think many (outside of perhaps Apple PR?) have argued that fingerprint security is great, absolutely speaking. Relatively speaking, however, it is great, as many phone owners would otherwise not have any sort of locking security on their devices at all. Yes a fingerprint unlock is hackable, but it's a lot less hackable than your phone being open from the get go.
Exactly. It's going to deter a lot of crimes of opportunity, which I would guess also make up the largest volume of unauthorized device usage.
Re: Fingerprints Are Usernames, Not Passwords (2013)
#4I don't think many (outside of perhaps Apple PR?) have argued that fingerprint security is great, absolutely speaking. Relatively speaking, however, it is great, as many phone owners would otherwise not have any sort of locking security on their devices at all. Yes a fingerprint unlock is hackable, but it's a lot less hackable than your phone being open from the get go.
Some lenovo thinkpads come with fingerprint readers and trsuted computing modules and more secure BIOS -- they pushed the security of that quite hard.
Re: Fingerprints Are Usernames, Not Passwords (2013)
#5This article is from 2013. While things didn't change a lot (this years TouchID was broken as well IIRC, though I've heard it got a little better), it's hardly news.
Also, I don't think even Apple advertises its fingerprint scanner as a replacement of passwords. It is a replacement of 4-digit PINs, and for that it is far more secure. While members of CCC have the knowledge of lifting a print, most people do not have this knowledge or tools. And if you notice your phone is stolen, you can always log in to icloud.com (with your password, you cannot use TouchID there) and lock down/reset your phone immediately.
Re: Fingerprints Are Usernames, Not Passwords (2013)
#6In the case of Touch ID, please consider that in order to circumvent it, you not only have to be able to fool the Touch ID sensor, you also have to have physical access to the device.
Re: Fingerprints Are Usernames, Not Passwords (2013)
#7I don't think many (outside of perhaps Apple PR?) have argued that fingerprint security is great, absolutely speaking. Relatively speaking, however, it is great, as many phone owners would otherwise not have any sort of locking security on their devices at all. Yes a fingerprint unlock is hackable, but it's a lot less hackable than your phone being open from the get go.
Some lenovo thinkpads come with fingerprint readers and trsuted computing modules and more secure BIOS -- they pushed the security of that quite hard.
I used to be employed by a bank that gave me a such a system with TPM and secure BIOS with fingerprint reader.It was a dell one if i remember and used to take quite a lot of time with even simple things like booting.It was a specific project!
Re: Fingerprints Are Usernames, Not Passwords (2013)
#8As with many things, it depends heavily on what you're using it for. Not as pithy for a title though, I suppose.
No amount of information entered into a computer fully proves it's you and not someone else. A fingerprint provides some information, as does a password.
This sounds like a fairly useless distinction, but hopefully this will make sense:
If all we're doing is trying to prove we're us and not someone else, why do we need a username at all? What added bonus is gained from having a completely public bit of information?
Well that's because:
1. People are bad at picking passwords, if everyone picked a 2000 character random password and kept it secret we'd not really need anything extra 2. You can't inform people if they've picked the same authentication as someone else, so you prefix it with a per-user unique value which you let people know will be public
I don't really see fingerprints as a username or a password. They're just another hint to the system that it's probably you, and you can use any combination of those three depending on what you actually care about.
For example:
I don't have a username on my phone to unlock it, just a password.
I have a username and password for HN.
I have a username, password and physical auth device for work-related logins.
The latter two are fairly obvious as differences in how important it is that I'm verified to be me, the former is because I mostly want my phone to distinguish between me and my pocket.
> But biometrics cannot, and absolutely must not, be used to authenticate an identity.
This is incredibly context dependent.
My pithy one liner:
All absolute statements are flawed.
Re: Fingerprints Are Usernames, Not Passwords (2013)
#9How about the user gets the option to add NFC pairing so strengthen the security of the fingerprint. Once the user sets both up, then he won't be able to login until both are recognized for authentication. It should be hassle free if that NFC pairing comes from a smartwatch or smart-band and he just picks up the phone with that hand. The NFC authentication should happen automatically without thinking about it.
The NFC would essentially function as an OTP 2nd factor (or FIDO U2F if that's better) to the fingerprint being the "password".
Re: Fingerprints Are Usernames, Not Passwords (2013)
#10I don't think many (outside of perhaps Apple PR?) have argued that fingerprint security is great, absolutely speaking. Relatively speaking, however, it is great, as many phone owners would otherwise not have any sort of locking security on their devices at all. Yes a fingerprint unlock is hackable, but it's a lot less hackable than your phone being open from the get go.
Exactly. Touch ID (hopefully!) isn't designed to protect against a sophisticated adversary with time for preparations; it only has to hold out as long as it takes the device owner to realize that their gadget has gone missing. In the case of Apple Pay, they can then immediately disable the payment functionality.
Of course, this doesn't help against a sophisticated attacker who is interested in the data on a device; in that case, a secure passphrase would be preferable.
Unfortunately, it seems like iOS doesn't allow using different authentication methods for payments and for device unlocking; it would be really nice to be able to use Touch ID for the former, and a passphrase (or even a passphrase AND a fingerprint!) for the latter.