Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fingerprints Are Usernames, Not Passwords (2013)

blog.dustinkirkland.com

Post reply on HN
Print view View original

31–40 of 106 posts

Re: Fingerprints Are Usernames, Not Passwords (2013)

#31

Post by higherpurpose »

ggreer wrote: post #20

His argument proves too much. If he thinks fingerprints are too insecure to be allowed, then he must think the same of low-entropy passwords. Yet I don't see him advocating that Ubuntu force users to choose high-entropy passwords and rotate them regularly. If he's fine letting users choose a low level of security by picking simple passwords, why not also let them choose to auth with fingerprints? Also, I think he mis…

There is indeed a high-risk way of doing fingerprint scanning - the way Estonia intends to do it for people who want to become its e-citizens. They want to collect everyone's fingerprints and store them in a centralized database. Good luck with that not being stolen. NSA will probably break into it the same same week it goes online.

Having the fingerprints hashes stored in a secure enclave on everyone's devices seems like a much more secure way to deal with fingerprints. The first method is completely unacceptable. The latter is more reasonable.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#32

Post by diminish »

ggreer wrote: post #20

His argument proves too much. If he thinks fingerprints are too insecure to be allowed, then he must think the same of low-entropy passwords. Yet I don't see him advocating that Ubuntu force users to choose high-entropy passwords and rotate them regularly. If he's fine letting users choose a low level of security by picking simple passwords, why not also let them choose to auth with fingerprints? Also, I think he mis…

> 3. Something you are (fingerprint, face, DNA, etc).

Add there your mom's maiden name, your parent's names and you get the point; in an authentication system "something you are" must be better used more as user names rather than passwords because users can't change them. Once they're public irrecoverable attacks may happen.

There are 3 categories of authentication inputs.

(1) Something users can not change

(2) Something users can change

(3) Something the service owners or system admins can change including time synchronized codes.

You better use 1 as usernames, 2 & 3 as passwords.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#33

Post by kosmopolska »

redwall_hp wrote: post #27
Tyrannosaurs wrote: post #24

Earlier quoted context omitted.

I think Apple are pretty aware of the limitations - they don't accept TouchID on first login after a restart, for the first purchase after a restart, if it's been 48 hours since an unlock or for resets/major config changes. For that you either need the PIN or, if you've opted for more security, the password. Overall it feels that Apple's take is for day to day login it's better than a four digit PIN and it's better t…

>they don't accept TouchID on first login after a restart That's because the hash of the print is stored on an encrypted volume of some kind, which requires your regular password to decrypt after a cold boot. Once the hash is in memory, the fingerprint can be used instead.

I'm not sure I'm following what you're saying a 100%, but based on this [1] i don't think the fingerprint hash is ever in memory. The TouchID camera sends the fingerprint hash directly to the secure enclave, where it is compared to the one saved there, and then the secure enclave sends a yes or no to memory, at least that's my interpretation

1. http://support.apple.com/kb/HT5949?viewlocale=en_US&locale=e...

Re: Fingerprints Are Usernames, Not Passwords (2013)

#34

Post by lostcolony »

ggreer wrote: post #20

His argument proves too much. If he thinks fingerprints are too insecure to be allowed, then he must think the same of low-entropy passwords. Yet I don't see him advocating that Ubuntu force users to choose high-entropy passwords and rotate them regularly. If he's fine letting users choose a low level of security by picking simple passwords, why not also let them choose to auth with fingerprints? Also, I think he mis…

I'm sure he -does- think low entropy passwords are bad. However, once compromised, those can be changed. That's the point. (Plus, passwords aren't routinely collected and shared by governmental agencies. Just throwing that out there).

As you say, with Apple's TouchID, you are actively choosing a less secure method to access your device, for convenience. But...that's also pretty close to what the author said. "Biometrics can be use used as a lightweight, convenient mechanism to establish identity, but they cannot authenticate a person or a thing alone."

His point is that for things like system access to a Linux box, or to unencrypt data (eCryptfs, the software he helps maintain), biometrics is far too insecure.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#35

Post by marcosdumay »

higherpurpose wrote: post #31
ggreer wrote: post #20

His argument proves too much. If he thinks fingerprints are too insecure to be allowed, then he must think the same of low-entropy passwords. Yet I don't see him advocating that Ubuntu force users to choose high-entropy passwords and rotate them regularly. If he's fine letting users choose a low level of security by picking simple passwords, why not also let them choose to auth with fingerprints? Also, I think he mis…

There is indeed a high-risk way of doing fingerprint scanning - the way Estonia intends to do it for people who want to become its e-citizens. They want to collect everyone's fingerprints and store them in a centralized database. Good luck with that not being stolen. NSA will probably break into it the same same week it goes online. Having the fingerprints hashes stored in a secure enclave on everyone's devices seems…

The NSA certainly already has the fingerprint of everybody they care about, and probably has of everybody else too.

Governments collect fingerprints on several occasions, as do several buildings' security, some mass transit administration, banks, workplaces, and lots of other entities. Also, you live them everywhere anyway.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#36

Post by _red »

diminish wrote: post #32
ggreer wrote: post #20

His argument proves too much. If he thinks fingerprints are too insecure to be allowed, then he must think the same of low-entropy passwords. Yet I don't see him advocating that Ubuntu force users to choose high-entropy passwords and rotate them regularly. If he's fine letting users choose a low level of security by picking simple passwords, why not also let them choose to auth with fingerprints? Also, I think he mis…

> 3. Something you are (fingerprint, face, DNA, etc). Add there your mom's maiden name, your parent's names and you get the point; in an authentication system "something you are" must be better used more as user names rather than passwords because users can't change them. Once they're public irrecoverable attacks may happen. There are 3 categories of authentication inputs. (1) Something users can not change (2) Somet…

Fingerprints can be changed as easily as a username. Simply never use the "raw" fingerprint output of the device, instead XOR it with some key (like either something from factors 2 or 3, or simply a static key).

Re: Fingerprints Are Usernames, Not Passwords (2013)

#37

Post by reynard_le_faux »

lostcolony wrote: post #34
ggreer wrote: post #20

His argument proves too much. If he thinks fingerprints are too insecure to be allowed, then he must think the same of low-entropy passwords. Yet I don't see him advocating that Ubuntu force users to choose high-entropy passwords and rotate them regularly. If he's fine letting users choose a low level of security by picking simple passwords, why not also let them choose to auth with fingerprints? Also, I think he mis…

I'm sure he -does- think low entropy passwords are bad. However, once compromised, those can be changed. That's the point. (Plus, passwords aren't routinely collected and shared by governmental agencies. Just throwing that out there). As you say, with Apple's TouchID, you are actively choosing a less secure method to access your device, for convenience. But...that's also pretty close to what the author said. "Biometr…

I think convenience is important in this comparison because that generates a context in which TouchID is actually more secure, because it's more likely to be used than remembering and typing a passcode/phrase. Apple have shown the usage stats. There is also the inconvenience for attackers of reproducing a fingerprint through an elaborate process, which again makes TouchID more secure (in my opinion) in practice than a password/phrase.

While theoretically less secure, I would say TouchID in practice is more secure for average users. But in the case where there is the motivation I would agree with you.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#38

Post by Retric »

_red wrote: post #36
diminish wrote: post #32

Earlier quoted context omitted.

> 3. Something you are (fingerprint, face, DNA, etc). Add there your mom's maiden name, your parent's names and you get the point; in an authentication system "something you are" must be better used more as user names rather than passwords because users can't change them. Once they're public irrecoverable attacks may happen. There are 3 categories of authentication inputs. (1) Something users can not change (2) Somet…

Fingerprints can be changed as easily as a username. Simply never use the "raw" fingerprint output of the device, instead XOR it with some key (like either something from factors 2 or 3, or simply a static key).

That's not changing the fingerprint that's using another password.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#39

Post by IanCal »

icebraining wrote: post #11
IanCal wrote: post #8

As with many things, it depends heavily on what you're using it for . Not as pithy for a title though, I suppose. No amount of information entered into a computer fully proves it's you and not someone else. A fingerprint provides some information, as does a password. This sounds like a fairly useless distinction, but hopefully this will make sense: If all we're doing is trying to prove we're us and not someone else,…

I think that's all irrelevant. Passwords can be compromised and must be changeable - that alone makes fingerprints a bad choice.

What are they a bad choice for? Everything? You can't think of a single scenario where fingerprints could be useful as a form of authentication?

Re: Fingerprints Are Usernames, Not Passwords (2013)

#40

Post by LanceH »

ggreer wrote: post #20

His argument proves too much. If he thinks fingerprints are too insecure to be allowed, then he must think the same of low-entropy passwords. Yet I don't see him advocating that Ubuntu force users to choose high-entropy passwords and rotate them regularly. If he's fine letting users choose a low level of security by picking simple passwords, why not also let them choose to auth with fingerprints? Also, I think he mis…

Why must high entropy passwords be rotated regularly anyway? Shouldn't they only need rotating after a certain number of incorrect logins? Shouldn't that number be decently high?
Post reply on HN