81–90 of 106 posts
* Something you have (like an access card or badge)
* Something you know (like a password)
* Something you are (like a fingerprint, iris scan, or a simply a photo)
Fingerprints are bit weird as you do in fact leave them around everywhere. Like iris scans I would qualify them as better photographs.
Everything about this article is well-intentioned — and wrong. "much as a your email address or username identifies you, perhaps from a list." Your email address or username may identify you, but it also may not. Your fingerprint absolutely identifies you and only you. "For authentication, you need a password or passphrase. Something that can be independently chosen" A password is a secret phrase. We're used to think…
The whole point of the article is that this isn't true. Fingerprints are trivial to obtain and copy with sufficient fidelity to beat modern fingerprint readers.
- http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid
- http://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in...
- http://www.discovery.com/tv-shows/mythbusters/mythbusters-da...
- http://www.instructables.com/id/How-To-Fool-a-Fingerprint-Se...
Simplifying his post, there are 3 reasons biometrics are terrible for authentication:
1. Every piece of biometric data is inherently public. (Fingerprints, facial geometry, hand geometry, even DNA)
2. Biometrics require an error threshold as our bodies are always changing (that's like typing a 20char password and having only 15 of them be correct. That's fine! Let them in anyways with 5 incorrect characters)
3. Key revocation. I can change my passwords and locks if you get a copy of my passwords or keys... but once you have a copy of a biometric identifier I cannot use that again for the rest of my life.
Well done, Dustin.
Something I feel that's always missed in these discussions is context: Who is the adversary you're attempting to protect against? Your kids screwing around with your phone? TouchID does the job. Random people screwing around with your phone if they find it? Same thing. Government gets ahold of it? Yeah.. notsomuch. Considering that the primary adversaries of an average smartphone user are other mere mortals, not dedi…
Still, I'd rather not give hardened criminals a reason to cut off my fingers.
Everything about this article is well-intentioned — and wrong. "much as a your email address or username identifies you, perhaps from a list." Your email address or username may identify you, but it also may not. Your fingerprint absolutely identifies you and only you. "For authentication, you need a password or passphrase. Something that can be independently chosen" A password is a secret phrase. We're used to think…
And fingerprints will leak, as we are using them more and more.
I always get the sense of cognitive dissonance when I read security researches and advocates write about passwords and fingerprints. If you have access to my device, you have access to my physical person, and my physical person will freely give up any password because no secret I have is worth my life. This isn't Hollywood, I'll give up my password with even the hint of physical violence that could maim or otherwise…
I think you take the right approach to true security risk analysis. But there are all sorts of cases you leave out. Someone might very well have access to your device without having access to your physical person. Because your device was lost or stolen. Someone may very well not be willing to threaten you with physical harm, but be willing to hack your device. (Not every adversary is from a Hollywood movie either!) L…
If you're at odds with an American TLA, your 4 digit pin isn't going to slow them down at all.
Besides, the entropy on the average 4 digit pin is really low, it has a greater chance of using 5, 6, 8, and 9 for righties, and 4, 5, 7, 8 for lefties. Combine this with repeated finger grease blobs, and I don't feel anyone can logically argue that a pin is a sufficiently more secure option compared to a fingerprint.
Earlier quoted context omitted.
Still, I'd rather not give hardened criminals a reason to cut off my fingers.
Touch ID only works for a minute or two after your finger is cut off. Touch ID reads the blood vessels, not the fingerprint, meaning it only works for a minute or two after the finger is cut off.
Earlier quoted context omitted.
I think you take the right approach to true security risk analysis. But there are all sorts of cases you leave out. Someone might very well have access to your device without having access to your physical person. Because your device was lost or stolen. Someone may very well not be willing to threaten you with physical harm, but be willing to hack your device. (Not every adversary is from a Hollywood movie either!) L…
Perhaps, but I feel that anyone sophisticated enough to replicate my fingerprint perfectly before it reverts to password only, and to do so before I'm able to make a remote wipe, and able to even find my fingerprints (lost phone) and to be lucky enough that the fingerprint is the one I used to secure the device, makes this a sufficiently low risk to the average user in my opinion. If you're at odds with an American T…
Earlier quoted context omitted.
Why must high entropy passwords be rotated regularly anyway? Shouldn't they only need rotating after a certain number of incorrect logins? Shouldn't that number be decently high?
Regularly changing your password reduces the impact of an undetected security breach by shortening the maximum amount of time a leaked password remains useful.
Because people are just people, not superhuman remembering machines.