Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fingerprints Are Usernames, Not Passwords (2013)

blog.dustinkirkland.com

Post reply on HN
Print view View original

101–106 of 106 posts

Re: Fingerprints Are Usernames, Not Passwords (2013)

#101

Post by lostcolony »

taejo wrote: post #76
avn2109 wrote: post #46

Earlier quoted context omitted.

>> "Plus, passwords aren't routinely collected and shared by governmental agencies" Y U no read Greenwald? Not sure if trolling.

It took me a moment to work this out too, but they meant that the police don't ask for your passwords when they arrest you for an unrelated charge; the DMV doesn't ask you for them when you get a drivers license (do US DMVs do that?) etc.

US DMVs do not require fingerprints, no. However, they do require images to be taken of you, that are entered into a database ( http://www.washingtonpost.com/business/technology/state-phot... ). So when discussing 'biometrics' as a whole, government agencies routinely collect and share it.

Plus, let's not forget the data sharing arrangements that were highlighted by Greenwald; the US collects fingerprints from anyone entering the country ( http://en.wikipedia.org/wiki/Office_of_Biometric_Identity_Ma... ), and I'm sure they're happy to share that information with other countries, who may be prevented legally from collecting that info from their own citizens. And vice versa. So traveled overseas? It's not unreasonable to assume your home country now has access to that piece of biometric data. Certainly, the country you traveled to does.

And of course, if you are arrested, your fingerprints are entered into a DB as well (though you can fight to have them removed if you are never found guilty of anything; good luck with that).

In general, our biometric data is collected routinely, and so makes a really bad choice for a password. I never see the equivalent of this for passwords - http://thefreethoughtproject.com/st-louis-police-fingerprint...

Re: Fingerprints Are Usernames, Not Passwords (2013)

#102

Post by Karunamon »

chrismcb wrote: post #98
Karunamon wrote: post #50

Something I feel that's always missed in these discussions is context: Who is the adversary you're attempting to protect against? Your kids screwing around with your phone? TouchID does the job. Random people screwing around with your phone if they find it? Same thing. Government gets ahold of it? Yeah.. notsomuch. Considering that the primary adversaries of an average smartphone user are other mere mortals, not dedi…

And you don't think your children will try to hack your fingerprint with a gummy bear? A fingerprint makes a poor password and even a worse ysername. So much for asking your spouse to log in and check something for you

Won't work with TouchID - reads the blood vessels in addition to the prints.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#103

Post by lakerz16 »

undersuit wrote: post #97
Aldo_MX wrote: post #63

Earlier quoted context omitted.

This a thousand times! When you think about security, you should have in mind who you are protecting against, and the same applies to passwords. Security purists love to advocate that password reuse is evil, but who in the first place is going to be your attacker and for which purpose? For example, in the context of money (online banking, paypal, ebay, etc.) I completely agree that password reuse is evil. But when it…

> Security purists love to advocate that password reuse is evil, but who in the first place is going to be your attacker and for which purpose? You don't know, that's why password reuse is evil. Years ago when I made my Facebook account it used the same password as all my other accounts. Now that I use Facebook as an OpenID provider for pretty much any news site I would be exposing myself and my friends to all sorts…

OpenID does not provide your password to each site that you use it on... It uses a token that only that site can use, for the permissions that were shown when you created the token. If someone did acquire that token, you could just change your Facebook password and the token would expire

Re: Fingerprints Are Usernames, Not Passwords (2013)

#104

Post by dysfunction »

GhotiFish wrote: post #95
tigereyeTO wrote: post #83

Dustin Kirkland gets it. Simplifying his post, there are 3 reasons biometrics are terrible for authentication: 1. Every piece of biometric data is inherently public. (Fingerprints, facial geometry, hand geometry, even DNA) 2. Biometrics require an error threshold as our bodies are always changing (that's like typing a 20char password and having only 15 of them be correct. That's fine! Let them in anyways with 5 incor…

I actually like 2. I wish more things used 2. My keys are plenty strong, but when I mistype a strong key (which is plausible seeing as I can't see what I'm typing) then I'm fine with sacrificing some strength to just accept it. My key is already well beyond practical attack anyway. That said, if you WERE to use something like 2, you'd have to be much more diligent about enforcing good passwords, also you'd have to co…

Even assuming 2 is a good idea, I have no idea how that could be implemented. A major desirable property of a good password hashing algorithm is that slightly differing inputs should produce wildly differing hashes, and the login authenticator should only ever know the password hash and not the password itself.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#105

Post by GhotiFish »

dysfunction wrote: post #104
GhotiFish wrote: post #95

Earlier quoted context omitted.

I actually like 2. I wish more things used 2. My keys are plenty strong, but when I mistype a strong key (which is plausible seeing as I can't see what I'm typing) then I'm fine with sacrificing some strength to just accept it. My key is already well beyond practical attack anyway. That said, if you WERE to use something like 2, you'd have to be much more diligent about enforcing good passwords, also you'd have to co…

Even assuming 2 is a good idea, I have no idea how that could be implemented. A major desirable property of a good password hashing algorithm is that slightly differing inputs should produce wildly differing hashes, and the login authenticator should only ever know the password hash and not the password itself.

I know. I've being thinking about how to do it, currently it involves having N hashs where you generate them like:

  echo -n "password" | md5sum
  5f4dcc3b5aa765d61d8327deb882cf99  -
  echo -n "assword" | md5sum
  297dbe7699dcfa60609bf9e667e2e4dc  -
  echo -n "pssword" | md5sum
  537319a7934aea9825d1af85df588fde  -
  echo -n "pasword" | md5sum
  22e5ab5743ea52caf34abcc02c0f161d  -
  echo -n "pasword" | md5sum
  22e5ab5743ea52caf34abcc02c0f161d  -
ect, then check the submitted password by testing it against these hashes by removing characters in the same fashion.

Just as an early idea.

I think it's a good idea, what if you could encourage users to use stronger passwords by telling them that "the system will forgive near misses, so don't be afraid"?

Re: Fingerprints Are Usernames, Not Passwords (2013)

#106

Post by undersuit »

lakerz16 wrote: post #103
undersuit wrote: post #97

Earlier quoted context omitted.

> Security purists love to advocate that password reuse is evil, but who in the first place is going to be your attacker and for which purpose? You don't know, that's why password reuse is evil. Years ago when I made my Facebook account it used the same password as all my other accounts. Now that I use Facebook as an OpenID provider for pretty much any news site I would be exposing myself and my friends to all sorts…

OpenID does not provide your password to each site that you use it on... It uses a token that only that site can use, for the permissions that were shown when you created the token. If someone did acquire that token, you could just change your Facebook password and the token would expire

If my Facebook password and some old website's password are the same my Facebook can be compromised. Then the attacker can run around on the net pretending to be me at any OpenID accepting website.

OpenID isn't being attacked or at fault, it's non-unique passwords.

Post reply on HN