Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID, Touch ID, No ID, PINs and Pragmatic Security

troyhunt.com

Post reply on HN
Print view View original

181–190 of 314 posts

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#181

Post by MBCook »

macintux wrote: post #173
MBCook wrote: post #167

Earlier quoted context omitted.

I think it would be really cool if it turned out that it could tell the difference between some pairs of identical twins due to seemingly imperceptible differences.

I'm sure it's not 100%, but I'd bet it's close. Certainly by young adulthood the identical twins I've been around have been relatively easy to distinguish.

That's sort of my theory. But I wonder how much of people's ability to distinguish identical twins is based on physical differences vs more subtle things like how they carry themselves/interact with the world.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#182

Post by vlozko »

liberte82 wrote: post #164
consto wrote: post #152

Honestly, the only downside I can see vs. TouchID is that you can in theory point the phone at the person and unlock it. However this is balanced out by not working while unconcious. PINs as discused are not directly comparable.

How does it not work while unconscious? Eyes need to be open?

That and looking at the device.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#183

Post by danjoc »

sgarg wrote: post #147

I really liked this write-up because it focused on the practicality of the various security mechanisms. Most articles I see usually have a blanket statement like "All biometric security mechanisms are bad!". I think this article does a good job comparing the various logins and describing the pros and cons for different people. Specifically, I appreciate the author calling out when people bring up the "What if" edge-c…

>All biometric security mechanisms are bad

They are though, if bad == insecure. Customs can make you unlock with fingerprint or face. If you can't lock yourself out, it's not secure.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#184

Post by Darthy »

baby wrote: post #37
rcarmo wrote: post #8

For me it's not so much the paranoia or the degree of security (which is an arguable point in itself) but the commodity of it. Touch ID lets me unlock my devices without having to re-position my upper body or move them in (practically) any way, and Face ID feels awkward (I'm typing this on the device that is likely an exception to that - a Microsoft Surface Pro - and Windows Hello's face recognition works beautifully…

> without having to re-position my upper body why would you unlock your phone if you're not going to look at it? I don't understand this argument.

One reason would be ApplePay. At least in Europe most payment terminals have their NFC sensors on their side, so you're supposed to hold your phone flat with the side of a box, so the selfie camera just points to the wall on your left. In that position, there is no way that the camera of your iPhone could see your face.

Compare this to Touch ID, where you hold your phone to that box with your finger on the sensor and half a second later you've paid - very convenient.

I would take a guess that Apple has not yet tested any iPhone X with a European payment terminals and will get a lot of angry emails once people try that combination.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#185

Post by eric_h »

smelterdemon wrote: post #150

Re: the pushback the author got on Twitter; I believe in skepticism towards corporations and marketing claims, but the level of cynicism online towards any new tech idea or product seems a bit out of hand. There's a certain trend, on Twitter especially, of people racing to prove they're either more woke or smarter than the teams of people behind things that are yet to even be released. I mean a "wait and see" attitud…

> There's a certain trend, on Twitter especially, of people racing to prove they're either more woke or smarter than the teams of people behind things that are yet to even be released.

This has been a trend of a vocal minority on the internet for as long as I've been connected to it. Remember "No wireless. Less space than a nomad. Lame"?

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#186

Post by daveFNbuck »

et-al wrote: post #179
jfaat wrote: post #114

Earlier quoted context omitted.

All of my banking apps, among others (e.g. password manager), include options for both pin and touchID auth. Do we not already have what you’re asking for?

Which password manager are you using? 1Password doesn't support TouchID + PIN on iOS, but I wish they would.

I'm using LastPass on Android, and I have it set to require both my fingerprint and my LastPass password.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#187

Post by alistairSH »

It appears that FaceId only supports a single face (unlike TouchId, which supports multiple fingers).

Maybe this use case isn't common, but my wife frequently needs access to my phone. Usually while driving, to change GPS routing, or playlist, or respond to SMS. With TouchId, she can do so without my PIN. With FaceId, she needs my PIN.

This strikes me as both less secure and quite annoying. Now, I have to repeat my PIN out loud while she types it into the device. Or, force her to memorize it (in addition to her own PIN, and I have to remember hers for the reverse situation).

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#188

Post by mikeash »

DrNuke wrote: post #117

The complete business model is taking the p*ss imho. I am seeing more than a number of people reverting to simple €20 nokias for basic telephone + sms usage on top of a gadget / secondary device for consumption or mobile business.

Apple sold over 200 million iPhones last year, and they make up a relatively small proportion of the overall smartphone market. I don't think there are very many people like you describe.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#189

Post by joombaga »

n42 wrote: post #180
apeace wrote: post #177

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN This is what has been missing from every discussion of this issue that I've seen so far. The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get i…

On top of this, iOS 11 introduced an emergency mode that is enabled by tapping the standby button five times rapidly. It is easy to do discretely in your pocket, and it locks your phone by requiring your passcode to be entered again.

You can achieve the same effect on some Android devices by exploiting the password lock from scanning the wrong finger repeatedly.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#190

Post by pertymcpert »

danjoc wrote: post #183
sgarg wrote: post #147

I really liked this write-up because it focused on the practicality of the various security mechanisms. Most articles I see usually have a blanket statement like "All biometric security mechanisms are bad!". I think this article does a good job comparing the various logins and describing the pros and cons for different people. Specifically, I appreciate the author calling out when people bring up the "What if" edge-c…

>All biometric security mechanisms are bad They are though, if bad == insecure. Customs can make you unlock with fingerprint or face. If you can't lock yourself out, it's not secure.

Customs can do that anyway if you have a password.
Post reply on HN