Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I recommend against using biometric identification

medium.freecodecamp.org

Post reply on HN
Print view View original

191–200 of 239 posts

Re: I recommend against using biometric identification

#191

Post by StephenConnell »

EGreg wrote: post #163
castis wrote: post #107

Earlier quoted context omitted.

That man may still be in prison, but that drive is still encrypted. If you are unwilling to give something you know to someone, no amount of force can take it from you. Had that drive been encrypted using facial biometrics, they could have just knocked him out, glued his eyes open, and taken what they wanted. What works, and what has been deemed legal, as you probably already know, are not mutually exclusive.

Why do people assume that deniability results in more whacking? Technology can easily be used to encrypt a hard drive to reveal different things for different passwords. TrueCrypt does it. Plus you can have cryptographic keys stored with friends or beacons that signify you are safe. For example you hide files on your phone before a flight, and to unhide them you need your host's wifi at your destination. Until the fr…

That's what we did with our TI86 calculators in the 90s. Fake memory Clear was the name of one app. Teacher looks and sees what looks like a formatted calculator, clears the calculator if they want, then you exit the app and access your notes, games, and apps.

Re: I recommend against using biometric identification

#192

Post by torstenvl »

beefsack wrote: post #159
sullyj3 wrote: post #155

> Today Apple announced its new FaceID technology. It’s a new way to unlock your phone through facial recognition. This line makes it sound like android hasn't had this feature for years.

There's a funny double standard in mobile reporting. It's incredibly common to see non-Apple phones being called "iPhone clones" but I'm seeing very little mention of the iPhone X looking eerily similar to existing bezel-free-with-cut-out designs like the Essential PH-1 and Aquos S2.

Facile comparison is facile.

Re: I recommend against using biometric identification

#193

Post by seandougall »

bodz wrote: post #50
kenjackson wrote: post #32

Earlier quoted context omitted.

Ehh... it's not the same as a username. It's more like fingerprints are door locks. Any determined thief can get around it. But it protects you from people who aren't really all that determined. And for most people door locks are sufficient. But if you are a major crime lord, protecting something extremely valuable, or just really into security then door locks are not enough.

The "door lock" analogy ignores the biggest flaw with fingerprints: they're forever. If your door lock is compromised, you can change the key. If someone steals your password, you can change the password. If someone steals your fingerprint, you can never change your fingerprint (same with your face). The other stuff is dead-on: its a "good enough" security measure for phones. But as a security practitioner, the bigge…

> you can never change your fingerprint

Not quite true from the phone's perspective. Most people have nine backups to fall back on if they really need to.

Re: I recommend against using biometric identification

#194

Post by chaostheory »

dawnerd wrote: post #151
chaostheory wrote: post #119

Earlier quoted context omitted.

1. It's 6 digits now, and not 4. 2. I can also better hide myself entering the pin 3. As mentioned in other places, unlike a fingerprint or face; you can easily change pin codes. In an ideal world, facial recognition or touch id would serve as identification in addition to the pin code.

https://www.schneier.com/blog/archives/2016/11/using_wi-fi_t... Pins are basically useless to anyone determined, no matter how much you try to hide it. There's no real bullet-proof security except for a really long password, but how many people are going to do that realistically?

> WindTalker presents a novel approach to collect the target's CSI data by deploying a public WiFi hotspot.

If you don't join public WiFi hotspots, this isn't a danger.

Yes pins are not foolproof. They are however still better than facial scans or thumb scans.

Re: I recommend against using biometric identification

#195

Post by stale2002 »

coldtea wrote: post #102
booleandilemma wrote: post #101

Earlier quoted context omitted.

It doesn't have to be a repeated attack from the same attacker. Imagine your fingerprint data is leaked to hundreds of hackers.

And many of those hackers (or even one of them) care enough to (a) steal your phone, (b) fake your fingerprints with a cast or whatever? Yeah, I'll risk it...

Ok, how about this. Imagine if MILLIONS of fingerprints are leaked, in some sort of wide net security break, and now any script kiddie can hack ~50% of phones?

Re: I recommend against using biometric identification

#196

Post by remarkEon »

cstrat wrote: post #111
sxates wrote: post #84

Never? If Jason Bourne is after you that's probably true. If you're worried about border security, that's maybe true. But for most people, the lock on their phone isn't protecting them from the government, it's protecting them from nosy relatives, a pick pocket, or the guy that finds the phone you left at the bar, or their 4 year old. None of these 'attackers' will ever be sophisticated enough to defeat the biometric…

The big thing about TouchID and FaceID is that they are great ways of enforcing a higher level of security than nothing... Prior to these technologies many people I knew did not bother having PINs or were using 1234 because remembering a complex PIN or having to type in something long is too laborious.

Bingo. Numerous times I've had to explain to my parents why using their wedding anniversary for everything is a really bad idea. For folks like us, yeah, we can see issues. But for my parents biometrics is the best worst option.

Re: I recommend against using biometric identification

#197

Post by remarkEon »

kurthr wrote: post #104
sxates wrote: post #84

Never? If Jason Bourne is after you that's probably true. If you're worried about border security, that's maybe true. But for most people, the lock on their phone isn't protecting them from the government, it's protecting them from nosy relatives, a pick pocket, or the guy that finds the phone you left at the bar, or their 4 year old. None of these 'attackers' will ever be sophisticated enough to defeat the biometric…

I agree that convenience is the real test of each of these technologies (along with "good enough" security) that lets the majority of people to have a good experience. The biggest concerns for the iPhone (or others) then are things like viewing angle, sunlight, etc... Also, if I were an identical twin (only 0.3% of the population) I would be a bit unhappy that my brother/sister could post anything they wanted on my I…

What about Halloween when everyone is in costume? Will I be able to access my phone without taking off a mask?

Re: I recommend against using biometric identification

#199

Post by roenxi »

cstrat wrote: post #111
sxates wrote: post #84

Never? If Jason Bourne is after you that's probably true. If you're worried about border security, that's maybe true. But for most people, the lock on their phone isn't protecting them from the government, it's protecting them from nosy relatives, a pick pocket, or the guy that finds the phone you left at the bar, or their 4 year old. None of these 'attackers' will ever be sophisticated enough to defeat the biometric…

The big thing about TouchID and FaceID is that they are great ways of enforcing a higher level of security than nothing... Prior to these technologies many people I knew did not bother having PINs or were using 1234 because remembering a complex PIN or having to type in something long is too laborious.

They are even less convenient for lending a phone to a friend or relative though.

These features are change; not a straight improvement. They have different pros and cons compared to a passcode.

Re: I recommend against using biometric identification

#200

Post by linopolus »

wentoodeep wrote: post #198

Can't wait for a guide, first things to do on your first boot. 1) Turn Off Face Unlock, this feature consume memories and stores large training data for your face and also will drain your battery.

Not exactly correct, as this data is stored in the separate secure enclave, just like with TouchID today.
Post reply on HN