Face ID, Touch ID, No ID, PINs and Pragmatic Security • Hacker News Board

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#191

Post by mikeash » Thu, Sep 14, 2017, 4:38 PM UTC

rothbardrand wrote: post #174

sgarg wrote: post #147

I really liked this write-up because it focused on the practicality of the various security mechanisms. Most articles I see usually have a blanket statement like "All biometric security mechanisms are bad!". I think this article does a good job comparing the various logins and describing the pros and cons for different people. Specifically, I appreciate the author calling out when people bring up the "What if" edge-c…

Specifically, getting more people to have better security on their devices is a very difficult User Experience problem, and Apple's pretty good at solving these kinds of problems. TouchID moved the ball forward quite a bit, and FaceID will probably go even further. Obviously neither provide ultimate security, but Apple is in a strategic advantage since they make the hardware and software to make the barn walls and ro…

Before TouchID, I set my passcode to 0000 with a four-hour window where I didn't have to reenter it. I only had one set at all because Find My Friends refused to keep me logged in unless I had a passcode set.

With TouchID, I have a complex passcode that I have to enter a couple times a week. It's less secure than some hypothetical setup where I have a complex passcode I have to enter every time I unlock the phone, but it's far more secure than what I was actually doing before.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#192

Post by mikeash » Thu, Sep 14, 2017, 4:39 PM UTC

danjoc wrote: post #183

sgarg wrote: post #147

I really liked this write-up because it focused on the practicality of the various security mechanisms. Most articles I see usually have a blanket statement like "All biometric security mechanisms are bad!". I think this article does a good job comparing the various logins and describing the pros and cons for different people. Specifically, I appreciate the author calling out when people bring up the "What if" edge-c…

>All biometric security mechanisms are bad They are though, if bad == insecure. Customs can make you unlock with fingerprint or face. If you can't lock yourself out, it's not secure.

That's why you temporarily disable biometric authentication before you go through customs. On iOS, this is as easy as turning the device off, and in iOS 11 it just takes five quick presses of the sleep button.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#193

Post by jakebellacera » Thu, Sep 14, 2017, 4:50 PM UTC

tony101 wrote: post #94

Given that the authentication methods are "differently secure," wouldn't it be good if we were offered the option to combine them and require both for unlock? I would love to use Face ID + PIN or Touch ID + PIN for better security.

I also believe that TouchID + FaceID would be a good combo as well for the vast majority of users. Both technologies seem to be relatively foolproof and user-friendly. Upping the ante from a security perspective would be a good thing. Unfortunately, that won't come to fruition.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#194

Post by cmsj » Thu, Sep 14, 2017, 4:50 PM UTC

ernsheong wrote: post #166

tony101 wrote: post #94

Given that the authentication methods are "differently secure," wouldn't it be good if we were offered the option to combine them and require both for unlock? I would love to use Face ID + PIN or Touch ID + PIN for better security.

I'm calling it that Touch ID will make a comeback: https://twitter.com/ernsheong/status/908018119595003904 How bout: Touch ID + Face ID. Hahaa

I'm not sure that Touch ID can come back in its current form. Phil stood on stage and told us Touch ID is 50,000 secure and Face ID is 1,000,000 secure.

I think the only way for Touch ID to come back is for it to cover the whole display, so it can authenticate every touch.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#195

Post by jakebellacera » Thu, Sep 14, 2017, 4:52 PM UTC

ernsheong wrote: post #166

tony101 wrote: post #94

Given that the authentication methods are "differently secure," wouldn't it be good if we were offered the option to combine them and require both for unlock? I would love to use Face ID + PIN or Touch ID + PIN for better security.

I'm calling it that Touch ID will make a comeback: https://twitter.com/ernsheong/status/908018119595003904 How bout: Touch ID + Face ID. Hahaa

I highly doubt this would be possible for a long time, but it would be interesting if Apple could equip the entire display a TouchID sensor. If you could scan all of our fingertips, then you could theoretically "sign" every interaction with the display.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#196

Post by crindy » Thu, Sep 14, 2017, 4:54 PM UTC

n42 wrote: post #180

apeace wrote: post #177

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN This is what has been missing from every discussion of this issue that I've seen so far. The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get i…

On top of this, iOS 11 introduced an emergency mode that is enabled by tapping the standby button five times rapidly. It is easy to do discretely in your pocket, and it locks your phone by requiring your passcode to be entered again.

One thing to note: It's at least five times, not exactly. Just click that side button until your phone vibrates a bit and it's locked. I mainly see myself using this feature in high stress situations, like going through airport security or being pulled over, so not needing to count is a small plus.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#197

Post by phire » Thu, Sep 14, 2017, 4:54 PM UTC

mikeash wrote: post #191

rothbardrand wrote: post #174

Earlier quoted context omitted.

Specifically, getting more people to have better security on their devices is a very difficult User Experience problem, and Apple's pretty good at solving these kinds of problems. TouchID moved the ball forward quite a bit, and FaceID will probably go even further. Obviously neither provide ultimate security, but Apple is in a strategic advantage since they make the hardware and software to make the barn walls and ro…

Before TouchID, I set my passcode to 0000 with a four-hour window where I didn't have to reenter it. I only had one set at all because Find My Friends refused to keep me logged in unless I had a passcode set. With TouchID, I have a complex passcode that I have to enter a couple times a week. It's less secure than some hypothetical setup where I have a complex passcode I have to enter every time I unlock the phone, bu…

My android phone forces me to re-enter my passcode every 24 hours.

I think that strikes a nice security median. If someone does get procession of my phone, I only need to stall for less than 24 hours.

The rest of the time, the fingerprint scanner works near perfectly. It's actually faster to use the fingerprint scanner than the standard slide to unlock, which is all I ever had setup on my previous phones.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#198

Post by ansonhoyt » Thu, Sep 14, 2017, 4:57 PM UTC

saluki wrote: post #101

Stolen iPhones should be worthless. Apple need to create a system where stolen phones can be reported to them, Apple can then contact the owner/verify they are stolen. And then add them to a stolen list and disable calling/apps on those phones. And display an overlay on the screen THIS PHONE IS STOLEN. Every iphone would come with an validate phone feature that is accessible even when locked that can authenticate the…

Once it is reported stolen, it could capture the face of everyone who tries to access it. If you assign your police case number in iCloud, it could automatically send your police department these faces (with times and locations) to expedite recovery. With all the face databases popping up, they'll easily have a short list of people to follow up with.

Then again, this might create lots of other problems.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#199

Post by irq-1 » Thu, Sep 14, 2017, 4:58 PM UTC

joombaga wrote: post #189

n42 wrote: post #180

Earlier quoted context omitted.

On top of this, iOS 11 introduced an emergency mode that is enabled by tapping the standby button five times rapidly. It is easy to do discretely in your pocket, and it locks your phone by requiring your passcode to be entered again.

You can achieve the same effect on some Android devices by exploiting the password lock from scanning the wrong finger repeatedly.

If a judge issues a warrant allowing the police to compel the use of biometrics, can a person use the wrong finger? Courts can't compel someone enter their PIN. So can a court compel not only biometric "use" but the correct biometric?

My Android forces PIN entry after 5 wrong fingerprints.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#200

Post by irq-1 » Thu, Sep 14, 2017, 5:01 PM UTC

smelterdemon wrote: post #150

Re: the pushback the author got on Twitter; I believe in skepticism towards corporations and marketing claims, but the level of cynicism online towards any new tech idea or product seems a bit out of hand. There's a certain trend, on Twitter especially, of people racing to prove they're either more woke or smarter than the teams of people behind things that are yet to even be released. I mean a "wait and see" attitud…

"attention awareness" is Apples own description. How long before it's turned against the user to confirm "Advertisement Awareness" or EULA Awareness, etc..?