Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I recommend against using biometric identification

medium.freecodecamp.org

Post reply on HN
Print view View original

21–30 of 239 posts

Re: I recommend against using biometric identification

#21

Post by metafunctor »

thresh wrote: post #16

I don't understand why what's essentially a login (fingerprint, face, dna) is considered a password. It simply isnt. And I don't understand why I cant (on Android 7) combine fingerprint and then PIN/Pattern to unlock my device. It's mind boggling and completely stupid.

Biometric data is not a username. Biometric data is also not a password.

Biometrics is biometrics. I like to think of it sitting between a continuum between "username" and "password".

I might like a setting to require both a Touch ID (or Face ID) and a passphrase to unlock my iPhone. However, Touch ID has flaked out enough times for me (not accepting my fingerprints) that I probably wouldn't like to risk it in practice.

Re: I recommend against using biometric identification

#23

Post by jayess »

blaincate wrote: post #20

Just Realized : Face recognition unlock : Biggest Security Scare - Case 1 : Imagine crossing security check or border crossing. Guards just take your phone and point it to you : UNLOCKED . No need to resis to give passwd - Case 2 : drug the activist and point unconscious victim ! Voila ! - Case 3 : Steal the phone, and change the cover and flash it in front of the real owner ! could go on and on ...

Not sure why you're being downvoted.

Re: I recommend against using biometric identification

#24

Post by sperling75 »

metafunctor wrote: post #21
thresh wrote: post #16

I don't understand why what's essentially a login (fingerprint, face, dna) is considered a password. It simply isnt. And I don't understand why I cant (on Android 7) combine fingerprint and then PIN/Pattern to unlock my device. It's mind boggling and completely stupid.

Biometric data is not a username. Biometric data is also not a password. Biometrics is biometrics. I like to think of it sitting between a continuum between "username" and "password". I might like a setting to require both a Touch ID (or Face ID) and a passphrase to unlock my iPhone. However, Touch ID has flaked out enough times for me (not accepting my fingerprints) that I probably wouldn't like to risk it in practi…

Biometrics is closer to a username.

Re: I recommend against using biometric identification

#25

Post by blahedo »

Jyaif wrote: post #22

I don't know what's up with his sample JS, a simple "Math.floor(Math.random() * 9999)" would be better.

I wondered the same thing, but this guarantees not starting with a 0, which I could imagine breaking some people's idea of what a passcode should look like.

Re: I recommend against using biometric identification

#27

Post by kenjackson »

thinbeige wrote: post #19

A good thought. Just think you get robbed. The robbers can get the phone easily unlocked withoout even asking you.

If the robbers can make me look a the phone, if they ask me, I'm going to give them my pin anyways. Its not like I'm planning on resisting giving my pin out to a robber.

Re: I recommend against using biometric identification

#28

Post by kelnos »

ubernostrum wrote: post #18
crimsonalucard wrote: post #8

Earlier quoted context omitted.

I mean, it's less plainly visible then your face, or even pictures of your face. I bet you there's an algorithm somewhere that can take a picture of your face and turn it into a 3d model. Then you can take that model, 3d print it, then use it to unlock your phone.

I'm reminded of the excellent James Mickens piece on security, where he mentions the difference between (IIRC, don't have it in front of me) securing against an angry ex, and securing against Mossad. Sure, there are entities out there who could probably crack this if they were inclined to target you. But is that truly -- and don't be hyperbolic here -- a thing that you worry about on a day-to-day basis due to actual…

So others can be lazy like I wanted to be and not have to look it up: https://www.usenix.org/system/files/1401_08-12_mickens.pdf (warning: pdf, if that matters to you)

Re: I recommend against using biometric identification

#29

Post by otterpro »

That's why I use both types of authentication / identification, and having more than 1 option is a good thing.

When in a situation where there are higher risk, such as going through certain airports or borders, or in a situation where confiscation of phones are high, just disable biometric authentication temporarily and use pin/password.

But in normal situation, where risks are low, re-enable the biometrics, for convenience. I like the ease and convenience of using phone this way when I'm at home or at work.

Post reply on HN