Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID, Touch ID, No ID, PINs and Pragmatic Security

troyhunt.com

Post reply on HN
Print view View original

211–220 of 314 posts

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#211

Post by OkGoDoIt »

apeace wrote: post #177

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN This is what has been missing from every discussion of this issue that I've seen so far. The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get i…

Since I use fingerprint authentication for the vast majority of authentications with my iPhone, I set the actual pin to a complex alphanumeric password. I only have to enter it a few times a week, so it’s worth the hassle. In this sense fingerprint authentication has significantly improved the security of my phone, because it’s so much more difficult to shoulder surf that alphanumeric password that it is a 4/6 digit numeric pin. Biometric authentication definitely seems like a win to me.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#212

Post by ithkuil »

tony101 wrote: post #202
irq-1 wrote: post #199

Earlier quoted context omitted.

If a judge issues a warrant allowing the police to compel the use of biometrics, can a person use the wrong finger? Courts can't compel someone enter their PIN. So can a court compel not only biometric "use" but the correct biometric? My Android forces PIN entry after 5 wrong fingerprints.

If you refuse to tell them which finger you used, and comply by only pressing whichever finger they ask you to press, they will have a 10% chance of getting in each time. So if you chose only 1 finger and you chose it randomly, they will have a 50% chance of getting in after 5 attempts.

And hope they're biased against the middle finger

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#213

Post by justsid »

irrational wrote: post #206
irq-1 wrote: post #203

> a thread emerged about abusive spouses. Now if I'm honest, I didn't see that angle coming and it made me curious - what is the angle? I mean how does Face ID pose a greater threat to victims of domestic violence than the previous auth models? If someone has the PIN and the phone, they can get in without the person (without their biometrics.) Fingerprints and Face recognition increase the chances that an abusive spo…

I'm not sure, but I know with my spouse and I, we always put each others Biometrics into each other's devices (I add her fingerprints to my phone and vice versa), share a lastpass account so we know each other's passwords, add our email accounts to each other's devices so we can always look at each others email, etc. If you are married to someone and don't trust them enough to do the same I have to question the found…

Not trying to tell you how to live your life, but being an open book to the other isn‘t very trusting. If your trust is build around being able to spy on the other, maybe you aren‘t trusting each other that much. My wife and I both have our own separate phones and computers without each other being able to access it and I trust her not to do anything that goes against our interests and vice versa. That‘s what trust is, not having to know what the other does and knowing they are doing the right thing.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#214

Post by [deleted] »

irrational wrote: post #206
irq-1 wrote: post #203

> a thread emerged about abusive spouses. Now if I'm honest, I didn't see that angle coming and it made me curious - what is the angle? I mean how does Face ID pose a greater threat to victims of domestic violence than the previous auth models? If someone has the PIN and the phone, they can get in without the person (without their biometrics.) Fingerprints and Face recognition increase the chances that an abusive spo…

I'm not sure, but I know with my spouse and I, we always put each others Biometrics into each other's devices (I add her fingerprints to my phone and vice versa), share a lastpass account so we know each other's passwords, add our email accounts to each other's devices so we can always look at each others email, etc. If you are married to someone and don't trust them enough to do the same I have to question the found…

[deleted]

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#215

Post by lbarrett »

justsid wrote: post #213
irrational wrote: post #206

Earlier quoted context omitted.

I'm not sure, but I know with my spouse and I, we always put each others Biometrics into each other's devices (I add her fingerprints to my phone and vice versa), share a lastpass account so we know each other's passwords, add our email accounts to each other's devices so we can always look at each others email, etc. If you are married to someone and don't trust them enough to do the same I have to question the found…

Not trying to tell you how to live your life, but being an open book to the other isn‘t very trusting. If your trust is build around being able to spy on the other, maybe you aren‘t trusting each other that much. My wife and I both have our own separate phones and computers without each other being able to access it and I trust her not to do anything that goes against our interests and vice versa. That‘s what trust i…

I also let my spouse unlock my phone. It's not so much "being an open book" as it is "I trust her not to snoop, and sometimes it's convenient that she can open a map on my phone." That meets your definition of trust: not having to know what she does because I know she'll do the right thing.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#216

Post by cjbillington »

SirZimzim wrote: post #209
irrational wrote: post #206

Earlier quoted context omitted.

I'm not sure, but I know with my spouse and I, we always put each others Biometrics into each other's devices (I add her fingerprints to my phone and vice versa), share a lastpass account so we know each other's passwords, add our email accounts to each other's devices so we can always look at each others email, etc. If you are married to someone and don't trust them enough to do the same I have to question the found…

What the hell

I don't think it's completely insane, but I think the parent comment overestimates the proportion of marriages that have that kind of trust. If people didn't get married without 100% trust then most people wouldn't be married, and evidence is that people prefer imperfect relationships to loneliness.

It's also useful to have a norm against doing these things even if you have 100% trust, because it's probably the case that people are too readily fooled (by themselves or a manipulative partner) into thinking they have 100 % trust when they actually don't. So having a norm against sharing everything protects the people who need it, even if you're not among those people.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#217

Post by gist »

apeace wrote: post #177

> ...when you do use the biometric options we're about to get into, you're still going to need [a pin] on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN This is what has been missing from every discussion of this issue that I've seen so far. The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get i…

I don't want to be that 'if you've got nothing to hide then' guy but why are people so worried about what border agents in particular will see on their cell phone?

I am not saying that I wouldn't mind at all if my phone was searched. But I can't think of anything in particular that I would be concerned about if it was. Sure in theory the agent could remember some personal information and come back later and use that info or pass it to someone for some nefarious purpose. But that's a pretty small chance event. It's more or less the equivalent of thinking you will get sick because you find a hair in your food at the restaurant. You don't like it and you send it back or demand a refund but the actual harm is more mental in nature.

Or what am I missing here?

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#218

Post by eanzenberg »

Jeremy1026 wrote: post #208
pertymcpert wrote: post #190

Earlier quoted context omitted.

Customs can do that anyway if you have a password.

Constitutionally, an individual can not be forced to enter a password for law enforcement (including customs agents).

That's the point, "constitutionally" while they lock you up for hours/days on end to obtain the warrant needed to give up your password unless you are willing to stay locked up.

Re: Face ID, Touch ID, No ID, PINs and Pragmatic Security

#220

Post by irrational »

mulletbum wrote: post #142
kfriede wrote: post #126

Earlier quoted context omitted.

I think he's requesting it on the system level. For example, if iOS allowed you to force PIN+TID when opening a specific (not necessarily secure) app for the first time after an unlock. Intended for apps that don't necessarily have security built in already.

This is especially useful for when the app developer doesn't think there is a reason for them to develop such a system. For example, I don't want my son playing a zombie game, but I myself play it often. I could then lock him out of said game, but still give him my phone to use.

This isn't exactly what you are looking for, but have you tried Guided Access on iOS (or whatever the equivalent is on Android)?
Post reply on HN