Fake fingerprints can imitate real ones in biometric systems

>That the phone is a physical token that you need in order to unlock the phone? I guess that's true, but it's a weird way of describing it versus just calling the fingerprint a single factor used to unlock the physical device.

No, it's an important (and interesting I think) difference. Compare to many of the systems you deal with otherwise: with most of them the specific physical thing you're using to access the data isn't that (or at all) relevant. With your HN account for example, if the password were known then it doesn't need to be access from one of your devices. Nothing of yours needs to be physically possessed. You could say storage on one of your computer systems would require more physical access, and that might sort of be true (there are gradients in all these things), but from a pure technical perspective general practice has been, even with full disk encryption, that the password is still the root. For software FDE the password is generally going to go through a key stretching algorithm to turn it into something cryptographically usable and add some resistance to brute force of so-so keys as well as time/memory tradeoff attacks (rainbow tables), but it's a deterministic process. If you know the password, the key can be generated, including if the drive was pulled and put into another system or imaged onto some other piece of hardware entirely. Getting access to the data may present challenges depending on where is (local could be harder then an attached drive which might be harder then a LAN volume, or the reverse). But once that data is acquired, knowledge of the password is sufficient.

But with a good smartphone (and starting to be more in computers via HSMs or built-in like Apple's T-series of chips) it'll instead be that the authentication factors go to a blackbox dedicated security chip, and that then handles keys which are entangled with hard burned-in data specific to that device. You cannot pull the storage or image it then unlock it, knowing the user's password is insufficient. For any data using that phone's hardware security as its root, you must go through that specific, physical chip regardless of any knowledge of biometrics or passwords. It is an integral part of the data security in a way that is not yet typical for traditional systems (let alone online). As far as I know all of those systems still have a password as one way to authenticate to them, with biometrics being another, and in principle they could make use of further automatic sensors too as well as do interesting things like require different authentication factors for different operations, or enable powerful anti-coercion features.

Of course, it also means if that chip ever has any trouble or gets lost better hope to have backups because otherwise you're hosed, no recovery is possible even if the physical storage is completely fine and all the encrypted data is right there.

So "what you're getting access to" is the data and operational capability of the phone, but "how you do so" is going through a "separate physical token authenticated by another a 2nd/3rd factor" (the hardware security chip), no different then if you had a USB HSM you plugged into your PC and made it a blackbox requirement for data decryption or certain operations like signing. Just because the connection between the separate token and what you're accessing happens to be direct solder and traces on a motherboard vs USB or PCIe or whatever doesn't mean it's not a separate factor here. And as it's the physical token intermediating even total compromise of the system to be accessed doesn't by itself mean biometrics or passwords leak either.

Not pedantic, it's exactly the issue. Single word dismissals are intellectually dishonest and particularly inappropriate for HN.

> They are. My grandmother in particular cannot handle such a thing. At all. This exactly the sort of dismissive tech myopia that comes from people who get too deep into the tech trenches and lose sight of huge swaths of the general population. It's very easy to take for granted the huge amounts of meta knowledge and mental models of abstract systems people like us possess. With those as frameworks lots of things make total sense that are utterly confusing to those without them, even ignoring sensory trouble.

The advantage of using a sentence as password is that it is easy to remember. The advantage of using a password manager is that you only need to remember one strong password. The strong password can be remembered as a picture (like correct horse battery staple) which is a very strong way to remember anything. Tricks like paintings and books can be used instead of sticky notes.

With touchID and faceID an adversary can force you to cooperate, and they also have false positives. IIRC with FaceID it was 1 in 1.000.000. TouchID weaker. Non-Apple implementations likely even weaker. It takes longer to break said password with full knowledge (53 bit entropy). It didn't even have fancy things such as capitals or different separators.

Plus, I never said I only use a password; I use 2FA. A YubiKey with TOTP or whatever can be revoked. The government doesn't have a copy of it, it isn't stored in my ID card either. It is mine, and mine only.

> Really? Seems a lot easier: there that person is hunting and pecking (you don't think touch typing even is universal do you?) in public, hard of hearing and totally focused on that, while someone else stands behind them and just watches. Even assuming there are no cameras looking down of any kind around of course. Using words like you suggest makes it even easier, if you know each section is a real word then even missing parts will make it easy to fill in the blanks, heck just hearing it would be plenty to narrow the search space. Or how about using WiFi transmissions directly to recognize keystrokes ("Keystroke Recognition Using WiFi Signals": https://www.sigmobile.org/mobicom/2015/papers/p90-aliA.pdf )?

TEMPEST and such is a different problem. I don't recommend WLAN in secure environments. Cameras are a reason why I recommend 2FA.

> That's why we read all the time about the vast gangs using harvested finger prints and 3D face scans to unlock iPhones, but have never read about shitty PINs getting brute forced or people reusing passwords or password reset mechanisms getting abused because people forget them all the time or password databases getting leaked or...? Yeah, passwords are certainly the best!

We've read about fingerprint identification and facial recognition being cracked. It isn't a matter when touchID and faceID are cracked; the question is when. The password I mentioned, if inputted securely, has high enough entropy to remain secure longer than touchID and faceID are.

PIN has very weak entropy, and using your password in public is a bad idea.

> Right back at you. Your comment comes across as a typically dismissive, smug put down of the needs and requirements of large portions of the our fellow humans who do amazing things but just not in our specialty. And it's an attitude that has actively harmed security.

You are projecting.

I would describe the difference in a much more simple way:

For the security of my Gmail account you need 1) password, 2) TOTP code, 3) an internet connection to Google

For the security of a physical place like my house, you need 1) key, and 2) physically be at my house. The being at my house part is more analogous to having an internet connection than another authentication factor.

The phone as a material object follows a threat model like my house. If someone has a copy of my fingerprint and is physically at my phone that's like having a copy of my house key and being at my house.

It's true that someone in China can't remotely break into my phone with the fingerprint, just like someone in China can't take a copy of my house key and steal my television.

So yes, there's security value in needing physical proximity, but I think it's a stretch to describe it a second authentication factor.

How the secure enclave and encryption works is immaterial to the fact that if I leave my phone sitting on my desk, you only need one thing to get to my data, and it's a fingerprint that for all I know someone pulled off of a Starbucks cup 10 years ago after I tossed it into a rest stop trash can, and my only option to avoid that is "disable the fingerprint scanner" because it's a single authentication factor that I physically cannot change, unlike a leaked password.

Anyway, I think we agree on how it works, we're just arguing over the semantics of how to describe it.

im sorry it doesnt make sense to you. when you said, "thats's not what usernames are" it became clear it's a linguistic issue.

you are defining terms one way and i have defined them another way (that's fine) so that is why we cannot come to agreement on any corollary.

the distinction is that you are sticking to the "formal" definitions, while i am using "functional" definitions.

we agree (troll test #1) that auth factors can come in 3 flavors (for the 100th time): something you know, something you have, and something you are. according to this definition, a fingerprint goes into one bucket ("are") and a password goes into another bucket ("know"). peachy. BUT, fingerprints are also something else: GREASE. grease left on a handrail doesnt fit into any of these buckets. that doesnt mean its not a fingerprint!

do you see the point? if you can appreciate that, and look at my comments through this lens, they might make sense. functionally, programmers are free to use "usernames" QUA "passwords" if they want to -- we can't just define that out of existence.