51–60 of 138 posts
Earlier quoted context omitted.
Something I’ve wished companies would do: publish (on an internal site) all of their employees’ previous passwords each time they’re rotated. Users would be compelled to create better passwords out of sheer embarrassment/competitive spirit.
You want companies to store passwords in plain text?
Earlier quoted context omitted.
My country has my fingerprints because I have an id document like everybody else. A number of states around the world have my fingerprints too because I entered those countries as tourist and I had to put at least one finger on a reader. Maybe some country included mine also have my retina scan, I had to look into some cameras sometimes. All those biometric information could be leaked, sold by corrupt civil servants…
>All those biometric information could be leaked, sold by corrupt civil servants or exchanged with other countries so random passwords generated by a password manager protects me more than biometric information. Am I wrong? I know of zero biometric implementations where your biometric data is uploaded to the server for verification. All the biometric implementations I've seen (windows hello, icloud passkey) perform b…
Some rules of thumb: All Windows passwords shorter than about 10 characters shouldn't be considered secure, as the NT Hash at this point is so easily reversible that it's basically a "light obfuscation" at best. A single GPU can crack all 8-character passwords in minutes. The single best security setting on a Windows network is to increase the minimum password length to something like 14 characters. Use 20+ for privi…
i am forced to use windows machines in my own office. i know people and kids who use windows machines. with new installs, they are being taught to set a password, which is fine for a bank or a super secure machine that holds financial data but for kids and grannies and drone office workers, this gets tiring. Now you are saying to FORCE them to use 14+ characters. HOW? why? in linux there is a "auto login with this pa…
Newer computers also usually come with a TPM, which allows you to not have to type the password every time. If the PC doesn't have a fingerprint reader [0], it can use a shorter PIN.
---
[0] I know a fingerprint isn't a password, but for protecting low-profile individuals who aren't a target for actual data theft (as opposed to opportunistic old-fashioned property theft) it's likely good enough.
Hey, I keep seeing people claim biometrics somehow fix the password problem, but I feel like this is just a password you can't change? I can't change my fingerprints nor my retina, but if that data ever gets leaked, then that's vulnerable forever? In my mind, there's no world where one could make a biometric scanner that couldn't be spoofed (presumably with an arduino USB interface) and then when all these corporatio…
It’s also more secure than a password on a phone because if you’re using it in public someone can watch you type your password in.
Of course, someone might be able to clone your head shape.
Sounds exactly like the advice an offline cracker would give. ;)
Hey, I keep seeing people claim biometrics somehow fix the password problem, but I feel like this is just a password you can't change? I can't change my fingerprints nor my retina, but if that data ever gets leaked, then that's vulnerable forever? In my mind, there's no world where one could make a biometric scanner that couldn't be spoofed (presumably with an arduino USB interface) and then when all these corporatio…
Hey, I keep seeing people claim biometrics somehow fix the password problem, but I feel like this is just a password you can't change? I can't change my fingerprints nor my retina, but if that data ever gets leaked, then that's vulnerable forever? In my mind, there's no world where one could make a biometric scanner that couldn't be spoofed (presumably with an arduino USB interface) and then when all these corporatio…
iPhone biometrics can’t be faked because the sensors can’t be moved between devices, each Face ID sensor uses a different random pattern, etc. It’s also more secure than a password on a phone because if you’re using it in public someone can watch you type your password in. Of course, someone might be able to clone your head shape.
This is from 2005:
> Police in Malaysia are hunting for members of a violent gang who chopped off a car owner's finger to get round the vehicle's hi-tech security system.
http://news.bbc.co.uk/2/hi/asia-pacific/4396831.stm
I guess this is a question of threat model. I hope nobody would want to chop of my head just to unlock my iphone. But this always reminds me of the scene in "Demolition Man" where Wesley Snipes spoons out someone's eyeball to open the biometrically locked door of his prison.
Earlier quoted context omitted.
My country has my fingerprints because I have an id document like everybody else. A number of states around the world have my fingerprints too because I entered those countries as tourist and I had to put at least one finger on a reader. Maybe some country included mine also have my retina scan, I had to look into some cameras sometimes. All those biometric information could be leaked, sold by corrupt civil servants…
>All those biometric information could be leaked, sold by corrupt civil servants or exchanged with other countries so random passwords generated by a password manager protects me more than biometric information. Am I wrong? I know of zero biometric implementations where your biometric data is uploaded to the server for verification. All the biometric implementations I've seen (windows hello, icloud passkey) perform b…
However, even worse than that, your fingerprint in particular is something you leave literally everywhere you go. There was even a demonstration of someone copying Gerhard Schroeder's (German PM) fingerprint from a still photo of him from a bottle he had touched, and then creating a mold which fooled a sensor they had access to.
Hey, I keep seeing people claim biometrics somehow fix the password problem, but I feel like this is just a password you can't change? I can't change my fingerprints nor my retina, but if that data ever gets leaked, then that's vulnerable forever? In my mind, there's no world where one could make a biometric scanner that couldn't be spoofed (presumably with an arduino USB interface) and then when all these corporatio…
> but I feel like this is just a password you can't change Not quite. IBM has (had?) a research program on "cancelable" biometrics. I do not recall perfectly, but I think they were tweaking the encoded biometric sensor data before committing it to DBs. If there is a leak, one can redo it with a new tweak (like a new salt or nonce).
> Instead of passwords, we should use something like FIDO, which allows users to log in using a security key or biometric information. The problem "in the real world" is that people will lose these keys all the time . I mean, I agree, passwords need to die, and hopefully some of the work that is being done by Apple and others will help bring on an end to passwords, but you can't really talk about replacing passwords…
We have the following: Authenticator app, HID card, or FIDO key. Biometric is coming but the goal is to not have to give people yet another reader/device. In theory we wouldn't have to worry about someone losing their card or key but they don't always setup all three in their account.