Fingerprints Are Usernames, Not Passwords (2013) • Hacker News Board

Re: Fingerprints Are Usernames, Not Passwords (2013)

#51

Post by baffledbysmall » Thu, Oct 23, 2014, 2:24 PM UTC

I always get the sense of cognitive dissonance when I read security researches and advocates write about passwords and fingerprints. If you have access to my device, you have access to my physical person, and my physical person will freely give up any password because no secret I have is worth my life. This isn't Hollywood, I'll give up my password with even the hint of physical violence that could maim or otherwise affect my quality of life.

Fingerprint readers, as Apple uses them per device backed by a strong high entropy password, are good enough for securing the average persons access to a device.

My physical security, something much more dear to me than my secrets, is protected not by keys and tumblers, but by a 1/4 inch of glass that can be cut through in seconds with $5 from the hardware store. Even the key and lock can be circumvented with a rubber mallet and a bump key, or a set of picks. So why use them? Because locks keep honest people honest, and those looking to cause you harm will cause you harm, regardless of what digital security you use.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#52

Post by Raphmedia » Thu, Oct 23, 2014, 2:35 PM UTC

adamlett wrote: post #6

In the case of Touch ID, please consider that in order to circumvent it, you not only have to be able to fool the Touch ID sensor, you also have to have physical access to the device .

Depends. If you use Touch ID on an app, you could use your own iphone and fool its scanner.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#53

Post by 4684499 » Thu, Oct 23, 2014, 2:50 PM UTC

Passwords are not passwords, they are usernames. It's a part from the combination to identify you, while unlike usernames, it's hidden by design. Fingerprints are like passwords, they can't be easily copied and be reused somewhere else, for now.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#54

Post by Someone1234 » Thu, Oct 23, 2014, 2:50 PM UTC

baffledbysmall wrote: post #51

I always get the sense of cognitive dissonance when I read security researches and advocates write about passwords and fingerprints. If you have access to my device, you have access to my physical person, and my physical person will freely give up any password because no secret I have is worth my life. This isn't Hollywood, I'll give up my password with even the hint of physical violence that could maim or otherwise…

You cannot say that without linking to this: https://xkcd.com/538/

Re: Fingerprints Are Usernames, Not Passwords (2013)

#55

Post by clubhi » Thu, Oct 23, 2014, 2:57 PM UTC

I think fingerprint should still require a password after a duration. I'd be fine with using my fingerprint to login if I have recently logged in in the last few hours.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#56

Post by astazangasta » Thu, Oct 23, 2014, 2:57 PM UTC

baffledbysmall wrote: post #51

I always get the sense of cognitive dissonance when I read security researches and advocates write about passwords and fingerprints. If you have access to my device, you have access to my physical person, and my physical person will freely give up any password because no secret I have is worth my life. This isn't Hollywood, I'll give up my password with even the hint of physical violence that could maim or otherwise…

Jake Applebaum was detained routinely during border crossings in the early wikileaks days. They (FBI?) demanded he decrypt his hard drive for them. He refused. As far as I know they never managed to get inside. This works, at least some of the time.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#57

Post by dschiptsov » Thu, Oct 23, 2014, 3:12 PM UTC

Just no. Since old times fingerprints were used as a unique signature, not an unique id.

Unique id could be something as silly as

  sha256(concatenate(full-name,date-of-birth,place-of-birth))

or just any unique number, like cell phone number.

Again, a fingerprint or an image of a retina is a signature or password not an id or username.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#58

Post by osteele » Thu, Oct 23, 2014, 3:21 PM UTC

icebraining wrote: post #15

adamlett wrote: post #12

Earlier quoted context omitted.

A bad choice for what? Your fingerprint can only be used to access a particular device in the case of Touch ID. It is worthless if you don't also have physical access to the device. And it's a lot easier to tell if your device has been compromised because it means that you no longer possess it, in which case you can simply remote wipe it. To reiterate: Possession of your fingerprint alone does not allow someone to ac…

Your fingerprint can only be used to access a particular device in the case of Touch ID. It is worthless if you don't also have physical access to the device. Or any previous device you might have had with Touch ID. Unless you change your fingerprints when you get a new phone. And it's a lot easier to tell if your device has been compromised because it means that you no longer possess it, in which case you can simply…

> Or any previous device you might have had with Touch ID. Unless you change your fingerprints when you get a new phone.

Any previous unwired device that has not been power cycled and that was unlocked in the past 48 hours.

http://support.apple.com/kb/HT5949

Re: Fingerprints Are Usernames, Not Passwords (2013)

#59

Post by jrochkind1 » Thu, Oct 23, 2014, 3:24 PM UTC

Karunamon wrote: post #50

Something I feel that's always missed in these discussions is context: Who is the adversary you're attempting to protect against? Your kids screwing around with your phone? TouchID does the job. Random people screwing around with your phone if they find it? Same thing. Government gets ahold of it? Yeah.. notsomuch. Considering that the primary adversaries of an average smartphone user are other mere mortals, not dedi…

So this article is a year old, I don't know if Apple has managed to improve things since then.

But if it were as easy to get access as the article suggests...

I agree you take the right approach by identifying adversaries. And I agree that it's relatively reliable against kids or random people randomly screwing around. And not against governments.

But there's a whole bunch in between that. Business competitors? Ex-partners or personal enemies, motivated enough to hire a private detective or similar that can easily do this?

I think the line of "reasonable defense against" for this technology is actually probably _just barely_ above random people screwing around with your phone because it was just lying there. And there's a whole lot above that but below national intelligence agency.

Re: Fingerprints Are Usernames, Not Passwords (2013)

#60

Post by jrochkind1 » Thu, Oct 23, 2014, 3:27 PM UTC

baffledbysmall wrote: post #51

I always get the sense of cognitive dissonance when I read security researches and advocates write about passwords and fingerprints. If you have access to my device, you have access to my physical person, and my physical person will freely give up any password because no secret I have is worth my life. This isn't Hollywood, I'll give up my password with even the hint of physical violence that could maim or otherwise…

I think you take the right approach to true security risk analysis.

But there are all sorts of cases you leave out.

Someone might very well have access to your device without having access to your physical person. Because your device was lost or stolen.

Someone may very well not be willing to threaten you with physical harm, but be willing to hack your device. (Not every adversary is from a Hollywood movie either!)

Law enforcement agencies may not be legally allowed to compel you to reveal your password, but legally allowed to hack your device.

Etc.