61–70 of 99 posts
We worked in biometrics like 4 years ago or so. It is trivial to defeat this "security mechanism".
We had snake oil people trying to convince us to invest in this(we are a software company), so we made a bet: If we could defeat their marvelous thing on a test they will pay all of our tester team a dinner(and go away and don't bother us again).
It was as easy as creating a prototype trainer. You record a person typing with a webcam. You make some statistics and then in 10 minutes you could train ANYBODY to copy the same behavior signature.
It took us like 2 hours to create the prototype trainer. After testing it we realized the webcam WAS NOT EVEN NEEDED, the microphone is enough.
So we used a single hidden microphone to record the people chosen by the snake oil team and ALL OF US(10 people) were able to defeat the system. Really fun for us, extremely humiliating for the snake oil people.
BTW: This man is proposing a complete keylogger of all your actions in the computer, what could go wrong?
Earlier quoted context omitted.
Don't worry, there are additional blocked domains just for that. :-)
post a copy of your hosts.conf?
Note that certain adware/spyware domains, like google-analytics( look at the tags and ), are commented out, so edit the file as per your needs.
Google's re-capthas are coming from google.com, to block them add:
127.0.0.1 google.com
127.0.0.1 www.google.com
This may be a tough choice to make, depending on how integrated has Google become with your life ( note how I phrased this relationship ).
What a huge nightmare waiting to happen. Sites already give me shit for changing my location, making me jump through additional hoops because my browser signature changed, refusing to let me purchase something because I don't access them from my home country. The last thing I need is a behavioral profiler that insists it has determined I'm not me and there is nothing I can do to prove it wrong.
True - I was thinking "what happens if I burn my finger while cooking?" It does seem like a solution looking for a problem.
I hope these services have an opt-out. I know, I know, this will get infinitely more accurate at an arbitrary point in the future, and that I won't have complaints then. But I get screwed constantly while travelling to other countries, getting repeatedly locked out of Gmail. Again, most users won't face these issues. But I don't want to live in a world where if you're not a nominal case, you're screwed. The people wh…
I wonder if younger generations use more secure passwords. I'd guess that the typical user does not.
Well, yes you can change your behavior, and no, this is not a good idea. We worked in biometrics like 4 years ago or so. It is trivial to defeat this "security mechanism". We had snake oil people trying to convince us to invest in this(we are a software company), so we made a bet: If we could defeat their marvelous thing on a test they will pay all of our tester team a dinner(and go away and don't bother us again). I…
But given I am not an expert in this field I would like to turn around and perhaps ask you, what is the bigger vision?
Surely biometrics in all sorts of shapes and forms comes with it's own issues and shortcomings.
Isn't the idea to make it good enough not necessarily 100% airtight (although I do understand that the scaleability of technology makes it the requirements many times higher than between people)?
I might not get everything right, but aren't they proposing "kind of" a keylogger as a security solution? Even the idea of using a technology for which others build products to fight against seems a bit strange. Now, admitting that everyone will use it in good faith, I'd like the fact that, by itself, it does not add another thing you need to do as a user to authenticate. But, as Paul said in his article, I only see…
http://blog.dustinkirkland.com/2013/10/fingerprints-are-user... bears repeating. If you can't change it then it doesn't make for a good passwords as there's no revocation. This sort of thing is useful as a signal when deciding if a user is who they say they are, but it's not sufficient on it's own.
It would be another thing an intruder would have to bypass, and it could be constructed loosely enough to not interfere with a normal work day. Essentially just a flag, rather than a lock-out if it detects a failure.
I imagine a suite of behavior heuristics would be something of interest to a big enterprise company.
Earlier quoted context omitted.
There are plenty of sites that allow you to change your username!
The observation that some usernames are changeable, doesn't contradict the claim that passwords must be changeable, nor does it contradict the claim that usernames need not be changeable.
What are you talking about? The comment I replied to didn't make any such claims!
> passwords must be changeable
Not necessarily. What about fingerprints?
> usernames need not be changeable
Not necessarily. What about National Insurance / Social Security numbers?
I hope these services have an opt-out. I know, I know, this will get infinitely more accurate at an arbitrary point in the future, and that I won't have complaints then. But I get screwed constantly while travelling to other countries, getting repeatedly locked out of Gmail. Again, most users won't face these issues. But I don't want to live in a world where if you're not a nominal case, you're screwed. The people wh…
I am on the glass half empty side of if user passwords will improve on a scale required. Even if you get to 90% of users using a good enough password, that still seems too low. For an average user, it is difficult to use a different password AND remember it, and that barrier probably will not change much. Many users still aren't going to start using a password safe.
The article mentions but dismisses multi-factor as degrading the user experience. But I think with the dominance of mobile devices, that providing a simple multi-factor token has become easier than carrying an RSA dongle. I find Google's use of the SMS token to be quite convenient.