81–90 of 371 posts
If I can use FIDO2 on my yubikeys in more places, it would be fantastic.
Earlier quoted context omitted.
That doesn't make sense. Username + Password is a cumbersome workaround because (so far) machines couldn't use biometrics to authenticate a user. Now they can, so we can let go of that very problematic and often insecure model. Think like this, when you go to visit your grandmother and knock on her door you don't have to provide a password. You don't have to provide anything, because the human brain is capable of det…
Biometrics fails every test for a password. 1) A password is secret 2) You don't leave copies of it lying around everywhere 3) You can change it periodically 4) If discovered, it can't be traced back to you No, biometrics can only be a username. It can never be an acceptable password.
That would be a pretty quick and painless way to verify that I am, indeed, a human, with no unpaid labor involved.
I would never use this for anything sensitive. Bad actors can get your face and your fingerprint. Some of them already have it (governments, banks, Apple, Facebook, etc). And changing your face or fingerprint is practically impossible.
Apple has my face and fingerprint? I haven't heard this before and Google turns up nothing. Any source?
These all seem to be examples that use faceID/touchID as a password. That’s not what biometrics should be though, they should be the username. I hope that this is supported as a flow as well. Identify who you are with biometrics, and prove your access with a correlated password.
If the machine can prove that you are indeed you through biometric authentication, why take another step for authorization?
Earlier quoted context omitted.
"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)
> I would definitely stay away from any "Sign in with Apple". I would stay away from any "Sign in with.." service as a user and as a product owner. You're affectively giving away a major control of your users to a third party.
Has anybody ever thought about how Face ID is pretty much a backdoor into your iPhone? Think back a few years to when Apple refused to open a felon's iPhone for the US government, because "they couldn't." If that happened now, they wouldn't even have to ask Apple, given the felon has Face ID enabled. Edit: I'm kind of surprised by the downvotes, given I thought HN was pretty big on personal privacy. Just thought I'd…
Earlier quoted context omitted.
Biometrics fails every test for a password. 1) A password is secret 2) You don't leave copies of it lying around everywhere 3) You can change it periodically 4) If discovered, it can't be traced back to you No, biometrics can only be a username. It can never be an acceptable password.
It falls short, because biometrics passwords. As I said, biometrics == identity. Compare biometrics with identity: 1) Your identity is not secret. Your mother knows you, your entire school knows you, your neighbour knows you, when you go anywhere the police may ask for your ID at any time and knows you. Biometrics is the same. 2) You don't hide every day from the world. You don't cover your face (ok maybe before COVI…
I would never use this for anything sensitive. Bad actors can get your face and your fingerprint. Some of them already have it (governments, banks, Apple, Facebook, etc). And changing your face or fingerprint is practically impossible.
FaceID and TouchID both record any data they need in parts of the enclave that can't be used for anything else, and cannot be extracted. The information that they do store is not a picture, and cannot be reversed even in the case where someone does manage to get that data.
They have repeatedly documented how these features work.
Similarly touchid and faceid aren't sending your touchid/faceid data to a third party (because again, even if they wanted to, they can't), they're simply gating access to credential data on successful local authentication.
Has anybody ever thought about how Face ID is pretty much a backdoor into your iPhone? Think back a few years to when Apple refused to open a felon's iPhone for the US government, because "they couldn't." If that happened now, they wouldn't even have to ask Apple, given the felon has Face ID enabled. Edit: I'm kind of surprised by the downvotes, given I thought HN was pretty big on personal privacy. Just thought I'd…
>To use Face ID, you must set up a passcode on your device.
>You must enter your passcode for additional security validation when:
>The device has just been turned on or restarted.
>The device hasn’t been unlocked for more than 48 hours.
>The passcode hasn’t been used to unlock the device in the last six and a half days and Face ID hasn't unlocked the device in the last 4 hours.
>The device has received a remote lock command.
>After five unsuccessful attempts to match a face.
>After initiating power off/Emergency SOS by pressing and holding either volume button and the side button simultaneously for 2 seconds.