3 ms·
Something I have always pondered,...would it be more secure to request a password after the user has been identified by the system? For example,... 1. User c
by nr152522 11y ago
Something I have always pondered,...would it be more secure to request a password after the user has been identified by the system?
For example,...
1. User clicks login
2. Webcam uses facial recognition to identify the user.
3. The identified user is requested to enter their password.
In this case, I think, it is harder to impersonate the real user. I am no expert but would interested to know if anyone can see any obvious flaws or if something similar exists?
- rahimnathwani 11y agoA face is a username, not a password. I can take a picture of you and hold it up in front of the webcam. And my picture will work every time unless you decide to get surgery.
- nr152522 11y agoExactly,...the user is identified and then requested to enter a password. You are identifying the user, then you proceed to ask them a password. I.e. Identifying the user is something you are, then asking them for a password is something you know.
- rahimnathwani 11y agoThere's no improvement in security from asking for a face rather than a username.
- nr152522 11y agoWhat are the reasons? Genuinely interested as I'd like to understand in more detail.
- rahimnathwani 11y agoFor the same reason that thumbprints are usernames, not passwords: http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user... Previous HN discussion: https://news.ycombinator.com/item?id=6477505 https://news.ycombinator.com/item?id=6477505
- nr152522 11y agoI'm confused. I never stated that a users face should be used as a password. I was suggesting that their face (or other bio-info) be their username. Am I missing something?
- rahimnathwani 11y ago"I was suggesting that their face (or other bio-info) be their username." What problem does this solve?