5 ms·
My worry is that this is a gateway drug to "Fingerprint protect all the things!" My bank emailed me the other day with an announcement that I could access my a
by chrsstrm 11y ago
My worry is that this is a gateway drug to "Fingerprint protect all the things!"
My bank emailed me the other day with an announcement that I could access my account through their app via my fingerprint. WTF? My text messages are one thing by now my money is protected by just my fingerprint? I took my bank to task because they allowed my username to be twice as long as the allowed characters in my password. Someone at the bank said, "Hey, all these new-fangled phones have fingerprint readers, why don't we tap into that and sell it as a feature?" When everyone is doing it, no one is going to stop and ask if they should, it's just a race to incorporate the newest features. Normal people aren't asking if this is secure, they are buying into the marketing copy pushed on them, so they start thinking that it has to be secure, because why would my bank not have my interests in mind?
- zuppy 11y agoFair point, it should be used for convenience, not for real security.
- tgb 11y agoWhat can the bank app do? Mine can only deposit and view accounts, not withdraw or transfer. Open access to it would be weird, but not much worse than someone fishing my ATM receipts out of the trash to see my balance.
- chrsstrm 11y agoIt's Bank of America, so it's about as feature-filled as a banking app gets. You can do all the normal stuff like check balances and deposit checks, but you can also open new accounts (including credit cards) and transfer money (between other accounts you own or to other people outside the bank). And yes, the app has the ability to add new transfer recipients, which only needs their email address or phone number. There is a protection to guard against unauthorized adding of new recipients, but you guessed it, the protection is in the form of a 2FA code sent via SMS. So if you're already in the phone and in the banking app you can add yourself as a transfer recipient with your email address and verify the recipient addition because you can read the incoming text messages too. And the warning email that comes when you add a new recipient and initiate a new transfer is likely going to come to the same phone you're currently holding. If you get into my banking app through my phone you can send yourself as much of my money as you want and cover your tracks so I wouldn't know until my next statement comes, and to top it all off, it looks like I was the one who sent the money to you, so how am I going to argue that I didn't?
- branchan 11y agoThe bottomline is that if someone can hack a server to steal your fingerprint, they can just as easily use the same method to steal your method so I don't really see the differen imho.
- nileshtrivedi 11y agoExcept that you can't choose a different fingerprint for each app/site. Lose it once and all your accounts are compromised.
- branchan 11y agoAll the apps that I use give me the option to not use fingerprint login.
- TechieKid 11y agoThe bottomline is that someone doesn't need to hack a server to steal your fingerprint, you leave those everywhere you go as virtual gifts to any passers-by. All they need to do is steal your phone, and that's pick-pocketing level easy.
- branchan 11y agoUmmm, if I lose my phone, I'm just going to remotely disable it so there's no way the person who stole my phone can reach my data.
- bostik 11y agoSo, you're using full-disk encryption on your phone and the remote kill switch flushes the key? Otherwise the data is still there in the plain, accessible by anyone who can read the flash.
- EwanToo 11y agoIf you're using a Nexus 5X or 6P on Android 6, then probably yes. Android 5 has full disk encryption but was disabled by default on the Nexus 5 (and most other phones) due to performance issues.
- wisty 11y agoYeah, no-one will steal your fingerprint, just like no-one will crack a reasonably strong password. But if every site has a copy ...
- SideburnsOfDoom 11y agoIt's quite possible that your fingerprint has already been stolen http://www.theguardian.com/technology/2015/sep/23/us-government-hack-stole-fingerprints http://www.theguardian.com/technology/2015/sep/23/us-governm...