4 ms·
>it's something different from both, with its own unique properties. No, it's a username that is physically tied to the user. If I can get that data (fingerpri
by Intermernet 11y ago
>it's something different from both, with its own unique properties.
No, it's a username that is physically tied to the user. If I can get that data (fingerprint) then I don't need to go through the usual rigmarole of password hacking.
Fingerprints are literally "one factor auth".
- mikeash 11y agoThat doesn't mean that they're usernames. You can say this about passwords too: if you can get that data (password) then you don't need to go through password cracking, and they're literally "one factor auth." Consider an example. Imagine if HN authenticated based only on the username. Could you get into my account? Now imagine if HN used fingerprint authentication. Would that make it harder?
- semi-extrinsic 11y agoYour analogy only works if usernames were stored in a secret database, not displayed publically.
- mikeash 11y agoWhy?
- semi-extrinsic 11y agoBecause this is the assumption behind using fingerprints as authentication.
- mikeash 11y agoThat's my whole point. Usernames are public info, passwords are private, and fingerprints occupy a weird in-between world where they're sort of public but difficult to obtain and difficult to use if you're not the one whose fingers they're on.