5 ms·

That's not a complete complaint. If the password were your brainwaves, why would you still need to reset it? Did someone else steal your brain and you need to m

by 794CD01 10y ago

That's not a complete complaint. If the password were your brainwaves, why would you still need to reset it? Did someone else steal your brain and you need to make sure they no longer have access?

JoshTriplett 10y ago
> Did someone else steal your brain and you need to make sure they no longer have access? Password databases get compromised all the time; so would a "brainprint" database. You can change a password.
- Lx1oG-AWb6h_ZG0 10y ago
  That's what one-way hash functions are for. You never store the raw fingerprint data, just its unique salted hash so the data cannot be reused elsewhere.
  - Vraxx 10y ago
    It only takes one case of blatant disregard by a trusted source to spoil the entire process. What do you do when the scandal leaks that X Co didn't do due diligence and now 100 million of their customer's brainprints are leaked and able to be compromised?
  - heffo 10y ago
    That's the same reasoning for text passwords, yet there are huge password dumps every year. It only takes one place where security standards aren't implemented properly to have your print leaked forever. Never mind a malicious user managing to alter the code to leak the print before it's hashed. Or even someone physically accosting you and retrieving a brain scan. They could do the same thing and force you to give up a password, but at least the password you can change later on.
    - JoshTriplett 10y ago
      > Or even someone physically accosting you and retrieving a brain scan. They could do the same thing and force you to give up a password, but at least the password you can change later on. For that matter, a password is always your choice to reveal or not, taking the cost and alternative into account. Biometric information isn't.
    - SEJeff 10y ago
      Or messing with the RNG so that the salt isn't actually random. That would never happen :)
  - deleted 10y ago
    [deleted]
eli_gottlieb 10y ago
Security measures are going to have to deal with situations where people are potentially acting under compulsion and need plausible deniability.
- 794CD01 10y ago
  No they don't. American credit cards handle it the right way already with minimal technology around security. Make a good-faith attempt to validate, but generally treat the transaction as legitimate. If it was not, help law enforcement investigate, and make the compromised party whole as a cost of doing business. Bonus points if you can extort that last part from your vendor in the contract you have with them.

by 794CD01 10y ago

That's not a complete complaint. If the password were your brainwaves, why would you still need to reset it? Did someone else steal your brain and you need to make sure they no longer have access?

JoshTriplett 10y ago

> Did someone else steal your brain and you need to make sure they no longer have access? Password databases get compromised all the time; so would a "brainprint" database. You can change a password.

Lx1oG-AWb6h_ZG0 10y ago
That's what one-way hash functions are for. You never store the raw fingerprint data, just its unique salted hash so the data cannot be reused elsewhere.
- Vraxx 10y ago
  It only takes one case of blatant disregard by a trusted source to spoil the entire process. What do you do when the scandal leaks that X Co didn't do due diligence and now 100 million of their customer's brainprints are leaked and able to be compromised?
- heffo 10y ago
  That's the same reasoning for text passwords, yet there are huge password dumps every year. It only takes one place where security standards aren't implemented properly to have your print leaked forever. Never mind a malicious user managing to alter the code to leak the print before it's hashed. Or even someone physically accosting you and retrieving a brain scan. They could do the same thing and force you to give up a password, but at least the password you can change later on.
  - JoshTriplett 10y ago
    > Or even someone physically accosting you and retrieving a brain scan. They could do the same thing and force you to give up a password, but at least the password you can change later on. For that matter, a password is always your choice to reveal or not, taking the cost and alternative into account. Biometric information isn't.
  - SEJeff 10y ago
    Or messing with the RNG so that the salt isn't actually random. That would never happen :)
- deleted 10y ago
  [deleted]

eli_gottlieb 10y ago

Security measures are going to have to deal with situations where people are potentially acting under compulsion and need plausible deniability.

794CD01 10y ago
No they don't. American credit cards handle it the right way already with minimal technology around security. Make a good-faith attempt to validate, but generally treat the transaction as legitimate. If it was not, help law enforcement investigate, and make the compromised party whole as a cost of doing business. Bonus points if you can extort that last part from your vendor in the contract you have with them.