11 ms·
Fingerprints are Usernames, not Passwords (2013)
- fweespee_ch 11y agoI'm glad to see this post getting upvoted because I've had to argue with people repeatedly on HN who claim its private / a valid authentication factor. Look folks, maybe as part of some second or third factor it might be okay...but you still need a password.
- kobayashi 11y agoPeople on HN have actually argued that "its private / a valid authentication factor"? I'm rather surprised. To me, this seemed like a longstanding given (in this community).
- derekp7 11y agoCommon security practices define authentication factors as: 1) Something only you know [password], 2) Something you have [hardware security token], and 3) something you are [fingerprint, iris scan, etc]. And you should need at least two of these to authenticate to a system.
- revscat 11y ago> I'm glad to see this post getting upvoted because I've had to argue with people repeatedly on HN who claim its private / a valid authentication factor. No, you didn't. There is nothing in your history regarding this subject, except for this post.
- USAnum1 11y agoTo give them the benefit of the doubt, it's possible they've made a new account (45 days old isn't too much tenure). Heck, I've done it, since it's probably not the best to create a digital repository of all my opinions!
- dave2000 11y agoI create a new account on every site I use roughly once a year. I've no interest in reputation and there's no way to gain from keeping one account going. I know I'm not alone in doing this.
- fweespee_ch 11y agoDid you bother to read the posts where I offered old accounts and/or the fact I cycle through accounts? https://news.ycombinator.com/item?id=11440951 https://news.ycombinator.com/item?id=11440951 https://news.ycombinator.com/item?id=11377425 https://news.ycombinator.com/item?id=11377425 I mean if you are going to accuse me of being a liar, you may want to at least check to see if I mentioned having other accounts first. Also, you may want to consider the OP was posted in 2013 to HN and I've said publicly I've been around on and off since 2010.
- colinbartlett 11y agoCan a mod please add "(2013)" to the title?
- colinbartlett 11y agoPrevious discussion: https://news.ycombinator.com/item?id=6477505 https://news.ycombinator.com/item?id=6477505
- UncleSam 11y agoThis article has been discussed in the past (about 2 years ago). https://news.ycombinator.com/item?id=6477505 https://news.ycombinator.com/item?id=6477505 I think that fingerprints are fine for low security things, but I would never use it as authentication for anything that touches my bank account.
- gpvos 11y agoHas become relevant again because of this post: https://news.ycombinator.com/item?id=11548414 https://news.ycombinator.com/item?id=11548414
- abritishguy 11y agoAs a factor in a multi-factor authentication scenario it is pretty good.
- cfieber 11y agothat makes sense since my voice is my passport. [verify me]
- ryanlol 11y agoIs this not completely obvious?
- phasmantistes 11y agoIt's not, not to much of the general populate. This has been reinforced by decades of science fiction in which fingerprints or handprints get characters access to secure resources. It's also been reinforced by Apple's messaging about the fingerprint reader on recent iPhones: it replaces a pin or password, and so people think of it as a password as well.
- acbabis 11y agoNot saying I disagree, but a layperson paying attention to a sci-fi movie could figure this one out on their own. How often does the protagonist circumvent the fingerprint scanner with a) A piece of tape, or b) the hand of the armed guard who was standing right next to the scanner?
- 794CD01 11y agoYou say that as if "secure until I'm dead" is not good enough for 99.999% of people.
- acbabis 11y agoWhat makes you think I care about Henchman #752? His boss is the one who has to suffer the consequences of his stolen fingerprint.
- 794CD01 11y agoBut he no longer has to care what his boss thinks.
- masterzora 11y agoIn the case where you're using a fingerprint unlock for your own phone, you are both Henchman #752 and the boss.
- deleted 11y ago[deleted]
- xyzzy4 11y agoFingerprints are more like your SSN. You shouldn't trust anyone to store them and not share them.
- maxerickson 11y agoThat's the wrong way around though. It shouldn't be the case that there are consequences for me if someone else presents my fingerprint or SSN. They obviously aren't secrets, knowing them shouldn't be treated as authentication. (I guess if you have a human watch someone use a tamper resistant fingerprint reader you have accomplished some degree of authentication)
- dlandis 11y agoflagged. redirected to spam site when visiting this site on mobile.
- xoa 11y agoThis article was and remains wrong, and at least in the comments so far most people appear to be missing the point, which in turn weakens security. Biometrics are neither user names nor passwords, they're a perfectly valid factor (along with something you know and something you have) with their own strengths and weaknesses vs various threat models. One of the most absolutely fundamental mistakes that can be made with security is sacrificing the good at the alter of the perfect, because overall security is always, 100% of the time an economic equation, a time/resource expenditure tradeoff between an attacker and defender for a given value of information. "Security" as a field also exists almost exclusively for the benefit of and requiring interaction with humans, which means that the human factor must always be a fundamental consideration as well. Or more pithily, a "security" system is garbage if its users can't use it, won't use it, find it too easy to screw up, or even if the costs it imposes are greater then the benefits provided. Biometrics, including finger prints, are human friendly, and that instantly makes them worthy of consideration as part of a system. Touch ID or the like can enable a person to use an extremely strong password that would otherwise be completely uneconomic, and the combination of a limited time, extremely fast biometric shortcut with a very strong core password, particularly if combined with coercion code use (only possible for now via jailbreak but something Apple or another manufacturer could and should implement at all levels), remote lockout (long available everywhere), etc., may be significantly better then merely a PIN code alone. Threat models cannot be ignored for a security system, because they define the system. The greatest threat most people face are remote attacks, with the next greatest being scatter shots of various sorts (in other words, somebody was looking to steal or attack a device, not your device in particular). Persistent targeted threats are an entirely different situation and a password alone is not even necessarily better in a mobile scenario, because in a mobile scenario you often do not have even a modicum of control over your environment. A fingerprint might be possible to lift and use as the author links, but a PIN code or password can be taken, often even more easily, via shoulder surfing or cameras. In fact in the modern first world environment bird's eye view (ceiling/pole-mounted etc) surveillance cameras are becoming ever more ubiquitous and ever higher resolution. Are people going to seriously suggest nobody use their mobile device anywhere with a surveillance system? More and more, how will you even know that? Taking advantage of the ever increasing cost/performance/size/power improvements powered by the smartphone revolution, retailers are interested in ever more camera use not for thieves but for metrics, to figure out exactly what shoppers are doing down to precisely what they're looking at and for how long. The retailers of course have no interest in your phone info, and in fact an interest in not making people worried about that sort of thing. But if we're going to consider someone going to the specific trouble to rapidly spoof biometric identity for a specific device, then it's necessary to consider that once the cameras exist at all access for non-intended purposes may be just a hack or national-security-directive away. Basically, it's frustrating to still see people pointing to "somebody broke into this security system!" as if it means anything without thinking about the time/resource cost and threat model. Biometrics absolutely have a role to play in general authentication for the general population for the foreseeable future. There are paths for improvement there just as in other areas, perhaps culminating in fusion technologies like security authentication implants wired into our brains someday, but we'll need functional authentication to get us that far and passwords alone do not cut for most of the population as currently implemented.
- newman314 11y agoWhenever this topic comes up, I always think the following is a useful read. https://technet.microsoft.com/en-us/library/cc512578.aspx https://technet.microsoft.com/en-us/library/cc512578.aspx
- SlySherZ 11y agoI think he has a point, but do we really have better alternatives? Soon enough computers will be able to check every possibility for passwords as big as we can remember them. With good algorithms predicting what is likely to be a valid password, maybe they already can. Even though I agree fingerprints aren't a good solution, passwords aren't either. Any ideas? Maybe we could have some kind of card that would have big keys stored on it. EDIT: Fixed missing word
- _ZeD_ 11y agoStart using phrases as password. Mix languages.
- egypturnash 11y agoTyping out a lengthy phrase on a phone keyboard, without being able to see any visual feedback because the letters are replaced with dots, is an exercise in frustration. I do this on a regular basis because I have an entire sentence as my LastPass passphrase.
- pmontra 11y agoI do the same with keepass. I think it's the best we can do now.
- egypturnash 11y agoI usually hit the "make visible" button on LastPass' password entry slot, to be honest. I usually make sure nobody's got a good view of my phone when I do this. Usually. I should never become a spy, my security technique is laughable.
- deleted 11y ago[deleted]
- e12e 11y agoThere are a couple of things here: I think the most important is that without rate-limiting, there are no such things as passwords. There can only be passphrases. That is, if "something you know" is a shared secret, it need to be high entropy, effectively around 128 bits. That's much harder than most people think. You could probably make a list of 256 common, short words that are distinguished by their first two letters[1], but to encode 128 bits of entropy, you'd need 19 words, (or 16 if you managed to get use 512 words). Even if you picked only the first two letters, that's best case 32 characters. It's a lot to type blind, it's a lot to remember, it's complicated to cycle the phrase. So it's better to not have to remember the password - use a password manager. Or, if you could somehow avoid the possibility of off-line attack, and guarantee solid rate-limiting -- much less entropy might be needed. A 4-digit pin is probably on the low side (consider that on a site with ~100.000 users, if you tried any set of three pins, you'd probably compromise many accounts, assuming uniform distribution of pins). Another way, is to continue using a shared secret, but prove knowledge in a different way: eg using TOTP[2]. On the other hand, TOTP shares some of the disadvantages of unsalted passwords: the secrets are stored in plain text both on your one-time token generator (your insecure smartphone), and on the server. On the other hand, they're harder for most users to re-use than passwords are (users typically don't know the secret used to generate one-time passwords). But all these have another problem: how to you protect your secrets? You could use full disk encryption... protected by ... a password? Still, the idea of using a fingerprint for authentication, especially on a device filled with your fingerprints seems like a pretty bad idea. Never mind the fact that once compromised they can never be changed. As for your last point, I do think the combination of something like a yubikey neo[3] along with NFC is probably the sweetspot for practical security right now. You can use it to unlock your smartphone, and your computer. [1] (26^2=512, but not all combinations are common, fitting 256 should probably be possible, even if the more common combination of vowel+consonant is only ~6*20=120. Possibly in combinations with the numbers 1..99) [2] https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_A... [3] https://www.yubico.com/products/yubikey-hardware/yubikey-neo/ https://www.yubico.com/products/yubikey-hardware/yubikey-neo...
- ShinyCyril 11y agoMy background is in EE, so forgive me if this is a stupid question. Are there any cryptographic hash functions which support a closeness metric? Having written that out, it seems that such a thing would be contradictory, as to be able to compute their closeness would give information away about their nature and thus make them possibly reversible.
- MattSteelblade 11y agoThat is correct, it would be contradictory. Fingerprints are un-hashable in that sense.
- JadeNB 11y agoI am also no expert, but I am not sure that I agree with MattSteelblade (https://news.ycombinator.com/item?id=11550845 https://news.ycombinator.com/item?id=11550845). There is certainly such a thing as homomorphic encryption (https://en.wikipedia.org/wiki/Homomorphic_encryption https://en.wikipedia.org/wiki/Homomorphic_encryption), which allows one to perform transformations on encrypted text without being able to decrypt it. As long as one of the transformations that can be performed is a measure of closeness (which is certainly the case for fully homomorphic encryption (https://en.wikipedia.org/wiki/Homomorphic_encryption#Fully_homomorphic_encryption https://en.wikipedia.org/wiki/Homomorphic_encryption#Fully_h... )), and as long as you know the ciphertext of the possible numerical responses, then you can read off closeness without being able to decrypt the hash. The emphasised bit is a drawback, but it demonstrates the theoretical possibility; and, although I don't know of an implementation, nor do I see anything inherently contradictory about a (non-reversible) system designed intentionally to reveal closeness information.
- taejo 11y agoWhat you're looking for are "fuzzy extractors".
- joefkelley 11y agoOff the top of my head, it would at best severely weaken the strength of the hash function. Instead of having to brute force to find an output that matches exactly, you would only have to brute force for one that was sufficiently close, then use a greedy search to move from there to the actual key. The stronger you make the "closeness" guarantee, the weaker the function becomes to this kind of thing.
- SFJulie 11y agosince fingerprints are "measured" they MAY be usernames. Damn errors, and false positive refusing to let stuff be non ambiguous. And, like everything that can be measured ... it can be duplicated... without the knowledge of the owner of the metric. Damn analogic world refusing to enter the modern didgital world. (pun digit = finger in latin)
- Aloha 11y agofingerprints are UUIDs, not either usernames or password.
- awqrre 11y agoif the connection is encrypted, a UUID is much closer to a password then a fingerprint
- alexnewman 11y agosomething you have, something you know, something about you. Nothing has changed in 40 years. The key is making them reputabiable. It's hard to get new fingers.
- Amiga64 11y agoMy problem with all biometric authentication mechanisms are "what do you do when your fingerprint/eye/face signature is stolen?" Since these are non-replacable signatures they are vulnerable as they can't be replaced.