5 ms·
Identity should never be used as a password. Identity cannot be changed if compromised. As a second form of authentication it is fine, but as a single form al
by buro9 10y ago
Identity should never be used as a password.
Identity cannot be changed if compromised.
As a second form of authentication it is fine, but as a single form alone it is a bad idea.
Ideally you would always have two of these:
* Something you know (i.e. password)
* Something you have (i.e. yubikey or a token generator on your phone)
* Something you are (i.e. fingerprint)
But if you must have only one of these then the weakest one is something you are as, if compromised, it can never be changed.
- koolba 10y ago> Identity should never be used as a password. Yes. > Identity cannot be changed if compromised. I'm not up to date at what's possible with plastic surgery, but in this specific case I think it's doable (new fingerprints). > As a second form of authentication it is fine, but as a single form alone it is a bad idea. I don't consider it authentication. More like a record locator. > But if you must have only one of these then the weakest one is something you are as, if compromised, it can never be changed. I think a lot of this "fingerprints as authentication" stuff will go away once situations like this become commonplace: https://news.ycombinator.com/item?id=11726108 https://news.ycombinator.com/item?id=11726108
- hellofunk 10y ago> I don't consider it authentication. Maybe you don't, but a lot of others do. Like, Apple.
- emodendroket 10y agoIs the point of fingerprint scanners really to defeat advanced, targeted hacking efforts where someone has multiple high-resolution photos of you? Or is it (IMO more plausibly) just to keep somebody who picks your pocket or whatever from also getting access to your bank accounts and so on? For the latter scenario the fingerprint works fine.
- Avshalom 10y agowell except that your phone is covered in your fingerprints...
- emodendroket 10y agoYeah but, again, the point isn't to offer bullet-proof security; it's to inconvenience people who mostly want to unload your phone.
- phlo 10y agoTouch ID is a fun case in security where bad is better. Fingerprint authentication on a fingerprint magnet seems like a foolish idea until you realize the alternative (for the majority of users) is 4-digit PINs[1], not strong passwords. [1] http://www.datagenetics.com/blog/september32012/ http://www.datagenetics.com/blog/september32012/
- emodendroket 10y agoThe Android password pattern thing apparently offers close to 400k possibilities so it's considerably better than PINs.
- wcoenen 10y agoI used patterns for a while, until I noticed that I could simply see the unlock pattern on the greasy screen if the sunlight hit it just right.
- emodendroket 10y agoAnd PINs don't have the same problem?
- alblue 10y agoNot really - with a pattern you drag from one loaction to another. With a PIN you tend not to drag your finger along but lift and press. In addition with PINs you can have diagonally opposite numbers (e.g. 1-9 or 3-7) but with patterns you don't have that unless you use 5 on the way (e.g. 1-5-9 or 3-5-7). In fact most people will have the central dot in their pattern recognition somewhere in the middle just through human nature.
- deleted 10y ago[deleted]
- treebeard901 10y agoApple uses fingerprints in addition to the PIN. To do anything security wise in iOS, you have to enter your PIN. You can use your fingerprint to unlock the phone but only if the phone has been unlocked by the PIN previously. I'm sure numerous improvements can be made for this system but it's more of a form of second factor authentication than a primary form of authentication in iOS.
- deleted 10y ago[deleted]
- eatbitseveryday 10y ago> Identity should never be used as a password. Like in the USA, the social security numbers, our driver license numbers, etc. are all used as authentication, when originally were meant as identification for tracking purposes. So far, the safest form seems to be what we keep in our heads.
- JadeNB 10y ago> Like in the USA, the social security numbers, our driver license numbers, etc. are all used as authentication, when originally were meant as identification for tracking purposes. The SSN certainly, but I don't think I've ever been asked for my DL number for authentication rather than identification. Maybe I've just forgotten. When did it happen to you?
- mcs_ 10y ago> Something you are (i.e. fingerprint) > ...it can never be changed well, we should change the Minister