3 ms·
Not a fan of solely using fingerprints for authentication. Good systems allow you to rotate keys. I only got 10 fingerprints.
by kyled 10y ago
Not a fan of solely using fingerprints for authentication. Good systems allow you to rotate keys. I only got 10 fingerprints.
- rch 10y agoAnd you might not have any, once an adversary is done with you.
- nothrabannosir 10y agoFortunately, my threat model does not include people cutting off my fingers. Take out the pliers and you can have my phone. My notes are private, but not that private.
- freehunter 10y agohttps://www.xkcd.com/538/ https://www.xkcd.com/538/
- M_Grey 10y agoThat's the reality, for sure, but at least you're stripping away the air of respectability, law, and order. When you're whipping someone with a rubber hose, you've made a serious commitment.
- nickpsecurity 10y ago" you're stripping away the air of respectability, law, and order." Counterexample popped in my head was parents with a belt asking for iPhone unlocked. Still has respectability, law, and order in most places. I wonder if there are other counterexamples.
- M_Grey 10y agoIf you need to belt your kid to get access to their device, you've already gone well past the fail-state of parenting.
- nickpsecurity 10y agoI've met some real hellions that I couldn't quite attribute to the seemingly-good parents. Your statement is probably true 90+% of the time, though.
- helthanatos 10y agoGood passkeys also should only exist to be checked on the device. Fingerprints can be in databases and on the device itself. Not sure how fingerprint scanners react to replicated fingerprints, but the right people can probably replicate them pretty well. I would only consider a fingerprint a more secure authentication measure because it can't be recorded by cameras.
- c22 10y agoFinger prints can be (and have been) recorded by cameras.
- helthanatos 10y agoI meant it's a lot harder to record fingerprints... It's relatively easy for a camera from almost any angle to record touches on the phone (especially with many phone's animations that show the number touched)
- greggarious 10y agoPlus many countries demand fingerprints to enter. (Japan, for example)
- wiml 10y ago> the right people can probably replicate them pretty well They can be fooled reasonably well (well enough to fool an iphone) with pretty simple techniques. For details, search for a bunch of articles from 2002 referencing Tsutomu Matsumoto's work. > it can't be recorded by cameras Well... http://www.theregister.co.uk/2014/12/29/german_minister_fingered_as_hackers_steal_her_thumbprint_from_a_photo/ http://www.theregister.co.uk/2014/12/29/german_minister_fing... https://news.ycombinator.com/item?id=12611155 https://news.ycombinator.com/item?id=12611155