4 ms·

Biometrics could be used as a username, but should not be used as a password...

• Grazester 10y ago
  Exactly. It is a form of identification not authentication.
  • toomanybeersies 10y ago
    I heard fingerprints described as "Authentication, not authorisation", which I think is a better description of the role they play (on the iPhone, at least), and the role they should play. They authenticate who you are, they aren't trivial to fake. However, they shouldn't authorise access to a device on their own. Your fingerprint works as a somewhat more secure, medium term swipe-to-unlock for your phone.
    • joshuahutt 10y ago
      Authorization typically means what actions the authenticated user is allowed to perform, not that the authenticated user has herself conveyed some kind of approval.
    • rdtsc 10y ago
      > I heard fingerprints described as "Authentication, not authorisation", I understand once you've authenticated who the user is, authorization is just a mask of what they are allowed to do. It is like saying "after you've given your username (GMail account) to Google, it should allow you to read your email. If you happen to be an administrator for Google Business account you can also see other accounts or settings etc". So hopefully you meant that you just use your fingerprint in place of typing out your username not in place of typing your username _and_ password.
      • raphman 10y ago
        One could see fingerprint and user/pw as two different roles - with different levels of authorisation. (Somehow similar to sudo which asks for the user's password the first time but assumes that the logged in user is allowed to execute further sudo commands without pw auth. Even if sudo does not really implement two different user roles here.)
      • raphman 10y ago
        One could see fingerprint and user/pw as two different roles - with different levels of authorisation. (Somehow similar to sudo which asks for the user's password the first time but assumes that the logged in user is allowed to execute further sudo commands without pw auth. Even if sudo does not really implement two different user roles here.)
    • dagss 10y ago
      Careful, authentication / authorization have specific definitions in software development which are at odds with what you say. A username/password together would be authentication.
• abrookewood 10y ago
  If we keep repeating it, maybe someone will eventually listen ... Really, it should be obvious how bad an idea it is to use biometrics as passwords to large companies like Apple. I guess they figure (probably correctly) that customers favour convenience over security.