5 ms·

I agree. But my thinking is that touch id just shows who the person claims to be (like a username), but it doesn't actually authenticate they are that person.

by rrmm 10y ago

I agree. But my thinking is that touch id just shows who the person claims to be (like a username), but it doesn't actually authenticate they are that person. I know that in practice apple does use it to auth.

arnarbi 10y ago
It's a "something you are" authentication factor, since it is presumed that the cost of faking a fingerprint is too high to be worth it in those cases.
- rrmm 10y ago
  I guess I like the trade-offs of something-you-have/something-you-know even if the cost of faking them is actually lower. I am probably in a minority.
  - Klathmon 10y ago
    Could you setup your system to still need "something you know" when logging in, but use your TouchID for additional authentication (like sudo) once already in the system? That seems like the best of both worlds there.
  - arnarbi 10y ago
    When done correctly, fingerprints are both something you are and something you have: The fingerprint data should reside in and work only to activate an HSM that then proves possession of an attested key pair. That way the HSM (and the device it sits in) is your something to have.
- yxhuvud 10y ago
  I wonder how much the cost will be reduced though considering that you will most probably be able to find a matching fingerprint on the same keyboard.
  - CodeWriter23 10y ago
    Use your thumb print.
    - deleted 10y ago
      [deleted]
    - pritambaral 10y ago
      Lift the thumbprint off of the TouchID sensor itself? That is, assuming the premise of the grandparent comment is valid and fingerprints lifted off of the keyboard would be enough.
      - throwanem 10y ago
        Slide, rather than raise, your thumb off the sensor.
        noja 10y ago
        When I hold my phone, I use my opposable thumb to hold the front of the phone. Anyone can lift it off there.
      - CodeWriter23 10y ago
        You only use your thumb on the space bar, and when you do, it's the side. But when you scan your thumb, it's the face of the print, ergo, impossible to lift thumb print from nearby key.
- zwp 10y ago
  https://www.schneier.com/crypto-gram/archives/2002/0515.html#5 https://www.schneier.com/crypto-gram/archives/2002/0515.html... "He used $10 of ingredients you could buy, and whipped up his gummy fingers in the equivalent of a home kitchen. And he defeated eleven different commercial fingerprint readers, with both optical and capacitive sensors, and some with "live finger detection" features." That article's a little old now and the tech may well have improved since but I wouldn't put too much faith in fingerprint readers. (Also: other attack vectors exist).
  - dogma1138 10y ago
    The sensor is pretty good at detecting real finger since it's tuned to the capacitance of human skin, possible to fake but not particularly easy. If they'll move to the new optical sensors the the refracted IR ones can sense the flow of blood in the veins of your finger.
    - vog 10y ago
      They (including Apple) told us once too often that their new fingerprint sensor will now really, really, finally solve all issues. With every new generation they tell us that all flaws of all previous generations have been solved. And once too often, they we proven to be wrong. So I agree with zwp (not sure why he was downvoted): I wouldn't put too much faith in fingerprint readers.
  - arnarbi 10y ago
    My point is that this is still more expensive than harvesting knowledge factors with phishing and stealing dbs where people use the same factors.
- a_c_s 10y ago
  Yeah, I'm not an international spy: even if it is 'easy', nobody is going to spend a few hours faking my fingerprint just to get into my phone or my laptop. And if they are so motivated, then there's a much bigger problem at hand. There are plenty of people still using 4 digit passcode (especially simple ones like 0000 or 1234) which is easy to 'steal' by watching somebody unlock their phone before pickpocketing them.
  - rrmm 10y ago
    The bigger issue in my mind is revocation and separation of identities. I only have one set of fingerprints. What's more, I may not want my biological identity connected to online identities. It would be like having to give every website your SSN/National ID to identify yourself rather than merely a unique ID. You are giving out a huge amount of info with your fingerprint. Now some of the above issues aren't specifically in play with this particular app: It's locally owned/controlled hardware only. Also, as you say most of us aren't international spies (though I do find that getting a bit close to 'I have nothing to hide').
    - zimpenfish 10y ago
      A sensible approach would be to have a master token which is unlocked using your fingerprint and used to generate one-time tokens for identification - perhaps like Apple Pay.
    - arnarbi 10y ago
      As you point out, there's a right way to do fingerprints, which Apple did. Only the key pair stored in the secure enclave is tied to your online identity. There is a missing link in the trust chain though, which is attestation of that secure enclave (how do we know it is a legitimate and uncompromised one?) However, privacy preserving attestation mechanisms such as DAA [1] require somewhat expensive crypto. [1] https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation
dogma1138 10y ago
TouchID sensor isn't that easy to fool with replicated fingerprints. If you are afraid that some one will cut off your finger to unlock your computer don't use the touchID, that said if some one is willing to do that to unlock it i wouldn't want to imagine what they'll do to you to get the password. ;)
- PetahNZ 10y ago
  You don't really need to cut their finger off. Just get them drunk enough to pass out.
  - d0mine 10y ago
    Or take a picture or find their photo on a social network http://www.geek.com/apple/bypassing-touch-id-with-a-phony-fingerprint-could-be-as-simple-as-taking-a-photo-1612511/ http://www.geek.com/apple/bypassing-touch-id-with-a-phony-fi...
    - mkhalil 10y ago
      "could be as simple as taking a photo" I don't buy this story or their "sources" at all. A zoomed in photo is enough to create a accurate 3d model? Really? I might be naive at times, but this time I'm calling BS.
      - lorenzhs 10y ago
        Starbug (same guy who was the first to fool a Touch ID sensor) demonstrated that he could create fingerprint masks from press photos of a politician. See his very entertaining talk at 31c3: http://youtube.com/watch?v=VVxL9ymiyAU http://youtube.com/watch?v=VVxL9ymiyAU
- deleted 10y ago
  [deleted]

by rrmm 10y ago

arnarbi 10y ago

It's a "something you are" authentication factor, since it is presumed that the cost of faking a fingerprint is too high to be worth it in those cases.

rrmm 10y ago
I guess I like the trade-offs of something-you-have/something-you-know even if the cost of faking them is actually lower. I am probably in a minority.
- Klathmon 10y ago
  Could you setup your system to still need "something you know" when logging in, but use your TouchID for additional authentication (like sudo) once already in the system? That seems like the best of both worlds there.
- arnarbi 10y ago
  When done correctly, fingerprints are both something you are and something you have: The fingerprint data should reside in and work only to activate an HSM that then proves possession of an attested key pair. That way the HSM (and the device it sits in) is your something to have.
yxhuvud 10y ago
I wonder how much the cost will be reduced though considering that you will most probably be able to find a matching fingerprint on the same keyboard.
- CodeWriter23 10y ago
  Use your thumb print.
  - deleted 10y ago
    [deleted]
  - pritambaral 10y ago
    Lift the thumbprint off of the TouchID sensor itself? That is, assuming the premise of the grandparent comment is valid and fingerprints lifted off of the keyboard would be enough.
    - throwanem 10y ago
      Slide, rather than raise, your thumb off the sensor.
      - noja 10y ago
        When I hold my phone, I use my opposable thumb to hold the front of the phone. Anyone can lift it off there.
    - CodeWriter23 10y ago
      You only use your thumb on the space bar, and when you do, it's the side. But when you scan your thumb, it's the face of the print, ergo, impossible to lift thumb print from nearby key.
zwp 10y ago
https://www.schneier.com/crypto-gram/archives/2002/0515.html#5 https://www.schneier.com/crypto-gram/archives/2002/0515.html... "He used $10 of ingredients you could buy, and whipped up his gummy fingers in the equivalent of a home kitchen. And he defeated eleven different commercial fingerprint readers, with both optical and capacitive sensors, and some with "live finger detection" features." That article's a little old now and the tech may well have improved since but I wouldn't put too much faith in fingerprint readers. (Also: other attack vectors exist).
- dogma1138 10y ago
  The sensor is pretty good at detecting real finger since it's tuned to the capacitance of human skin, possible to fake but not particularly easy. If they'll move to the new optical sensors the the refracted IR ones can sense the flow of blood in the veins of your finger.
  - vog 10y ago
    They (including Apple) told us once too often that their new fingerprint sensor will now really, really, finally solve all issues. With every new generation they tell us that all flaws of all previous generations have been solved. And once too often, they we proven to be wrong. So I agree with zwp (not sure why he was downvoted): I wouldn't put too much faith in fingerprint readers.
- arnarbi 10y ago
  My point is that this is still more expensive than harvesting knowledge factors with phishing and stealing dbs where people use the same factors.
a_c_s 10y ago
Yeah, I'm not an international spy: even if it is 'easy', nobody is going to spend a few hours faking my fingerprint just to get into my phone or my laptop. And if they are so motivated, then there's a much bigger problem at hand. There are plenty of people still using 4 digit passcode (especially simple ones like 0000 or 1234) which is easy to 'steal' by watching somebody unlock their phone before pickpocketing them.
- rrmm 10y ago
  The bigger issue in my mind is revocation and separation of identities. I only have one set of fingerprints. What's more, I may not want my biological identity connected to online identities. It would be like having to give every website your SSN/National ID to identify yourself rather than merely a unique ID. You are giving out a huge amount of info with your fingerprint. Now some of the above issues aren't specifically in play with this particular app: It's locally owned/controlled hardware only. Also, as you say most of us aren't international spies (though I do find that getting a bit close to 'I have nothing to hide').
  - zimpenfish 10y ago
    A sensible approach would be to have a master token which is unlocked using your fingerprint and used to generate one-time tokens for identification - perhaps like Apple Pay.
  - arnarbi 10y ago
    As you point out, there's a right way to do fingerprints, which Apple did. Only the key pair stored in the secure enclave is tied to your online identity. There is a missing link in the trust chain though, which is attestation of that secure enclave (how do we know it is a legitimate and uncompromised one?) However, privacy preserving attestation mechanisms such as DAA [1] require somewhat expensive crypto. [1] https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation

dogma1138 10y ago

TouchID sensor isn't that easy to fool with replicated fingerprints. If you are afraid that some one will cut off your finger to unlock your computer don't use the touchID, that said if some one is willing to do that to unlock it i wouldn't want to imagine what they'll do to you to get the password. ;)

PetahNZ 10y ago
You don't really need to cut their finger off. Just get them drunk enough to pass out.
- d0mine 10y ago
  Or take a picture or find their photo on a social network http://www.geek.com/apple/bypassing-touch-id-with-a-phony-fingerprint-could-be-as-simple-as-taking-a-photo-1612511/ http://www.geek.com/apple/bypassing-touch-id-with-a-phony-fi...
  - mkhalil 10y ago
    "could be as simple as taking a photo" I don't buy this story or their "sources" at all. A zoomed in photo is enough to create a accurate 3d model? Really? I might be naive at times, but this time I'm calling BS.
    - lorenzhs 10y ago
      Starbug (same guy who was the first to fool a Touch ID sensor) demonstrated that he could create fingerprint masks from press photos of a politician. See his very entertaining talk at 31c3: http://youtube.com/watch?v=VVxL9ymiyAU http://youtube.com/watch?v=VVxL9ymiyAU
deleted 10y ago
[deleted]