3 ms·
Yeah, I'm not an international spy: even if it is 'easy', nobody is going to spend a few hours faking my fingerprint just to get into my phone or my laptop. And
by a_c_s 10y ago
Yeah, I'm not an international spy: even if it is 'easy', nobody is going to spend a few hours faking my fingerprint just to get into my phone or my laptop. And if they are so motivated, then there's a much bigger problem at hand.
There are plenty of people still using 4 digit passcode (especially simple ones like 0000 or 1234) which is easy to 'steal' by watching somebody unlock their phone before pickpocketing them.
- rrmm 10y agoThe bigger issue in my mind is revocation and separation of identities. I only have one set of fingerprints. What's more, I may not want my biological identity connected to online identities. It would be like having to give every website your SSN/National ID to identify yourself rather than merely a unique ID. You are giving out a huge amount of info with your fingerprint. Now some of the above issues aren't specifically in play with this particular app: It's locally owned/controlled hardware only. Also, as you say most of us aren't international spies (though I do find that getting a bit close to 'I have nothing to hide').
- zimpenfish 10y agoA sensible approach would be to have a master token which is unlocked using your fingerprint and used to generate one-time tokens for identification - perhaps like Apple Pay.
- arnarbi 10y agoAs you point out, there's a right way to do fingerprints, which Apple did. Only the key pair stored in the secure enclave is tied to your online identity. There is a missing link in the trust chain though, which is attestation of that secure enclave (how do we know it is a legitimate and uncompromised one?) However, privacy preserving attestation mechanisms such as DAA [1] require somewhat expensive crypto. [1] https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation