5 ms·

Biometric data is not a password, it's an identity. Fingerprints and iris scans are equivalent to a username or email. To secure a device you need a password.

Biometric data is not a password, it's an identity. Fingerprints and iris scans are equivalent to a username or email. To secure a device you need a password. Basics: something you are (iris scan, fingerprint), something you have (2fa token, usb unlock key), something you know (password). One out of 3 is probably not very secure.

draugadrotten 9y ago
> Basics: something you are (iris scan, fingerprint), something you have (2fa token, usb unlock key), something you know (password). Why complicate things with 2fa tokens. Something you have: the phone! However I agree with something you know being missing.
- algesten 9y ago
  Sure. But perhaps it should be something you have that isn't the device you're trying to get into.
rimliu 9y ago
One out of three is still somewhat more secure than zero out of three.
JohnStrange 9y ago
Fingerprints and iris scans are not equivalent to a username or email, since the username and email can be changed easily. Proper biometric data cannot be changed, it is tied to the individual. So when the data is compromised and published in the wild and the devices can be fooled with it (which will always be possible), then the user of biometric recognition devices can become the victim of identity theft for the rest of their life.
- algesten 9y ago
  Good point. It's worse than email or username.
- CyberTrekker 9y ago
  Fingerprints are not hard to obtain at all. As a matter of fact, fingerprints are easy to obtain.
jpalomaki 9y ago
Phone must automatically lock quite quickly, otherwise somebody quick just grab it after you have unlocked it. This means the password needs to be typed in constantly if you are frequently picking up the phone. Also you often want to grab the phone with one hand, so you need to be able to type the password with one hand. Combine that with the frequent typing and you probably come to conclusion that you can't have a proper, secure passphrase. Instead you resort to pin code of some length. Now remember that you need to be typing the pin code constantly to unlock the phone. With one hand operation there's little you can do to protect yourself against shoulder surfing. This means you pin code is not that private. Iris scanning or fingerprints are easy for determined attacker, but I would say they are hard for somebody who just grabs your phone. Vice versa for the pin code. I think a good balance between security and usability would be to allow fingerprint or iris scan when the phone has been constantly in my proximity but require a pin (password) if the phone is taken away. The proximity could be determined for example by pairing the phone with smart watch.
- joncrocks 9y ago
  I'd note this is already possible on Android, using 'Smart Lock' - https://support.google.com/nexus/answer/6093922 https://support.google.com/nexus/answer/6093922
  - morsch 9y ago
    Not really. Quoting GP: I think a good balance between security and usability would be to allow fingerprint or iris scan when the phone has been constantly in my proximity but require a pin (password) if the phone is taken away. The proximity could be determined for example by pairing the phone with smart watch. When combined with a fingerprint sensor, smart lock keeps the device completely unlocked while "triggered" (by being on-body, or close to a trusted BT device, etc), and the fingerprint unlocks it while not triggered. It doesn't ever escalate to requiring the pin/password/pattern. Please correct me if I'm wrong, because I'd like to be.
    - jetpacktuxedo 9y ago
torrent-of-ions 9y ago
Just to make your point explicit, you can't change your identity/biometrics/fingerprint if it is compromised. You can change your keys.
- Eridrus 9y ago
  The easiest attack vector is just mugging you on the street after you've unlocked your phone. The police are already doing this. And unless you regularly leave you phone lying around, you'll realize this is pretty much a requirement for breaking into your phone anyway.
_asummers 9y ago
The password model on Google's version of Android and iOS (as examples) is not biometric based. You need the password every few hours (at least on Android, not sure about iOS) and whenever you restart. The biometric is a keep alive for that "session". For my threat model, that's sufficient. For many, that is sufficient. For some, it absolutely is not and they should disable biometrics entirely. .
- eric_h 9y ago
  iOS requires a password after a reboot, after 24-48 hours of inactivity or after several failed attempts with the fingerprint. I'm glad it's not every few hours because my iPhone password is quite long.
snarf21 9y ago
Exactly this. We need the big 4 to start pushing this as a standard and with all three passwords can be simpler like 8 alphanumeric characters. There is NO reason that the 2fa can't be built into the mobile OSes and shown on screen/watch with fingerprint verification as the trigger.
continuational 9y ago
A fingerprint is harder to steal and use than your birthyear of your kid, so for most people it's more secure than a memorable 4-digit pin.
Geee 9y ago
Something you are: iris or fingerprint Something you have: phone You can't log in remotely with an iris or fingerprint.

draugadrotten 9y ago

> Basics: something you are (iris scan, fingerprint), something you have (2fa token, usb unlock key), something you know (password). Why complicate things with 2fa tokens. Something you have: the phone! However I agree with something you know being missing.

algesten 9y ago
Sure. But perhaps it should be something you have that isn't the device you're trying to get into.

rimliu 9y ago

One out of three is still somewhat more secure than zero out of three.

JohnStrange 9y ago

Fingerprints and iris scans are not equivalent to a username or email, since the username and email can be changed easily. Proper biometric data cannot be changed, it is tied to the individual. So when the data is compromised and published in the wild and the devices can be fooled with it (which will always be possible), then the user of biometric recognition devices can become the victim of identity theft for the rest of their life.

algesten 9y ago
Good point. It's worse than email or username.
CyberTrekker 9y ago
Fingerprints are not hard to obtain at all. As a matter of fact, fingerprints are easy to obtain.

jpalomaki 9y ago

Phone must automatically lock quite quickly, otherwise somebody quick just grab it after you have unlocked it. This means the password needs to be typed in constantly if you are frequently picking up the phone. Also you often want to grab the phone with one hand, so you need to be able to type the password with one hand. Combine that with the frequent typing and you probably come to conclusion that you can't have a proper, secure passphrase. Instead you resort to pin code of some length. Now remember that you need to be typing the pin code constantly to unlock the phone. With one hand operation there's little you can do to protect yourself against shoulder surfing. This means you pin code is not that private. Iris scanning or fingerprints are easy for determined attacker, but I would say they are hard for somebody who just grabs your phone. Vice versa for the pin code. I think a good balance between security and usability would be to allow fingerprint or iris scan when the phone has been constantly in my proximity but require a pin (password) if the phone is taken away. The proximity could be determined for example by pairing the phone with smart watch.

joncrocks 9y ago
I'd note this is already possible on Android, using 'Smart Lock' - https://support.google.com/nexus/answer/6093922 https://support.google.com/nexus/answer/6093922
- morsch 9y ago
  Not really. Quoting GP: I think a good balance between security and usability would be to allow fingerprint or iris scan when the phone has been constantly in my proximity but require a pin (password) if the phone is taken away. The proximity could be determined for example by pairing the phone with smart watch. When combined with a fingerprint sensor, smart lock keeps the device completely unlocked while "triggered" (by being on-body, or close to a trusted BT device, etc), and the fingerprint unlocks it while not triggered. It doesn't ever escalate to requiring the pin/password/pattern. Please correct me if I'm wrong, because I'd like to be.
  - jetpacktuxedo 9y ago

torrent-of-ions 9y ago

Just to make your point explicit, you can't change your identity/biometrics/fingerprint if it is compromised. You can change your keys.

Eridrus 9y ago
The easiest attack vector is just mugging you on the street after you've unlocked your phone. The police are already doing this. And unless you regularly leave you phone lying around, you'll realize this is pretty much a requirement for breaking into your phone anyway.

_asummers 9y ago

The password model on Google's version of Android and iOS (as examples) is not biometric based. You need the password every few hours (at least on Android, not sure about iOS) and whenever you restart. The biometric is a keep alive for that "session". For my threat model, that's sufficient. For many, that is sufficient. For some, it absolutely is not and they should disable biometrics entirely. .

eric_h 9y ago
iOS requires a password after a reboot, after 24-48 hours of inactivity or after several failed attempts with the fingerprint. I'm glad it's not every few hours because my iPhone password is quite long.

snarf21 9y ago

Exactly this. We need the big 4 to start pushing this as a standard and with all three passwords can be simpler like 8 alphanumeric characters. There is NO reason that the 2fa can't be built into the mobile OSes and shown on screen/watch with fingerprint verification as the trigger.

continuational 9y ago

A fingerprint is harder to steal and use than your birthyear of your kid, so for most people it's more secure than a memorable 4-digit pin.

Geee 9y ago

Something you are: iris or fingerprint Something you have: phone You can't log in remotely with an iris or fingerprint.