5 ms·
The only secure thing is a thing that only you know and only you can verify even if you are freely observed. That is, shared secrets between you and your trust
by emilfihlman 9y ago
The only secure thing is a thing that only you know and only you can verify even if you are freely observed.
That is, shared secrets between you and your trusted device (meaning passwords) are the singular thing that provide authentication securely. Your password cannot be extracted from your head (yet).
That being said, if your risks are mundane then the benefits of biometric authentication far outweigh constant password input, not to mention that constantly entering your password exposes you to other side-channel attacks.
Biometrics for simple access, passwords for changes, modifies and access to sensitive information.
- arrrg 9y agoI know several techniques that would be highly efficient in extracting my password from my head. Some don’t even require physical access. (This is a cryptic way of saying that credible threats of violence or actual violence would compel me pretty quickly to tell my PIN.)
- reubenswartz 9y agoThe ease and quality of video surveillance from cell phones makes me think passwords are not that secure if other people or devices can observe you entering them.
- liberte82 9y agoI wonder if you could hack a person's password from their mind by forcing them to go through the alphabet and monitoring their heart rate / brain activity for each letter of their password. There must be a way to detect based on their reaction when you're on the right character, like a lie detector. I mean, I guess at that point you could just torture it out of them, but I wonder if this could work as a method that wouldn't count as torture.
- graphitezepp 9y agoI severely doubt that anything like that is feasible. Lie detectors don't really work so well too, afaik.
- mgberlin 9y ago"Your password cannot be extracted from your head": obligatory xkcd https://www.xkcd.com/538/ https://www.xkcd.com/538/