12 ms·

Fingerprints are usernames, not passwords (2013)

264 points by l1n 9y ago

jrimclean 9y ago
Biometrics are for identification. Passwords are for authentication.
deleted 9y ago
[deleted]
ModernMech 9y ago
I see this argument a lot, but I don't really see it accompanied by an argument about what the passwords should be. Companies are gravitating toward biometric authentication methods because consumers have "password fatigue". They can't memorize a long secure password for every site, app, and device, so they resort to using a single password everywhere (which may or may not be displayed on a postit note stuck to their monitor). All this article offers is: > For authentication, you need a password or passphrase. Something that can be independently chosen, changed, and rotated. Okay, so fingerprints aren't passwords, but what we need instead are passwords, which we know don't work either. Best practices for password security are ignored by consumers because they're onerous, and biometric authentication seems to be insecure by default. What's the solution then?
- alphaalpha101 9y ago
  Just use a password manager with a single long secure pass phrase you can remember.
  - WillPostForFood 9y ago
    Not a great process for unlocking your phone.
  - ModernMech 9y ago
    That falls under the "too onerous" category I think. I'm not speaking for myself, but for the fact that password managers exist, and yet we still have issues with password security. So that doesn't seem to be a fix for the problem. We're really fighting human nature here, so maybe the solution is psychological, rather than technological.
- ruytlm 9y ago
  I'd argue that what passes for best practice (i.e., symbols, numbers, upper/lower case) is not best practice. As always, relevant xkcd: https://xkcd.com/936/ https://xkcd.com/936/ For many services, I have a few 'default' words or phrases that I'll use as a base for the password to build up length, followed by a word or two that tie to the specific service; to make up an example, for Twitter it might be "extrawordsthensocialchirpynoise". Of course then the symbol/number/upper/lower rules become a pain in the arse - unless you build them into the extra words: "3Xtraword$thensocialchirpynoise". Though all that said, I can't actually remember what my HN password is...
  - dredmorbius 9y ago
    I've been checking the xkcdpass utility (available on Debian). Generated 50 sets of 100,000,000 passwords each, comprised of six words (the default), then sorted these uniq, and counted the output lines. Any duplicates would result in fewer than 100,000,000 lines. All fifty trials had no dupes. Took most of a week to run that, on an older box :) Previously mentioned: https://news.ycombinator.com/item?id=14757672 https://news.ycombinator.com/item?id=14757672
  - kalleboo 9y ago
    I'm not typing a 13 character phrase every 15 minutes when I unlock my phone. Before TouchID, I didn't even bother with a PIN since it was such a PITA to unlock
- deleted 9y ago
  [deleted]
- cicorias 9y ago
  Proper modern approach adds thermal, or at least 1 other biometric sensor. Just as Windows hello relies on more than a pic, plus IR, + thermal. I suspect Apple X does this minimum. More features can, but not always, improve the model. As pointed out by Tim Cook it goes from 1 in 50000 odds of duplicate result to 1 in 1,000,000. And that's 1,000,000 that would need to try on your phone. FBI is probably running load tests now to see if they can brute force.
- z29LiTp5qUC30n 9y ago
  And smarter organizations are deploying things like mooltipass https://www.themooltipass.com/ https://www.themooltipass.com/ and keepass http://keepass.info/ http://keepass.info/
ruytlm 9y ago
Thoroughly agree, though more from a philosophical standpoint. I would argue using biometrics as passwords removes an element of intent. A fingerprint can be used against your will; it is significantly harder to be forced to use a password that exists only in your mind.
- tpeo 9y ago
  That's a very interesting perspective! But you must recognize that it's a very abstract approach, no? I mean, when someone identifies themselves through biometry, there's clearly an element of intent. And if they write down passwords on sticky notes, or anywhere else really, it's about as available as a fingerprint is, if not more.
  - ruytlm 9y ago
    When someone identifies themselves, yes; what about when we identify others through biometry? The scene I'm reminded of is the on in Minority Report(?) where the main character is walking through a bank of bio-sensing ad displays, and has to not look at them to make sure they can't identify him from his iris/retinas. As an analogy, imagine you take a picture of someone at an antifa vs. alt-right protest that turns violent. All the picture tells you is they were there; it doesn't tell you whether they supported antifa, or supported the alt-right; it doesn't tell you if they were there as a police officer trying to keep the peace, or if they were simply trying to get in the front door of their apartment building when a clash broke out outside. The biometry reveals their presence - it doesn't reveal their intent.
    - tpeo 9y ago
      I was really thinking in biometry as used in a more ordinary situation, like a laptop fingerprint reader. With the most likely form of malicious behavior here being that of identity theft by a small-time attacker. Having to dodge biometric sensors or trying to avoid having your photograph taken at protest are more an issue of surveillance, either by government or by private citizens. Sorry for not making myself clear at first, but what I mean is that passwords aren't a sufficient guarantee of intent either. If anyone has access to them, they can spoof someone's identity. I reckon that this doesn't really fit a civil rights discussion, because we haven't (I think) reached such a point yet, but government-backed attacker might spoof someone's identity in order to either infiltrate or hijack a civil organization. Essentially, a virtual mole.
jakelazaroff 9y ago
This argument seems especially dated in retrospect. Since Apple introduced Touch ID in 2013, I can't recall even one single case of criminals or law enforcement using biometrics to access someone's iPhone. Same for any other phone manufacturer.
- jlgaddis 9y ago
  One such case: http://www.businessinsider.com/police-3d-printed-a-dead-mans-finger-to-unlock-his-iphone-2016-8 http://www.businessinsider.com/police-3d-printed-a-dead-mans...
  - nomel 9y ago
    This sound like an Apple Watch feature! Watch removed, or your pulse stops for more than a few minutes, or your pulse goes too high without physical activity (adrenaline), a passcode is required for all devices on next use.
paulannesley 9y ago
Fingerprints are not passwords, but I don't think it's useful to think of them as usernames either. This is a much more pragmatic take on it by Troy Hunt, the person behind “Have I been pwned?”: https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pragmatic-security/ https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pra... > The first point I'll make here as I begin talking about the 3 main security constructs available is that they're all differently secure.
- rothbardrand 9y ago
  Fingerprints are better passwords than no password. And the hassle of entering even a 4 digit numeric PIN was what Apple was trying to overcome. Too many people were leaving their phones completely unlocked all the time.
  - reificator 9y ago
    It's irrational, but I'm not going to use a security measure that increases the likelihood a malicious actor removes my finger.
    - kibwen 9y ago
      1. Then you have the option not to use it, and always will (biometrics are used to augment passwords, not replace them). 2. Using passwords as a security measure increases the likelihood that a malicious actor will beat them out of you with a five-dollar wrench (and this does not mean that passwords are a bad idea).
    - deleted 9y ago
      [deleted]
    - kobeya 9y ago
      The iPhone has a liveness test as part of its biometric.
      - bdibs 9y ago
therobot24 9y ago
this is a common argument by those who do not understand biometrics a biometric is a username and a password - yes, i know the purpose is to say that the biometric should be used as a password, but that changes the declarative statement quite a bit in my opinion
- alexhornbake 9y ago
  I think it's a common argument for people who think biometrics are a bad idea for security. IE. You can change your password, you can't change your thumb/face/biometric (easily). At best, a fingerprint establishes identity, therefore it has more in common with a username, drivers license, social security number, etc. than it has in common with a password.
  - rothbardrand 9y ago
    The problem is these people are thinking in terms of absolute security. Ideally you have a user name, a password, some sort of 2FA and also biometrics. But the alternative for iPhones was leaving them without even a PIN because entering a 4 digit numeric pin was too much hassle for most people... so Apple lowered the bar and increased security with biometrics. They are trying to do it again. If you want ultimate security ,then you can have a very long alphanumeric password, and turn off touchID and faceID
    - pishpash 9y ago
      Honestly, a biometric used solely on a device in your possession is not that bad. It is not being transmitted or stored remotely, which would be worse. But it would have been better if it were not a biometric that was being left everywhere.
  - freehunter 9y ago
    >At best, a fingerprint establishes identity Nope. At best a fingerprint establishes identity in a unique and authoritative manner. My name is an identity, and anyone can say or write my name. My SSN is an identity, and anyone can say or write my SSN. No one else can speak, type, write, or otherwise express my fingerprint. That is far beyond simple "identity".
wavefunction 9y ago
I am more than the checksum of my whorls and curves, sir/madame!
- TeMPOraL 9y ago
  Not to the Machine, f45875e0b18fa3bb81e0739952acbea9ed458113. Get in line.
ballenf 9y ago
No, they're really not either. The whole username vs. password debate is like asking whether the key to your house is a username or password. Biometrics are used as the key that unlocks a device (or app or asset within the device). And like the house they require physical proximity. And, yes, just like the house key there's a decent chance that someone who lives near you has the same key type (device type -- apple/samsung/lg/etc.) and keying (fingerprint data points) on their front door (phone). But those odds are basically irrelevant as an attack surface. For a native app on a phone the "username" is proxied to the device id, once linked to the user. I think the article being 4 years old reflects a 4-year-old fear of the new and misapprehension of where security problems would arise in the future on biometrically locked phones.
- SomeStupidPoint 9y ago
  I can rekey my house locks, I can change my password, I can.... what my fingerprints? The reason that fingerprints are a username is that they're a static value associated with the identity of the person, which is later impossible to change. There's no reason you can't also use a username as a password (though there are lots of reasons you shouldn't), but it's clear that fingerprints are closer to username than password. By contrast, the key to your house is clearly a password -- it a changeable value used to authenticate to a mechanism that you're authorize to operate it.
  - Bilal_io 9y ago
    But is a username really static? It is to some point until you decide to deactivate an account or abandon it in case you can't.
  - freehunter 9y ago
    >I can rekey my house locks, I can change my password, I can.... what my fingerprints? Years of poor security have taught us that we need our authentication to be easily changeable in order to be secure. It's not true. Passwords need to be changed because they can be guessed. They can be leaked. Any person sitting down at any keyboard could type any random string of characters and, given enough time, figure out someone's password. It doesn't work the same for fingerprints. There is no number of times I can press my finger on your scanner and trick your scanner into thinking I am you. Your fingerprint only needs to be changed if someone steals your finger and keeps it in a state where modern fingerprint scanners will still recognize it. That is exceedingly difficult to do. We need to get it out of our mind that "we change our passwords regularly, we should change our fingerprints too". Bad security advice led to routine password expiration, and that bad security advice lives on. It's still bad. >it's clear that fingerprints are closer to username than password That is not clear in any way, either in theory or in practice. The entire argument works on "fingerprints are publicly visible and cannot be changed" which would suck for a password, but fingerprints are not a password. That's why there's an entirely different name for it. Yes, I can see your fingerprint. But TouchID isn't going to be fooled by a piece of scotch tape lifted from your desk, so it doesn't matter. Fingerprints are neither a username nor a password. They are a uniquely identifying attribute. Usernames and passwords are not. There is no comparison between the two authentication systems.
kibwen 9y ago
This overly simplifies things. Passwords are primary authentication, biometrics are secondary authentication. Biometrics should only be used when a password has already been established, and then only as a shortcut to entering that password; furthermore, authenticating via biometrics should put one into a limited-access state that disallows tampering with primary authentication mechanisms. The result is that anyone spoofing a fingerprint would be unable to completely own another device. The tradeoffs inherent to this are well-described elsewhere: a lower degree of absolute security in exchange for a higher proportion of users with any security at all; in lieu of the convenience offered by biometric authentication, enormous swaths of users leave themselves wide open. And since biometrics are just a convenience, anyone who does require absolute security can easily choose to forgo them entirely.
dustinkirkland 9y ago
Original author here. This article is more pertinent today than ever before! Your face is your username, not your password. Use it like you use your username. But never as something secret, personal, unknown like your password. The same goes for any biometric. Fingerprints, voice, iris, gait, DNA, etc. No matter how much they try to sell you authentication through biometrics, it's total b.s. @DustinKirkland
- dogruck 9y ago
  What about the face ID for women wearing the hijab. What is her username? Is it her publicly veiled face, or her private natural face? As people age, or are otherwise disfigured, does their username change?
- EGreg 9y ago
  I would like to offer my 2 cents. Biometrics are good for unlocking X if the persob who cares about the security of X is the person who oversees the registration of the biometrics. In this case you are the person and X is ... the phone. That's it, the phone. You should not be using biometrics-derived data for any passwords except to unlock your phone (or that place with the security guard making sure you registered your face the first time). Because REPLAY ATTACKS. After that you're supposed to use challenge-response by some auth app on a device. So your fingerprint IS a password for the device but not for external services. Passwords in general are vulnerable to replay attacks!
- techno_modus 9y ago
  The main property of fingerprints just like faces and other biometrics are supposed to be not detachable from the thing (person) they represent. Therefore the authentication processes based on them should somehow guarantee the presence of the person itself. Usernames on the other hand are separate entities and therefore it is necessary to provide a secret for authentication. A key from a house can be also passed to other persons and hence that person without any protection, and hence that person should additionally authenticate itself as a true owner.
- curun1r 9y ago
  I said this in a previous thread [1], but I'll restate here: Your face or fingerprint is neither your username nor your password. It's a form of identity. The combination of username and password is another form of identity. A certificate chain is another form of identity. Not all forms of identity are separated into two components like username and password. And different forms of identity have different properties and applicability. Trying to shoehorn a form of identity like a face or a fingerprint into the username/password template is counterproductive and will only add unnecessary confusion. Please stop. Dumbing down security and removing the nuance is how people get it horribly wrong. Security is very dependent on context. Authenticating with a phone is very different from authenticating over the internet which is very different from authenticating in a situation where you're physically present with another human being (credit card, bank teller, etc). Authentication schemes need to be designed for the specific use case in which they're used and no rule is universal. [1] https://news.ycombinator.com/item?id=15233454 https://news.ycombinator.com/item?id=15233454
grzm 9y ago
Discussion at the time (257 comments): https://news.ycombinator.com/item?id=6477505 https://news.ycombinator.com/item?id=6477505
abalone 9y ago
Why is this getting reposted? I’d argue this is very shortsighted especially coming from a security professional. TouchID has been a huge leap forward in consumer device security. Security design must take into account usability. Fingerprints (and now faces) make it easy to use stronger passcodes. If you don’t use biometrics, people use weak passcodes. That’s clearly a worse outcome. Sure, it’s even stronger to not use biometrics and enter a strong high entropy passcode every time you want to unlock your phone. But to actually advise something like that as a better approach in a consumer device than TouchID is simply to advocate a guaranteed worse security outcome. Maybe you “cover your ass” as a security acolyte and blame the compromised user for not following your stringent prescriptions, but that’s not owning the outcome. You have to consider usability.
- russdpale 9y ago
  Considering the law can compel you to use your fingerprint to unlock a device, it cannot do the same for a passcode, which only lives in your head. For this simple, pragmatic reason alone, a pass code will ALWAYS, 100% of the time, beat out any supposed biometric security advantage. Usability only goes so far, otherwise we wouldn't even have doors on our houses.
  - abalone 9y ago
    First of all TouchID is layered on top of a passcode, so you still have good protection from being compelled to provide a fingerprint.[1] Second, you’re missing the point. Passcodes do not “always 100% of the time beat out” biometrics if the passcodes are weak or nonexistent. Which was the case prior to TouchID. [1] https://www.theverge.com/2017/8/17/16161758/ios-11-touch-id-disable-emergency-services-lock https://www.theverge.com/2017/8/17/16161758/ios-11-touch-id-...
  - kalleboo 9y ago
    I'm not worried about the law, I'm worried about some guy shoulder-surfing my 6-digit PIN and then pickpocketing me.
  - briandear 9y ago
13of40 9y ago
My mother's maiden name and the color of my first car are also usernames.
nodesocket 9y ago
Agree about fingerprints, as they are left around everywhere and thus easy to capture. However, FaceID should be significantly better. As Apple talked about, FaceID only works when your eyes are open and also tested/hardened against modeling.
- deleted 9y ago
  [deleted]
bandrami 9y ago
Fingerprints are tokens, just like usernames and passwords. Oddly enough, from a trust calculus standpoint usernames are not particularly valuable; we could do away with them entirely and the logic of authentication wouldn't change (though usernames add some very nice logistics that from a practical standpoint we don't want to give up). At a very basic level, a single token suffices to authenticate: something you have, know, or are does prove you are who you claim to be (usernames just give a convenient handle to that). So, a 1TP from a fob, a password, or a fingerprint at a very basic level is enough.
- Spooky23 9y ago
  Huh? Usernames are essential as they scope the credential. If you just uttered the magic word to a service logon page, anyone uttering the word gets in. You see the weakness in this type of scenario with Touch ID. If my wife's fingerprint is on my phone, she can access my Touch ID enrolled banking app.
  - bandrami 9y ago
    > anyone uttering the word gets in. Right. That's how a speakeasy works. It's the most basic form of authorization
deleted 9y ago
[deleted]
devdoomari 9y ago
+1 on this though I use fingerprints on my laptop, I'm quite aware that it's really easy to leave any fingerprint anywhere (I use it because I type slow)
jkaljundi 9y ago
In the same way SSN's in the US are usernames, not passwords.
fujiters 9y ago
I'm don't even like the idea of biometrics for user names. I don't want malicious actors to easily correlate distinct accounts (this guy's fingerprint has an account at Facebook, Reddit, Chase Bank, ...).
oliwarner 9y ago
Something you have. Something you know. Something you are. The problem with the third factor has always been a balance between cost, inconvenience and how easy it is to turn it into just another something an attacker has. Retinographic analysis is gold standard but it's hellishly expensive. Fingerprints can be copied. Easily. Facial and behavioural analysis sit somewhere in the middle, with too much scope for false negatives. So fingerprints aren't a username or password because they're not that factor... But used alone, they can be as weak as a username, in many senses.
Fej 9y ago
Yes, but the author preaching to the choir. The real problem here is educating the public at large as to why it's insecure and in what situations biometrics are unacceptable.
- IshKebab 9y ago
  Is it? If say the public has a pretty good intuitive idea of the security properties of fingerprints. Better than the author here anyway who seems to think fingerprints are as easy to copy as usernames.
- addHocker 9y ago
  The problem is with how security is depcited and movies and television series. Cinmatographic Things will always recive more eye-candy value and feature bigger. So to educated the audience security wise, one would need to raise the eyecandy value of good passwords.
TwoBit 9y ago
I'd rather use my fingerprint on my phone than have a hacker look at the finger oil smudge patterns on the glass to decipher my password. And with my fingerprint I don't need to worry about hiding my password entry.

264 points by l1n 9y ago

jrimclean 9y ago

Biometrics are for identification. Passwords are for authentication.

deleted 9y ago

[deleted]

ModernMech 9y ago

I see this argument a lot, but I don't really see it accompanied by an argument about what the passwords should be. Companies are gravitating toward biometric authentication methods because consumers have "password fatigue". They can't memorize a long secure password for every site, app, and device, so they resort to using a single password everywhere (which may or may not be displayed on a postit note stuck to their monitor). All this article offers is: > For authentication, you need a password or passphrase. Something that can be independently chosen, changed, and rotated. Okay, so fingerprints aren't passwords, but what we need instead are passwords, which we know don't work either. Best practices for password security are ignored by consumers because they're onerous, and biometric authentication seems to be insecure by default. What's the solution then?

alphaalpha101 9y ago
Just use a password manager with a single long secure pass phrase you can remember.
- WillPostForFood 9y ago
  Not a great process for unlocking your phone.
- ModernMech 9y ago
  That falls under the "too onerous" category I think. I'm not speaking for myself, but for the fact that password managers exist, and yet we still have issues with password security. So that doesn't seem to be a fix for the problem. We're really fighting human nature here, so maybe the solution is psychological, rather than technological.
ruytlm 9y ago
I'd argue that what passes for best practice (i.e., symbols, numbers, upper/lower case) is not best practice. As always, relevant xkcd: https://xkcd.com/936/ https://xkcd.com/936/ For many services, I have a few 'default' words or phrases that I'll use as a base for the password to build up length, followed by a word or two that tie to the specific service; to make up an example, for Twitter it might be "extrawordsthensocialchirpynoise". Of course then the symbol/number/upper/lower rules become a pain in the arse - unless you build them into the extra words: "3Xtraword$thensocialchirpynoise". Though all that said, I can't actually remember what my HN password is...
- dredmorbius 9y ago
  I've been checking the xkcdpass utility (available on Debian). Generated 50 sets of 100,000,000 passwords each, comprised of six words (the default), then sorted these uniq, and counted the output lines. Any duplicates would result in fewer than 100,000,000 lines. All fifty trials had no dupes. Took most of a week to run that, on an older box :) Previously mentioned: https://news.ycombinator.com/item?id=14757672 https://news.ycombinator.com/item?id=14757672
- kalleboo 9y ago
  I'm not typing a 13 character phrase every 15 minutes when I unlock my phone. Before TouchID, I didn't even bother with a PIN since it was such a PITA to unlock
deleted 9y ago
[deleted]
cicorias 9y ago
Proper modern approach adds thermal, or at least 1 other biometric sensor. Just as Windows hello relies on more than a pic, plus IR, + thermal. I suspect Apple X does this minimum. More features can, but not always, improve the model. As pointed out by Tim Cook it goes from 1 in 50000 odds of duplicate result to 1 in 1,000,000. And that's 1,000,000 that would need to try on your phone. FBI is probably running load tests now to see if they can brute force.
z29LiTp5qUC30n 9y ago
And smarter organizations are deploying things like mooltipass https://www.themooltipass.com/ https://www.themooltipass.com/ and keepass http://keepass.info/ http://keepass.info/

ruytlm 9y ago

Thoroughly agree, though more from a philosophical standpoint. I would argue using biometrics as passwords removes an element of intent. A fingerprint can be used against your will; it is significantly harder to be forced to use a password that exists only in your mind.

tpeo 9y ago
That's a very interesting perspective! But you must recognize that it's a very abstract approach, no? I mean, when someone identifies themselves through biometry, there's clearly an element of intent. And if they write down passwords on sticky notes, or anywhere else really, it's about as available as a fingerprint is, if not more.
- ruytlm 9y ago
  When someone identifies themselves, yes; what about when we identify others through biometry? The scene I'm reminded of is the on in Minority Report(?) where the main character is walking through a bank of bio-sensing ad displays, and has to not look at them to make sure they can't identify him from his iris/retinas. As an analogy, imagine you take a picture of someone at an antifa vs. alt-right protest that turns violent. All the picture tells you is they were there; it doesn't tell you whether they supported antifa, or supported the alt-right; it doesn't tell you if they were there as a police officer trying to keep the peace, or if they were simply trying to get in the front door of their apartment building when a clash broke out outside. The biometry reveals their presence - it doesn't reveal their intent.
  - tpeo 9y ago
    I was really thinking in biometry as used in a more ordinary situation, like a laptop fingerprint reader. With the most likely form of malicious behavior here being that of identity theft by a small-time attacker. Having to dodge biometric sensors or trying to avoid having your photograph taken at protest are more an issue of surveillance, either by government or by private citizens. Sorry for not making myself clear at first, but what I mean is that passwords aren't a sufficient guarantee of intent either. If anyone has access to them, they can spoof someone's identity. I reckon that this doesn't really fit a civil rights discussion, because we haven't (I think) reached such a point yet, but government-backed attacker might spoof someone's identity in order to either infiltrate or hijack a civil organization. Essentially, a virtual mole.

jakelazaroff 9y ago

This argument seems especially dated in retrospect. Since Apple introduced Touch ID in 2013, I can't recall even one single case of criminals or law enforcement using biometrics to access someone's iPhone. Same for any other phone manufacturer.

jlgaddis 9y ago
One such case: http://www.businessinsider.com/police-3d-printed-a-dead-mans-finger-to-unlock-his-iphone-2016-8 http://www.businessinsider.com/police-3d-printed-a-dead-mans...
- nomel 9y ago
  This sound like an Apple Watch feature! Watch removed, or your pulse stops for more than a few minutes, or your pulse goes too high without physical activity (adrenaline), a passcode is required for all devices on next use.

paulannesley 9y ago

Fingerprints are not passwords, but I don't think it's useful to think of them as usernames either. This is a much more pragmatic take on it by Troy Hunt, the person behind “Have I been pwned?”: https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pragmatic-security/ https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pra... > The first point I'll make here as I begin talking about the 3 main security constructs available is that they're all differently secure.

rothbardrand 9y ago
Fingerprints are better passwords than no password. And the hassle of entering even a 4 digit numeric PIN was what Apple was trying to overcome. Too many people were leaving their phones completely unlocked all the time.
- reificator 9y ago
  It's irrational, but I'm not going to use a security measure that increases the likelihood a malicious actor removes my finger.
  - kibwen 9y ago
    1. Then you have the option not to use it, and always will (biometrics are used to augment passwords, not replace them). 2. Using passwords as a security measure increases the likelihood that a malicious actor will beat them out of you with a five-dollar wrench (and this does not mean that passwords are a bad idea).
  - deleted 9y ago
    [deleted]
  - kobeya 9y ago
    The iPhone has a liveness test as part of its biometric.
    - bdibs 9y ago

therobot24 9y ago

this is a common argument by those who do not understand biometrics a biometric is a username and a password - yes, i know the purpose is to say that the biometric should be used as a password, but that changes the declarative statement quite a bit in my opinion

alexhornbake 9y ago
I think it's a common argument for people who think biometrics are a bad idea for security. IE. You can change your password, you can't change your thumb/face/biometric (easily). At best, a fingerprint establishes identity, therefore it has more in common with a username, drivers license, social security number, etc. than it has in common with a password.
- rothbardrand 9y ago
  The problem is these people are thinking in terms of absolute security. Ideally you have a user name, a password, some sort of 2FA and also biometrics. But the alternative for iPhones was leaving them without even a PIN because entering a 4 digit numeric pin was too much hassle for most people... so Apple lowered the bar and increased security with biometrics. They are trying to do it again. If you want ultimate security ,then you can have a very long alphanumeric password, and turn off touchID and faceID
  - pishpash 9y ago
    Honestly, a biometric used solely on a device in your possession is not that bad. It is not being transmitted or stored remotely, which would be worse. But it would have been better if it were not a biometric that was being left everywhere.
- freehunter 9y ago
  >At best, a fingerprint establishes identity Nope. At best a fingerprint establishes identity in a unique and authoritative manner. My name is an identity, and anyone can say or write my name. My SSN is an identity, and anyone can say or write my SSN. No one else can speak, type, write, or otherwise express my fingerprint. That is far beyond simple "identity".

wavefunction 9y ago

I am more than the checksum of my whorls and curves, sir/madame!

TeMPOraL 9y ago
Not to the Machine, f45875e0b18fa3bb81e0739952acbea9ed458113. Get in line.

ballenf 9y ago

No, they're really not either. The whole username vs. password debate is like asking whether the key to your house is a username or password. Biometrics are used as the key that unlocks a device (or app or asset within the device). And like the house they require physical proximity. And, yes, just like the house key there's a decent chance that someone who lives near you has the same key type (device type -- apple/samsung/lg/etc.) and keying (fingerprint data points) on their front door (phone). But those odds are basically irrelevant as an attack surface. For a native app on a phone the "username" is proxied to the device id, once linked to the user. I think the article being 4 years old reflects a 4-year-old fear of the new and misapprehension of where security problems would arise in the future on biometrically locked phones.

SomeStupidPoint 9y ago
I can rekey my house locks, I can change my password, I can.... what my fingerprints? The reason that fingerprints are a username is that they're a static value associated with the identity of the person, which is later impossible to change. There's no reason you can't also use a username as a password (though there are lots of reasons you shouldn't), but it's clear that fingerprints are closer to username than password. By contrast, the key to your house is clearly a password -- it a changeable value used to authenticate to a mechanism that you're authorize to operate it.
- Bilal_io 9y ago
  But is a username really static? It is to some point until you decide to deactivate an account or abandon it in case you can't.
- freehunter 9y ago
  >I can rekey my house locks, I can change my password, I can.... what my fingerprints? Years of poor security have taught us that we need our authentication to be easily changeable in order to be secure. It's not true. Passwords need to be changed because they can be guessed. They can be leaked. Any person sitting down at any keyboard could type any random string of characters and, given enough time, figure out someone's password. It doesn't work the same for fingerprints. There is no number of times I can press my finger on your scanner and trick your scanner into thinking I am you. Your fingerprint only needs to be changed if someone steals your finger and keeps it in a state where modern fingerprint scanners will still recognize it. That is exceedingly difficult to do. We need to get it out of our mind that "we change our passwords regularly, we should change our fingerprints too". Bad security advice led to routine password expiration, and that bad security advice lives on. It's still bad. >it's clear that fingerprints are closer to username than password That is not clear in any way, either in theory or in practice. The entire argument works on "fingerprints are publicly visible and cannot be changed" which would suck for a password, but fingerprints are not a password. That's why there's an entirely different name for it. Yes, I can see your fingerprint. But TouchID isn't going to be fooled by a piece of scotch tape lifted from your desk, so it doesn't matter. Fingerprints are neither a username nor a password. They are a uniquely identifying attribute. Usernames and passwords are not. There is no comparison between the two authentication systems.

kibwen 9y ago

This overly simplifies things. Passwords are primary authentication, biometrics are secondary authentication. Biometrics should only be used when a password has already been established, and then only as a shortcut to entering that password; furthermore, authenticating via biometrics should put one into a limited-access state that disallows tampering with primary authentication mechanisms. The result is that anyone spoofing a fingerprint would be unable to completely own another device. The tradeoffs inherent to this are well-described elsewhere: a lower degree of absolute security in exchange for a higher proportion of users with any security at all; in lieu of the convenience offered by biometric authentication, enormous swaths of users leave themselves wide open. And since biometrics are just a convenience, anyone who does require absolute security can easily choose to forgo them entirely.

dustinkirkland 9y ago

Original author here. This article is more pertinent today than ever before! Your face is your username, not your password. Use it like you use your username. But never as something secret, personal, unknown like your password. The same goes for any biometric. Fingerprints, voice, iris, gait, DNA, etc. No matter how much they try to sell you authentication through biometrics, it's total b.s. @DustinKirkland

dogruck 9y ago
What about the face ID for women wearing the hijab. What is her username? Is it her publicly veiled face, or her private natural face? As people age, or are otherwise disfigured, does their username change?
EGreg 9y ago
I would like to offer my 2 cents. Biometrics are good for unlocking X if the persob who cares about the security of X is the person who oversees the registration of the biometrics. In this case you are the person and X is ... the phone. That's it, the phone. You should not be using biometrics-derived data for any passwords except to unlock your phone (or that place with the security guard making sure you registered your face the first time). Because REPLAY ATTACKS. After that you're supposed to use challenge-response by some auth app on a device. So your fingerprint IS a password for the device but not for external services. Passwords in general are vulnerable to replay attacks!
techno_modus 9y ago
The main property of fingerprints just like faces and other biometrics are supposed to be not detachable from the thing (person) they represent. Therefore the authentication processes based on them should somehow guarantee the presence of the person itself. Usernames on the other hand are separate entities and therefore it is necessary to provide a secret for authentication. A key from a house can be also passed to other persons and hence that person without any protection, and hence that person should additionally authenticate itself as a true owner.
curun1r 9y ago
I said this in a previous thread [1], but I'll restate here: Your face or fingerprint is neither your username nor your password. It's a form of identity. The combination of username and password is another form of identity. A certificate chain is another form of identity. Not all forms of identity are separated into two components like username and password. And different forms of identity have different properties and applicability. Trying to shoehorn a form of identity like a face or a fingerprint into the username/password template is counterproductive and will only add unnecessary confusion. Please stop. Dumbing down security and removing the nuance is how people get it horribly wrong. Security is very dependent on context. Authenticating with a phone is very different from authenticating over the internet which is very different from authenticating in a situation where you're physically present with another human being (credit card, bank teller, etc). Authentication schemes need to be designed for the specific use case in which they're used and no rule is universal. [1] https://news.ycombinator.com/item?id=15233454 https://news.ycombinator.com/item?id=15233454

grzm 9y ago

Discussion at the time (257 comments): https://news.ycombinator.com/item?id=6477505 https://news.ycombinator.com/item?id=6477505

abalone 9y ago

Why is this getting reposted? I’d argue this is very shortsighted especially coming from a security professional. TouchID has been a huge leap forward in consumer device security. Security design must take into account usability. Fingerprints (and now faces) make it easy to use stronger passcodes. If you don’t use biometrics, people use weak passcodes. That’s clearly a worse outcome. Sure, it’s even stronger to not use biometrics and enter a strong high entropy passcode every time you want to unlock your phone. But to actually advise something like that as a better approach in a consumer device than TouchID is simply to advocate a guaranteed worse security outcome. Maybe you “cover your ass” as a security acolyte and blame the compromised user for not following your stringent prescriptions, but that’s not owning the outcome. You have to consider usability.

russdpale 9y ago
Considering the law can compel you to use your fingerprint to unlock a device, it cannot do the same for a passcode, which only lives in your head. For this simple, pragmatic reason alone, a pass code will ALWAYS, 100% of the time, beat out any supposed biometric security advantage. Usability only goes so far, otherwise we wouldn't even have doors on our houses.
- abalone 9y ago
  First of all TouchID is layered on top of a passcode, so you still have good protection from being compelled to provide a fingerprint.[1] Second, you’re missing the point. Passcodes do not “always 100% of the time beat out” biometrics if the passcodes are weak or nonexistent. Which was the case prior to TouchID. [1] https://www.theverge.com/2017/8/17/16161758/ios-11-touch-id-disable-emergency-services-lock https://www.theverge.com/2017/8/17/16161758/ios-11-touch-id-...
- kalleboo 9y ago
  I'm not worried about the law, I'm worried about some guy shoulder-surfing my 6-digit PIN and then pickpocketing me.
- briandear 9y ago

13of40 9y ago

My mother's maiden name and the color of my first car are also usernames.

nodesocket 9y ago

Agree about fingerprints, as they are left around everywhere and thus easy to capture. However, FaceID should be significantly better. As Apple talked about, FaceID only works when your eyes are open and also tested/hardened against modeling.

deleted 9y ago
[deleted]

bandrami 9y ago

Fingerprints are tokens, just like usernames and passwords. Oddly enough, from a trust calculus standpoint usernames are not particularly valuable; we could do away with them entirely and the logic of authentication wouldn't change (though usernames add some very nice logistics that from a practical standpoint we don't want to give up). At a very basic level, a single token suffices to authenticate: something you have, know, or are does prove you are who you claim to be (usernames just give a convenient handle to that). So, a 1TP from a fob, a password, or a fingerprint at a very basic level is enough.

Spooky23 9y ago
Huh? Usernames are essential as they scope the credential. If you just uttered the magic word to a service logon page, anyone uttering the word gets in. You see the weakness in this type of scenario with Touch ID. If my wife's fingerprint is on my phone, she can access my Touch ID enrolled banking app.
- bandrami 9y ago
  > anyone uttering the word gets in. Right. That's how a speakeasy works. It's the most basic form of authorization

deleted 9y ago

[deleted]

devdoomari 9y ago

+1 on this though I use fingerprints on my laptop, I'm quite aware that it's really easy to leave any fingerprint anywhere (I use it because I type slow)

jkaljundi 9y ago

In the same way SSN's in the US are usernames, not passwords.

fujiters 9y ago

I'm don't even like the idea of biometrics for user names. I don't want malicious actors to easily correlate distinct accounts (this guy's fingerprint has an account at Facebook, Reddit, Chase Bank, ...).

oliwarner 9y ago

Something you have. Something you know. Something you are. The problem with the third factor has always been a balance between cost, inconvenience and how easy it is to turn it into just another something an attacker has. Retinographic analysis is gold standard but it's hellishly expensive. Fingerprints can be copied. Easily. Facial and behavioural analysis sit somewhere in the middle, with too much scope for false negatives. So fingerprints aren't a username or password because they're not that factor... But used alone, they can be as weak as a username, in many senses.

Fej 9y ago

Yes, but the author preaching to the choir. The real problem here is educating the public at large as to why it's insecure and in what situations biometrics are unacceptable.

IshKebab 9y ago
Is it? If say the public has a pretty good intuitive idea of the security properties of fingerprints. Better than the author here anyway who seems to think fingerprints are as easy to copy as usernames.
addHocker 9y ago
The problem is with how security is depcited and movies and television series. Cinmatographic Things will always recive more eye-candy value and feature bigger. So to educated the audience security wise, one would need to raise the eyecandy value of good passwords.

TwoBit 9y ago

I'd rather use my fingerprint on my phone than have a hacker look at the finger oil smudge patterns on the glass to decipher my password. And with my fingerprint I don't need to worry about hiding my password entry.