7 ms·

They are as much a password as the key to your house is a password. And agree that Troy's description is best as it takes us away from unhelpful metaphors.

ben-schaaf 9y ago
I don't leave an impression of my keys on everything that I touch.
- nomel 9y ago
  If your fingerprint scanner is based on simple ridge profiles, then it's shouldn't be used for security. For example, some recent Apple keynotes claim they now use sub-dermal features for identification. Implementation matters more than what the sensor is authing with.
- Elvewyn 9y ago
  What if we did something like a mix of password + finger print, by using multiple fingers in a pattern? Like, say, middle - index - ring. It would be doubly unique.
  - maoej 9y ago
    It would be more unique but it would take away the convenience of having your phone unlocked nearly instantly with your finger. If you're going by security, a password plus fingerprint would be most secure but inconvenient.
foo101 9y ago
If you believe your key has been compromised (say duplicated), you can change the lock and your key. If you believe your fingerprint data has been compromised, can you change your fingerprint data?
- seandougall 9y ago
  As far as your phone is concerned, yes. Nine times, for most people.
  - curun1r 9y ago
    Believe it or not it's actually nineteen times, not nine. Though the last ten introduce a fair amount of inconvenience and eww-factor when unlocking your phone.
    - zingmars 9y ago
      I don't know about Apple phones, but I had luck getting my phone to unlock by using my chin. It wasn't really reliable (stopped working after a few hours, probably because of the beard growing), but I'm sure we can figure something out.
    - andrewingram 9y ago
      I tried using TouchID with my toes and it didn't really work.
    - valuearb 9y ago
      Being male, I actually have 21 digits, if you can stomach more inconvenience and eww-factor when unlocking a phone.
  - lazyjones 9y ago
    > Nine times, for most people. It's not too difficult to get access to the full 50000-odd combinations (see https://support.apple.com/en-us/HT204587 https://support.apple.com/en-us/HT204587 for where that number comes from) Apple hardware can identify with a little work. https://www.theguardian.com/technology/2014/dec/30/hacker-fakes-german-ministers-fingerprints-using-photos-of-her-hands https://www.theguardian.com/technology/2014/dec/30/hacker-fa...
    - bighi 9y ago
      You can only try a few before the phone locks itself, I believe.
SEJeff 9y ago
No. A key to your house can be easily changed. You can not change your biometrics without surgery, and even then, you still often can't really change them. biometrics make poor passwords.
- valuearb 9y ago
  Biometrics aren't passwords. They are unique identifiers and they make the best, most secure access control identifiers there are. Because security that people use is >> security people won't use
  - SEJeff 9y ago
    Right. Unique identifiers == usernames, NOT passwords. You can't change them, therefor they make poor secrets.

ben-schaaf 9y ago

I don't leave an impression of my keys on everything that I touch.

nomel 9y ago
If your fingerprint scanner is based on simple ridge profiles, then it's shouldn't be used for security. For example, some recent Apple keynotes claim they now use sub-dermal features for identification. Implementation matters more than what the sensor is authing with.
Elvewyn 9y ago
What if we did something like a mix of password + finger print, by using multiple fingers in a pattern? Like, say, middle - index - ring. It would be doubly unique.
- maoej 9y ago
  It would be more unique but it would take away the convenience of having your phone unlocked nearly instantly with your finger. If you're going by security, a password plus fingerprint would be most secure but inconvenient.

foo101 9y ago

If you believe your key has been compromised (say duplicated), you can change the lock and your key. If you believe your fingerprint data has been compromised, can you change your fingerprint data?

seandougall 9y ago
As far as your phone is concerned, yes. Nine times, for most people.
- curun1r 9y ago
  Believe it or not it's actually nineteen times, not nine. Though the last ten introduce a fair amount of inconvenience and eww-factor when unlocking your phone.
  - zingmars 9y ago
    I don't know about Apple phones, but I had luck getting my phone to unlock by using my chin. It wasn't really reliable (stopped working after a few hours, probably because of the beard growing), but I'm sure we can figure something out.
  - andrewingram 9y ago
    I tried using TouchID with my toes and it didn't really work.
  - valuearb 9y ago
    Being male, I actually have 21 digits, if you can stomach more inconvenience and eww-factor when unlocking a phone.
- lazyjones 9y ago
  > Nine times, for most people. It's not too difficult to get access to the full 50000-odd combinations (see https://support.apple.com/en-us/HT204587 https://support.apple.com/en-us/HT204587 for where that number comes from) Apple hardware can identify with a little work. https://www.theguardian.com/technology/2014/dec/30/hacker-fakes-german-ministers-fingerprints-using-photos-of-her-hands https://www.theguardian.com/technology/2014/dec/30/hacker-fa...
  - bighi 9y ago
    You can only try a few before the phone locks itself, I believe.

SEJeff 9y ago

No. A key to your house can be easily changed. You can not change your biometrics without surgery, and even then, you still often can't really change them. biometrics make poor passwords.

valuearb 9y ago
Biometrics aren't passwords. They are unique identifiers and they make the best, most secure access control identifiers there are. Because security that people use is >> security people won't use
- SEJeff 9y ago
  Right. Unique identifiers == usernames, NOT passwords. You can't change them, therefor they make poor secrets.