4 ms·

Original author here. This article is more pertinent today than ever before! Your face is your username, not your password. Use it like you use your username

Original author here. This article is more pertinent today than ever before! Your face is your username, not your password. Use it like you use your username. But never as something secret, personal, unknown like your password. The same goes for any biometric. Fingerprints, voice, iris, gait, DNA, etc. No matter how much they try to sell you authentication through biometrics, it's total b.s. @DustinKirkland

dogruck 9y ago
What about the face ID for women wearing the hijab. What is her username? Is it her publicly veiled face, or her private natural face? As people age, or are otherwise disfigured, does their username change?
EGreg 9y ago
I would like to offer my 2 cents. Biometrics are good for unlocking X if the persob who cares about the security of X is the person who oversees the registration of the biometrics. In this case you are the person and X is ... the phone. That's it, the phone. You should not be using biometrics-derived data for any passwords except to unlock your phone (or that place with the security guard making sure you registered your face the first time). Because REPLAY ATTACKS. After that you're supposed to use challenge-response by some auth app on a device. So your fingerprint IS a password for the device but not for external services. Passwords in general are vulnerable to replay attacks!
techno_modus 9y ago
The main property of fingerprints just like faces and other biometrics are supposed to be not detachable from the thing (person) they represent. Therefore the authentication processes based on them should somehow guarantee the presence of the person itself. Usernames on the other hand are separate entities and therefore it is necessary to provide a secret for authentication. A key from a house can be also passed to other persons and hence that person without any protection, and hence that person should additionally authenticate itself as a true owner.
curun1r 9y ago
I said this in a previous thread [1], but I'll restate here: Your face or fingerprint is neither your username nor your password. It's a form of identity. The combination of username and password is another form of identity. A certificate chain is another form of identity. Not all forms of identity are separated into two components like username and password. And different forms of identity have different properties and applicability. Trying to shoehorn a form of identity like a face or a fingerprint into the username/password template is counterproductive and will only add unnecessary confusion. Please stop. Dumbing down security and removing the nuance is how people get it horribly wrong. Security is very dependent on context. Authenticating with a phone is very different from authenticating over the internet which is very different from authenticating in a situation where you're physically present with another human being (credit card, bank teller, etc). Authentication schemes need to be designed for the specific use case in which they're used and no rule is universal. [1] https://news.ycombinator.com/item?id=15233454 https://news.ycombinator.com/item?id=15233454
Accacin 9y ago
Any stats for how many phones with Touch ID enabled have been compromised since you wrote this article? I've got a feeling it's zero. In your article you wrote how incredibly easy it is, so why haven't I heard about it happening?
bighi 9y ago
My password is my password. My face is not my password, it is my face. This kind of weak analogy you're trying only weakens the discussion.
JunkDNA 9y ago
My big issue with this argument is that usernames and passwords are a means to an end. That end is (in many cases) establishing identity. One can establish identity in other ways. For example: every morning when I open the door to my house after my early morning run, my wife greets me in the kitchen and asks me how my run was. She (thankfully) does not hit me on the head with a frying pan and call the cops about an intruder. My biometrics work awesome for establishing that I'm "me" in the real world. I don't think it's too big a stretch to imagine a world where my computer is as good at looking at me and identifying that I'm "me" as my wife.

dogruck 9y ago

What about the face ID for women wearing the hijab. What is her username? Is it her publicly veiled face, or her private natural face? As people age, or are otherwise disfigured, does their username change?

EGreg 9y ago

I would like to offer my 2 cents. Biometrics are good for unlocking X if the persob who cares about the security of X is the person who oversees the registration of the biometrics. In this case you are the person and X is ... the phone. That's it, the phone. You should not be using biometrics-derived data for any passwords except to unlock your phone (or that place with the security guard making sure you registered your face the first time). Because REPLAY ATTACKS. After that you're supposed to use challenge-response by some auth app on a device. So your fingerprint IS a password for the device but not for external services. Passwords in general are vulnerable to replay attacks!

techno_modus 9y ago

The main property of fingerprints just like faces and other biometrics are supposed to be not detachable from the thing (person) they represent. Therefore the authentication processes based on them should somehow guarantee the presence of the person itself. Usernames on the other hand are separate entities and therefore it is necessary to provide a secret for authentication. A key from a house can be also passed to other persons and hence that person without any protection, and hence that person should additionally authenticate itself as a true owner.

curun1r 9y ago

I said this in a previous thread [1], but I'll restate here: Your face or fingerprint is neither your username nor your password. It's a form of identity. The combination of username and password is another form of identity. A certificate chain is another form of identity. Not all forms of identity are separated into two components like username and password. And different forms of identity have different properties and applicability. Trying to shoehorn a form of identity like a face or a fingerprint into the username/password template is counterproductive and will only add unnecessary confusion. Please stop. Dumbing down security and removing the nuance is how people get it horribly wrong. Security is very dependent on context. Authenticating with a phone is very different from authenticating over the internet which is very different from authenticating in a situation where you're physically present with another human being (credit card, bank teller, etc). Authentication schemes need to be designed for the specific use case in which they're used and no rule is universal. [1] https://news.ycombinator.com/item?id=15233454 https://news.ycombinator.com/item?id=15233454

Accacin 9y ago

Any stats for how many phones with Touch ID enabled have been compromised since you wrote this article? I've got a feeling it's zero. In your article you wrote how incredibly easy it is, so why haven't I heard about it happening?

bighi 9y ago

My password is my password. My face is not my password, it is my face. This kind of weak analogy you're trying only weakens the discussion.

JunkDNA 9y ago

My big issue with this argument is that usernames and passwords are a means to an end. That end is (in many cases) establishing identity. One can establish identity in other ways. For example: every morning when I open the door to my house after my early morning run, my wife greets me in the kitchen and asks me how my run was. She (thankfully) does not hit me on the head with a frying pan and call the cops about an intruder. My biometrics work awesome for establishing that I'm "me" in the real world. I don't think it's too big a stretch to imagine a world where my computer is as good at looking at me and identifying that I'm "me" as my wife.