4 ms·
Why is this getting reposted? I’d argue this is very shortsighted especially coming from a security professional. TouchID has been a huge leap forward in consum
by abalone 9y ago
Why is this getting reposted? I’d argue this is very shortsighted especially coming from a security professional. TouchID has been a huge leap forward in consumer device security.
Security design must take into account usability. Fingerprints (and now faces) make it easy to use stronger passcodes. If you don’t use biometrics, people use weak passcodes. That’s clearly a worse outcome.
Sure, it’s even stronger to not use biometrics and enter a strong high entropy passcode every time you want to unlock your phone. But to actually advise something like that as a better approach in a consumer device than TouchID is simply to advocate a guaranteed worse security outcome. Maybe you “cover your ass” as a security acolyte and blame the compromised user for not following your stringent prescriptions, but that’s not owning the outcome. You have to consider usability.
- russdpale 9y agoConsidering the law can compel you to use your fingerprint to unlock a device, it cannot do the same for a passcode, which only lives in your head. For this simple, pragmatic reason alone, a pass code will ALWAYS, 100% of the time, beat out any supposed biometric security advantage. Usability only goes so far, otherwise we wouldn't even have doors on our houses.
- abalone 9y agoFirst of all TouchID is layered on top of a passcode, so you still have good protection from being compelled to provide a fingerprint.[1] Second, you’re missing the point. Passcodes do not “always 100% of the time beat out” biometrics if the passcodes are weak or nonexistent. Which was the case prior to TouchID. [1] https://www.theverge.com/2017/8/17/16161758/ios-11-touch-id-disable-emergency-services-lock https://www.theverge.com/2017/8/17/16161758/ios-11-touch-id-...
- kalleboo 9y agoI'm not worried about the law, I'm worried about some guy shoulder-surfing my 6-digit PIN and then pickpocketing me.
- briandear 9y agoI’m not sure why protecting my device from the police is that big of an issue. I’m not worried about cops stealing my phone and buying stuff using Apple Pay. And to use your door metaphor, do we install doors to keep our the police? Is that really the average person’s concern? You make it sound like everyone is a drug trafficker or some kind of mobster. I don’t lock my doors to keep out the police; I lock them to keep out criminals that want to steal my stuff.
- valuearb 9y agoConsidering that most people don't use secure passcodes, for the entire population of users biometrics will ALWAYS, 100% of the time, beat out any supposed passcode security advantage.