3 ms·

Biometrics are UID's - not passcodes.

aroman 9y ago
I agree with you, but features like this are often the difference have some (decent) security and none at all. Consider the iPhone prior to TouchID. A lot of people used trivial passcodes, or no passcodes at all.
- MBCook 9y ago
  Apple had numbers a few years ago (2015?). It was something like 95% without passwords before TouchID and only 50% after TouchID. I know people who consider TouchID too much of a hassle. This doesn’t need to be a perfect solution, it just needs to be more secure than TouchID (claimed) and more secure than nothing (obviously) while being easy enough people won’t turn it off (we’ll see).
mikeash 9y ago
Biometrics are neither user IDs nor passcodes, they are biometrics and they have their own features, strengths, and weaknesses.
madeofpalk 9y ago
Literally the second paragraph > Face ID doesn’t replace your passcode, but provides easy access to iPhone X within thoughtful boundaries and time constraints. This is important because a strong passcode forms the foundation of your iOS device’s cryptographic protection.
- JumpCrisscross 9y ago
  Also, “ID” is literally in the name.
matthewmacleod 9y ago
Yes, we all know that. The difference is that they are a user ID which is somewhat difficult to lose, forget, or have stolen. No, it’s not impossible to clone a fingerprint that will fool Touch ID, but it’s not easy either. If we assume that Face ID will be roughly as difficult to fool, then we’ve actually got pretty good security here. It’s possinle that in some cases a secure passcode would be safer, and it’s great that you still have that option too. But security can only effective in the consumer market if it’s fairly frictionless; I’m unlikely to tolerate entering a long, complex passcode every time I want to use my phone, so I’d probably compromise on something shorter. If Touch/Face ID offers a more secure option, we all win!
runeks 9y ago
If a user ID is sufficiently long, there’s no practical difference between that and a passcode (it becomes a “login key” which both uniquely identifies the user and acts as a secret). If everyone in the world had a secret 128 bit user ID, we wouldn’t need passcodes. Having the iPhone X scan a device-specific, random pattern of the user’s face is somewhat close to that.

I agree with you, but features like this are often the difference have some (decent) security and none at all. Consider the iPhone prior to TouchID. A lot of people used trivial passcodes, or no passcodes at all.

MBCook 9y ago
Apple had numbers a few years ago (2015?). It was something like 95% without passwords before TouchID and only 50% after TouchID. I know people who consider TouchID too much of a hassle. This doesn’t need to be a perfect solution, it just needs to be more secure than TouchID (claimed) and more secure than nothing (obviously) while being easy enough people won’t turn it off (we’ll see).

mikeash 9y ago

Biometrics are neither user IDs nor passcodes, they are biometrics and they have their own features, strengths, and weaknesses.

madeofpalk 9y ago

Literally the second paragraph > Face ID doesn’t replace your passcode, but provides easy access to iPhone X within thoughtful boundaries and time constraints. This is important because a strong passcode forms the foundation of your iOS device’s cryptographic protection.

JumpCrisscross 9y ago
Also, “ID” is literally in the name.

matthewmacleod 9y ago

Yes, we all know that. The difference is that they are a user ID which is somewhat difficult to lose, forget, or have stolen. No, it’s not impossible to clone a fingerprint that will fool Touch ID, but it’s not easy either. If we assume that Face ID will be roughly as difficult to fool, then we’ve actually got pretty good security here. It’s possinle that in some cases a secure passcode would be safer, and it’s great that you still have that option too. But security can only effective in the consumer market if it’s fairly frictionless; I’m unlikely to tolerate entering a long, complex passcode every time I want to use my phone, so I’d probably compromise on something shorter. If Touch/Face ID offers a more secure option, we all win!

runeks 9y ago

If a user ID is sufficiently long, there’s no practical difference between that and a passcode (it becomes a “login key” which both uniquely identifies the user and acts as a secret). If everyone in the world had a secret 128 bit user ID, we wouldn’t need passcodes. Having the iPhone X scan a device-specific, random pattern of the user’s face is somewhat close to that.