3 ms·

Biometrics are usernames not passwords. Biometrics should never be used on the sole authentication method they should only be used in conjunction with somethin

by syshum 9y ago

Biometrics are usernames not passwords. Biometrics should never be used on the sole authentication method they should only be used in conjunction with something else.

nobodyshere 9y ago
They realize that at Apple too. Face/Touch ID can be forcefully disabled for enterprise. However for an average Joe this is not a threat.
- tormeh 9y ago
  Can you require both face and password?
  - nobodyshere 9y ago
    No. As far as I know, there is no such device on the market. You can disable Face ID, but can't force it in combination with passcode, for example. Android allows you basically the same approach: any of the currently enabled methods. It is awkward though that there is no option to have that sort of 2FA for mobile devices, where at least two methods would be required, or strictly specified ones.
  - valuearb 9y ago
    That would be an extremely bad idea. In that scenario, imagine FaceID fails to recognize you, now you can't get into your device. Currently if FaceID fails, you have passcode as an alternative way into the device.
    - nobodyshere 9y ago
      Although fingerprint AND face/iris scan would probably add more confidence, with passcode as a reserve option.
adamlett 9y ago
Biometrics are usernames not passwords That such a meaningless slogan. Passwords and biometrics have different pros and cons, but they are the same in that they increase security. Biometrics should never be used on the sole authentication method * Biometrics is always better than no security. * Biometrics done well is certainly better than a 4-digit PIN. * Biometrics on an iDevice is in fact always used with something else, which is device itself: Touch/FaceID on an iPhone can only be used to access that particular iPhone. Ie. if you manage to steal my fingerprint, you can only use it to access the devices that I have set up to use my fingerprint. This means that my fingerprint alone is not of any value, unless you can also gain physical access to my phone. Compare this with a password which, if stolen, allows attackers on the other side of the globe to access to my accounts.
- syshum 9y ago
  >That such a meaningless slogan. Passwords and biometrics have different pros and cons, but they are the same in that they increase security. It is not a meaningless slogan, if Biometrics give the wider public a FALSE sense of security in that companies like Apple pitch them in unrealistic and inaccurate ways in their marketing that gives the average Joe the false idea that bio metrics are more secure than they really are, and secure more data that it really does. >Biometrics is always better than no security. That not only a pointless statement, but a False Dilemma Fallacy as well >Biometrics done well is certainly better than a 4-digit PIN. Done well is the key part, and again that is a False Dilemma Fallacy as you assume the choice is between a 4 digit pin and Biometrics, it is not > if you manage to steal my fingerprint, you can only use it to access the devices that I have set up to use my fingerprint. This means that my fingerprint alone is not of any value, unless you can also gain physical access to my phone. Compare this with a password which, if stolen, allows attackers on the other side of the globe to access to my accounts. it is funny you mention that because often time I see people set VERY insecure passwords because they believe that thei biometrics protects their password. So they set a insecure password "They will never use or need" because they relay biometrics and believe it provides all the security they need not just the security of the device, but since they only access their data from that device they are lulled in a false sense of security that the biometrics are protecting not only their device but ALL OF THEIR ACCOUNTS
audunw 9y ago
> Biometrics are usernames not passwords. Biometrics are biometrics. They're distinct from username and passwords. They can be used for low effort access control, the same way that most locks are easy to pick or bypass but are still useful to block crimes of opportunity.
Geee 9y ago
That something else is your device. Biometrics should never be used on remote systems.

by syshum 9y ago

Biometrics are usernames not passwords. Biometrics should never be used on the sole authentication method they should only be used in conjunction with something else.

nobodyshere 9y ago

They realize that at Apple too. Face/Touch ID can be forcefully disabled for enterprise. However for an average Joe this is not a threat.

tormeh 9y ago
Can you require both face and password?
- nobodyshere 9y ago
  No. As far as I know, there is no such device on the market. You can disable Face ID, but can't force it in combination with passcode, for example. Android allows you basically the same approach: any of the currently enabled methods. It is awkward though that there is no option to have that sort of 2FA for mobile devices, where at least two methods would be required, or strictly specified ones.
- valuearb 9y ago
  That would be an extremely bad idea. In that scenario, imagine FaceID fails to recognize you, now you can't get into your device. Currently if FaceID fails, you have passcode as an alternative way into the device.
  - nobodyshere 9y ago
    Although fingerprint AND face/iris scan would probably add more confidence, with passcode as a reserve option.

adamlett 9y ago

Biometrics are usernames not passwords That such a meaningless slogan. Passwords and biometrics have different pros and cons, but they are the same in that they increase security. Biometrics should never be used on the sole authentication method * Biometrics is always better than no security. * Biometrics done well is certainly better than a 4-digit PIN. * Biometrics on an iDevice is in fact always used with something else, which is device itself: Touch/FaceID on an iPhone can only be used to access that particular iPhone. Ie. if you manage to steal my fingerprint, you can only use it to access the devices that I have set up to use my fingerprint. This means that my fingerprint alone is not of any value, unless you can also gain physical access to my phone. Compare this with a password which, if stolen, allows attackers on the other side of the globe to access to my accounts.

syshum 9y ago
>That such a meaningless slogan. Passwords and biometrics have different pros and cons, but they are the same in that they increase security. It is not a meaningless slogan, if Biometrics give the wider public a FALSE sense of security in that companies like Apple pitch them in unrealistic and inaccurate ways in their marketing that gives the average Joe the false idea that bio metrics are more secure than they really are, and secure more data that it really does. >Biometrics is always better than no security. That not only a pointless statement, but a False Dilemma Fallacy as well >Biometrics done well is certainly better than a 4-digit PIN. Done well is the key part, and again that is a False Dilemma Fallacy as you assume the choice is between a 4 digit pin and Biometrics, it is not > if you manage to steal my fingerprint, you can only use it to access the devices that I have set up to use my fingerprint. This means that my fingerprint alone is not of any value, unless you can also gain physical access to my phone. Compare this with a password which, if stolen, allows attackers on the other side of the globe to access to my accounts. it is funny you mention that because often time I see people set VERY insecure passwords because they believe that thei biometrics protects their password. So they set a insecure password "They will never use or need" because they relay biometrics and believe it provides all the security they need not just the security of the device, but since they only access their data from that device they are lulled in a false sense of security that the biometrics are protecting not only their device but ALL OF THEIR ACCOUNTS

audunw 9y ago

> Biometrics are usernames not passwords. Biometrics are biometrics. They're distinct from username and passwords. They can be used for low effort access control, the same way that most locks are easy to pick or bypass but are still useful to block crimes of opportunity.

Geee 9y ago

That something else is your device. Biometrics should never be used on remote systems.