8 ms·
Google and Microsoft Push Websites to Go Password-Less
- concerned_user 8y agoIt has been said many times already, biometric data is not a password it is a login/user name.
- evfanknitram 8y agoBut isn't it still a stronger form of authentication than the average password? I would not use it for authentication against the missile launch system, but my ex will probably not chop of my finger to access my Facebook account, nor will random bots trying to access my Gmail account.
- trumped 8y agonot really, because once it gets compromised, you are screwed because you can't really change it.
- Eyght 8y agoMaybe those people with facial tattoos are onto something.
- cornholio 8y agoYet, she can use 50$ kits to lift and scan a fingerprint from your belongings.
- UncleMeat 8y agoShe can, but the threat model here is so amazingly different than traditional threat models for username/pw that it is ridiculous to say that biometrics are usernames. Biometrics are biometrics. They are simply different. They have different threat models and failure modes than passwords. They are neither better nor worse.
- cornholio 8y agoIt's an analogy that captures the essence of the problem framed in a way most people can understand it: with biometrics there is no shared secret, just a high entropy, non-revocable and very public UID. Yes, public in a different model, with a different set of threats, but that's irrelevant to what the analogy is trying to convey. It's a human trait to evaluate and disseminate new concepts though existing concepts. Everything is unique, if you want to refine or disprove the analogy it's not enough to call it wrong repeatedly, you need to accept that specific frame of reference is suggestive to those who chose it, and formulate your arguments from that perspective.
- evfanknitram 8y agoSo it's more expensive than trying to guess which of my cats name I used as password then.
- curun1r 8y agoAnd it's been wrong every time. Biometric data is a form of identity, as is the combination of username and password. Different forms of identity have different security trade-offs and removing nuance by comparing it to a single component of different form of identity is always counter-productive. Biometric authentication is its own thing with its own security characteristics that need to be understood outside the context of what we know about usernames and passwords.
- csydas 8y agoWell, I think that's what people are mostly concerned about. The current considerations regarding biometrics is that it ultimately results in an immutable means of identification that cannot be revoked. With IRL identification (passports, driver's licenses, state issued IDs), these all have means of being revoked in some way with varying degrees of efficacy. Therein lies the issue with Biometric data being both username and password, for the most part. That most of the data is easily replicable aside, the fact is that you cannot control the cycle of your "credentials regeneration" since you're tied to the aging process. On top of that, the regeneration is even fairly predictable with current and past technology, and even non-technical solutions could accurately predict the physical changes in a person as they age. Biometric data is a matter of convenience, not really security. Combine with an additional password, it at least serves the role of a Username well. For low-value items, it can make sense, provided proper pre-cautions are taken for actually sensitive data. (e.g., unlocking your phone is fine provided that sensitive data is protected with additional precautions).
- dredmorbius 8y agoPasswords are bad. Fingerprints and face-recognition worse. I'm strongly in favour of very-near-field chips, at < 1cm range preferably. In a wearable form factor, these are replaceable but difficult to misplace or lose.
- lazycouchpotato 8y agoLike those on a debit/credit card, or like NFC on phones?
- dredmorbius 8y agoSomewhat. NFCRing is closest I've seen to what I think of. http://nfcring.com http://nfcring.com
- lazycouchpotato 8y agoWhile it might be convenient, someone could just steal your NFC device or skim the NFC chip and mirror it.
- iamnothere 8y agoProperly implemented, NFC auth provides a secure challenge-response mechanism with a private key, so mirroring would not be possible. Theft is a potential problem, but so is shoulder-surfing. At least if your auth token goes missing then you know you've been compromised.
- dredmorbius 8y agoBingo.
- trumped 8y agoIt might be <1cm with this antenna but someone else with a better antenna might be able to read it from 1m...
- ommunist 8y agofor Yubikey U2F WordPress plugin only Chrome currently is supported. The second point is - you cannot share fingerprints, while sharing passwords is common practice. I'd say, from UX point of view, Google and Microsoft initiative is bad for users.
- hirsin 8y agoCouple comments already on "websites shouldn't accept biometrics as a password". They're totally correct, and that's not what is being shown here. This is "websites accept hardware or software generated FIDO logins that have access to them intermediated by a combination of several factors including device presence, session login, and biometrics". The hard part is making that look and feel like "login with a fingerprint".
- magicalist 8y agoYeah, this is a bad article leading to a really bad discussion. FIDO2 is basically proposing to replace passwords with U2F. How the keys are generated, exchanged, and challenged has nothing to do with biometrics[1]. That part of this appears to be MS and Google demonstrations of using biometrics to unlock what is essentially just an OS password manager for U2F keys, which wouldn't even raise an eyebrow if found in today's Android or iOS. [1] The relevant part of the spec: "In order to provide evidence of user interaction, an external authenticator implementing this protocol is expected to have a mechanism to obtain a user gesture. Possible examples of user gestures include: as a consent button, password, a PIN, a biometric or a combination of these." https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-cl...
- JumpCrisscross 8y agoWhat happens when I lose or break all my devices?
- magicalist 8y ago> What happens when I lose or break all my devices? What happens when you use iOS's password generator and manager and you lose or break your phone? Or the same but with LastPass? You've either synced it or you lose all your passwords.
- JumpCrisscross 8y agoMy LastPass vault is protected with a master password. If I lose all my devices, I can restore from online using that. I’m just wondering how that would work in a password less schéma.
- shmerl 8y agoBiometrics should never be the only means of authentication. They can only be complimentary.
- titanix2 8y agoWhile it may be interesting from an ease of use point of view, I'm worried it is actually more of move from Google and Microsoft to get more lock-in on their OS and of the web.
- remir 8y agoTechnically, nothing prevents Apple and Mozilla (and others) from implementing this technology into their products.
- titanix2 8y agoSorry, I didn't details enough. I mean biometric data are gathered from the hardware through system API. This is where system vendors can restrict things, for example by exposing the API to some framework only (e.g. UWP) or even making them private.
- tajen 8y agoAnd exclude vendors who “don’t respect the rules”, whatever the future definition is, so that certain populations can’t access webapps.
- ThoAppelsin 8y agoUnless system vendors discriminate other browsers from their own browser in terms of the said restrictions, I would say that it is fair game. Following your example, if Microsoft were to require browsers use UWP framework to utilize the biometric authentication API, implementing the feature to Edge and not to Internet Explorer, would that be problematic?
- jpswade 8y agoBiometric can be used as an identifier but not as a password.
- toddh 8y agoI couldn't tell what data is leaking to the service provider. Are they gathering data on all these sessions?
- haspoken 8y agoNothing is free and now you will have to have an account with the service provider and whatever terms and service they choose.
- JoshMnem 8y agoIt sounds like a terrible idea. What if you don't have Android, Microsoft, Apple, or Amazon products, or even a smartphone at all? Smartphones collect too much information and it shouldn't be required to link all that data just to log in to websites.
- tootie 8y agoPlenty of sites provide multiple auth options. Like social login or email/pass. There's something to be said for not trusting ever site in the world to know how to secure a password database. In fact, many are outsourcing auth to companies like auth0 behind the scenes.
- jlgaddis 8y agoYubico wants people to go "passwordless" too -- and was also at RSA to pitch "passwordless login" [0] -- but wants you to use their new "Security Key" [1] (which supports both U2F and FIDO2) instead. Personally, I'd be more inclined to go this route (hardware key versus an app on my phone that uses my fingerprint or a facial scan). [0]: https://www.yubico.com/2018/04/yubico-rsa-2018-passwordless-logins-developer-programs/ https://www.yubico.com/2018/04/yubico-rsa-2018-passwordless-... [1]: https://www.yubico.com/product/security-key-by-yubico/ https://www.yubico.com/product/security-key-by-yubico/
- skywhopper 8y agoThis is nothing new, although there's perhaps no common standard implemented by all the players. However, while the process may be "simpler, securer ways to grant login access" from the users' perspectives, often these sorts of protocols become many times more complex to get right on the server side of things. Another worry is that this sort of approach will effectively hide the authentication mechanism from the user. So while I may make the choice to use notional biometric login to a Facebook app on my phone, knowing all the risks and compromises that come with having a Facebook account, I may not wish to use a Facebook login for other authenticated services unrelated to Facebook (when I'm confronted with the option to log in with Facebook, I always choose the other option, whatever it is, even if it's "give up on using this system/service").
- hirsin 8y agoAuthentication and Federated login shouldn't become the same thing, and FIDO doesn't move us closer to that. There's not a scenario where this becomes "silently login to Facebook and silently provide consent by clicking login" - users will still have to consciously click on "login with Facebook" at which point they can use FIDO to login to a Facebook property.
- tootie 8y agoIt seems to me that biometric passwords are convenient and better than a weak password, but much easier to compromise. Fingerprints can be lifted. Faces can be photographed.
- albertgoeswoof 8y agomore importantly, they can't be changed
- danielblazevski 8y agoGetting my fingerprints hacked sounds worse than getting my password hacked, I can’t change my fingerprint!
- Quarrelsome 8y agoAs long as you're still logging into the device using some form of information that can't be collected from you unconsciously its fine. Is that what it is? I hope that's what it is otherwise I'm going to need to buy some gloves.
- newnewpdro 8y agoAuthentication should always require something you know. Adding something you have/possess like a crypto device is a great way to enhance security, but it should always be a supplement to something you know - your password.
- amanzi 8y agoAs others have already mentioned, this article is a bit misleading. However, I'd like to point out the good work that Microsoft is already doing to enable "passwordless" logins. You can log in to your Windows PC with a PIN or biometrics, and you can log into many Microsoft web services using the Authenticator app on your smartphone. The upshot to this, is that you can set a much stronger account password knowing that you won't have to type it in that often. Google and Apple are lagging behind in this space - both require you to type in your full password way too often which leads customers to using weaker, easier to type passwords instead. Still a lot to improve in this space.