4 ms·

We're seeing more biometric authentication with fingerprints, face recognition, perhaps retina scan. How do these methods perform in practice, considering both

We're seeing more biometric authentication with fingerprints, face recognition, perhaps retina scan. How do these methods perform in practice, considering both their contribution to security and their practical application? I currently authenticate on my iPhone with fingerprint. How hard is that to crack? If you had the victim's fingerprint, it's apparently trivial [1]. But accessing my fingerprint is not something that a random hacker/thief on the Internet would reasonably be able to do. Since our phones are becoming our life-key. Would a 3-factor authentication sufficiently protect us? Something you have: SmartPhone. Something you know: Password. Unique part of you: Fingerprint. [1] https://www.businessinsider.com/fingerprint-hacked-smartphones-2016-3 https://www.businessinsider.com/fingerprint-hacked-smartphon...

3pt14159 8y ago
Fingerprints are so fucking dumb. You can't change them and you leave them everywhere! They're good against stopping your nosy family members from seeing your password, but what am I supposed to do when dining or paying someone? Wear gloves? If the cybersec game turns into "collect physical fingerprints" then the gangs are going to collect physical fingerprints and then what? What we need is something dynamic that's hard to fake, like a human voice or face, tied to a government issued cryptographic device with no input ports / volatile memory / inbound network adapter. You say a challenge sentence out loud. The device validates. Then the device signs or authenticates or whatever. For integrity it could optionally encrypt and broadcast what happened. You lose the device, you get a new one just like you get a passport. In person with other documents, etc. This really isn't that hard. We could have done it decades ago.
- gregknicholson 8y ago
  > government issued cryptographic device I don't trust my government to be competent at cryptography. Some people don't trust their government to be non-malicious.
  - smnrchrds 8y ago
    > I don't trust my government to be competent at cryptography. Which government is it? If it is the US, you might as well not trust any cryptographic schemes, considering how many of them were developed by NSA.
    - gsich 8y ago
      Not the ones that "count" or should be used. Just look at the Dual_EC_DRBG desaster.
  - Avamander 8y ago
    But you trust your mobile operator more? Pfft.
  - 3pt14159 8y ago
    (Presuming you live in Canada, USA, EU, etc.) I just find this type of thinking pointless. We know for certain that we're getting hacked daily with constant identity theft and rather than have the same people that we entrust with our tanks, bombs, guns, lasers, and satellites to be competent at a simple key signing / rotating physical device we're going to what, use our fingerprints with our bank? No. A physical device that everyone has is going to be torn apart by everyone. The last place they'd put something malicious would be in something that diffuse.
- deleted 8y ago
  [deleted]
- politician 8y ago
  > You say a challenge sentence out loud. The device validates. ...This really isn't that hard. Last year Lyrebird (https://lyrebird.ai/ https://lyrebird.ai/) released a demo that cloned several Presidents' voices. So while I agree with you that fingerprints are a poor choice, voice isn't better.
  - 3pt14159 8y ago
    Well I didn't want to get bogged down in the details, but obviously I'm aware of this project and there is a ton of funding into adversarial ML and the artifacts that are generated by false voices are detectable. Even so, I appreciate the concern and it is one I share in the long run. Regardless—possession of the device is half the battle. Authentication of the individual is the other. Even if the authentication portion is broken at worse what this means is that someone that stole your device can impersonate you. Not great, but not enough of a reason to completely disqualify voice as a mechanism.
- tialaramex 8y ago
  Biometrics make sense when there's a trusted human there to oversee collection. Good luck giving the cops fake fingerprints when you're arrested for example, or trying to show the gate guard on a military base just a photograph of a regular visitor instead of your actual face. They're useless when you try to substitute some primitive bit of electronics, like those built-in print scanners. And so nobody should expect to use biometrics for Internet security.

3pt14159 8y ago

Fingerprints are so fucking dumb. You can't change them and you leave them everywhere! They're good against stopping your nosy family members from seeing your password, but what am I supposed to do when dining or paying someone? Wear gloves? If the cybersec game turns into "collect physical fingerprints" then the gangs are going to collect physical fingerprints and then what? What we need is something dynamic that's hard to fake, like a human voice or face, tied to a government issued cryptographic device with no input ports / volatile memory / inbound network adapter. You say a challenge sentence out loud. The device validates. Then the device signs or authenticates or whatever. For integrity it could optionally encrypt and broadcast what happened. You lose the device, you get a new one just like you get a passport. In person with other documents, etc. This really isn't that hard. We could have done it decades ago.

gregknicholson 8y ago
> government issued cryptographic device I don't trust my government to be competent at cryptography. Some people don't trust their government to be non-malicious.
- smnrchrds 8y ago
  > I don't trust my government to be competent at cryptography. Which government is it? If it is the US, you might as well not trust any cryptographic schemes, considering how many of them were developed by NSA.
  - gsich 8y ago
    Not the ones that "count" or should be used. Just look at the Dual_EC_DRBG desaster.
- Avamander 8y ago
  But you trust your mobile operator more? Pfft.
- 3pt14159 8y ago
  (Presuming you live in Canada, USA, EU, etc.) I just find this type of thinking pointless. We know for certain that we're getting hacked daily with constant identity theft and rather than have the same people that we entrust with our tanks, bombs, guns, lasers, and satellites to be competent at a simple key signing / rotating physical device we're going to what, use our fingerprints with our bank? No. A physical device that everyone has is going to be torn apart by everyone. The last place they'd put something malicious would be in something that diffuse.
deleted 8y ago
[deleted]
politician 8y ago
> You say a challenge sentence out loud. The device validates. ...This really isn't that hard. Last year Lyrebird (https://lyrebird.ai/ https://lyrebird.ai/) released a demo that cloned several Presidents' voices. So while I agree with you that fingerprints are a poor choice, voice isn't better.
- 3pt14159 8y ago
  Well I didn't want to get bogged down in the details, but obviously I'm aware of this project and there is a ton of funding into adversarial ML and the artifacts that are generated by false voices are detectable. Even so, I appreciate the concern and it is one I share in the long run. Regardless—possession of the device is half the battle. Authentication of the individual is the other. Even if the authentication portion is broken at worse what this means is that someone that stole your device can impersonate you. Not great, but not enough of a reason to completely disqualify voice as a mechanism.
tialaramex 8y ago
Biometrics make sense when there's a trusted human there to oversee collection. Good luck giving the cops fake fingerprints when you're arrested for example, or trying to show the gate guard on a military base just a photograph of a regular visitor instead of your actual face. They're useless when you try to substitute some primitive bit of electronics, like those built-in print scanners. And so nobody should expect to use biometrics for Internet security.