7 ms·
Because the something you know part isn't all that secure anyway? https://xkcd.com/538/ https://xkcd.com/538/
by lugg 8y ago
Because the something you know part isn't all that secure anyway?
https://xkcd.com/538/ https://xkcd.com/538/
- bluGill 8y agoit is a different level of security. The comic is fully correct, but you should still use a secret. That is why there are 3 different types of authentication. The first is something you have - a card or key. The second is something you know - a password. The third is something you are - a fingerprint. Each provides protection against a different attack and is vulnerable to different attacks. The more important the secret the more of them you should use. Note that you quickly get to the point where you need more than one person involved. You can compromise one person as much as you want, but if that person doesn't have the complete secret it doesn't do any good.
- pps43 8y agoCalling a fingerprint "something you are" is a stretch. You are leaving fingerprints everywhere, they can be lifted from any smooth surface you touched (or even high-resolution photo) and then used to open biometric locks.
- rikkus 8y agoThe fingerprint belongs to you. Calling it 'something you are' is conveying this, without claim to it being somehow difficult to clone or entirely unique. Mother's maiden name is similar in this regard.
- dragonwriter 8y ago> The third is something you are - a fingerprint. A fingerprint isn't “something you are”, because it can be destroyed while you remain, and information about it can be captured and reproduced by attackers who are not you. It's just a particularly hard to lose (but easy to discover, and impractical to replace if compromised, at least more times than you have fingers) “something you have.” In security factor terms, I'm not convinced the idea of a distinct “something you are” category is coherent, since most candidates seem similar to that.
- bluGill 8y agoDNA is something you are.
- dllthomas 8y agoMaybe? Although not yet practical, in theory it too can be captured and reproduced.
- dragonwriter 8y agoThe reason DNA is useful as criminal evidence is you leave it everywhere; that makes it a horrible security factor: like fingerprints it's an impractical to replace wheb compromised “thing you have” that you leave everywhere for attackers.
- bluGill 8y agoThat is a very good reason to not use it alone. However when combined with other it provides a good indication that someone was actually there. Either that, or the attacker went through more effort to get the secrets.
- jiveturkey 8y ago"Something you are" is a term of art, not a very specific statement of fact to be legally overanalyzed. A fp is very much "something you are".
- dragonwriter 8y ago> "Something you are" is a term of art, Yes, what I am saying is that in practice what that term of art refers to is not an independent, orthogonal kind of security factor from “have” and “know” but a strictly worse form of “have”.
- NedIsakoff 8y agoI honestly think the better one would be: "Hit his wife and kids until he tells us the password." Much more effective.