4 ms·

Yes. We should think about our fingerprints as a userid, not as a password.

xoa 8y ago
No, we shouldn't because that is entirely wrong. "corpMaverick" is a user ID. Your real name could be a form of user ID. "Something you are" is not a user ID. For root's sake, are you really actually thinking it through when you say stuff like this? In one breath your argument is "well biometrics aren't changeable so not like passwords" then you suggest it is equivalent to user IDs which by definition are all changeable, since they are essentially aesthetic symbolic pointers towards primary keys and bundles of identity. How easily or not any given entity makes it to change pointers in their own sphere varies based on subjective goals and tradeoffs, but there is nothing fundamental about it.
- modzu 8y ago
  wow dude i duno if the comments have been edited, but that's wrong. biometrics are much more like usernames than passwords. its a common sentiment among those educated in security
  - xoa 8y ago
    It's a common sentiment amongst those who think they're educated about security. Just like "rotate passwords at rapid intervals and you must satisfy this baroque complex set of requirements for them too" is common sentiment. Unfortunately.
    - modzu 8y ago
      i think we agree more than it might seem, but i can't tell. sure those types of requirements are often absurd and result of ignorance. but back to the point, i don't understand what your argument is about user IDs. remember the context of the comment you criticized is that there are vulnerabilities in biometric security. those vulnerabilities apply when the biometric data is used as a password; it does not apply when the biometric is a username. so if you're merely saying (as i think you are) that biometrics make poor usernames, much as they make poor passwords, your argument is quite trivial/tangential to this thread and really doesn't address the point op is making and doesn't contribute to the thread in any meaningful way (unless you wanted to expound specifically on why its so important for usernames to be, mutable?) and if, instead, you're saying, as you implied to me, that biometrics make better passwords than usernames, i'll reiterate: that's wrong.
      - modzu 8y ago
        having read some of your other comments maybe you're making a point about UX -- where the tradeoff between a biometric password or some long and obtuse string of characters (which is thus more likely to be saved in the browser or written on a sticky note) is not as obvious as it seems: which is worse? that's a valid point. and then about usernames: maybe you're just saying, hey i can't just swipe my finger at gmail.com because which gmail account am i logging into? do i need 1 finger for each account (business, personal, etc)? lol that's kind of valid point too but nobody is proposing that the biometric identifier is the only part of the username anymore than your browser fingerprint is (which google does indeed utilize; sign in from somewhere else and you'll get 2FA vs on your own device, etc etc). think of your biometric data more like your phone number in 2fa. its yours and can help to verify your identify but its not secret and your authenticator should be secret
      - xoa 8y ago
        >i don't understand what your argument is about user IDs Names/User IDs are not equivalent to biometrics. Nor passwords. Nor tokens. They are symbols that exist to enhance human UX. That's it. >remember the context of the comment you criticized is that there are vulnerabilities in biometric security Yes, just like in every single form of authentication. Which is utterly irrelevant. >so if you're merely saying (as i think you are) that biometrics make poor usernames, much as they make poor passwords >that biometrics make better passwords than usernames, i'll reiterate: that's wrong. These are utterly non-sensical statements. Biometrics are not user names (a public symbol) nor are they passwords ("something you know"), "poor" has nothing to do with it, they are one of the other two classes of unique authentication factors. They have their own strengths and weaknesses, and yield different practical results when combined with one (or both) of the other two in a multi-factor authentication system. And a biometric/token MF system can absolutely be superior in security for many common threat scenarios and use cases compared to passwords. Achieving good security requires intelligent deployment of all 3.
        modzu 8y ago
        defined as such! good grief. anyone can code up a system that uses a fingerprint as a username -- you can't reply "thats not a username!" yes it is, because its defined as such! similarly, lots of applications use the fingerprint as both username and password, again defying your platonic ideal. you can go ahead and define the proper "taxonomy of authentication factors" but the whole irony is you think everyone has this biometric username/password false dichotomy when you fail to recognize that this dichotomy exists in the wild and often in really bad ways ;P
- philipodonnell 8y ago
  > user IDs which by definition are all changeable, since they are essentially aesthetic symbolic pointers towards primary keys and bundles of identity Citation needed? A fingerprint can absolutely be used to generate a hash that functions as a pointer to primary keys.
  - xoa 8y ago
    Are you seriously arguing a fingerprint is an aesthetic symbolic pointer in the way a name is? That you are going to just refer to other people (whether IRL or online) by "fingerprint"? That people choose their fingerprints based on what they think will be a good one? That there can just be a simple process to arbitrarily change their fingerprint if they later decide they'd prefer another one? Because all of those apply to user IDs.
    - opless 8y ago
      Not trolling, but pouring more oil on the fire... TLDR yes, biometrics are the closest thing to a user ID > Are you seriously arguing a fingerprint is an aesthetic symbolic pointer in the way a name is? Absolutely. A given name is non-unique, and not chosen by you. Yet everyone refers you by it, if only by convention. > That you are going to just refer to other people (whether IRL or online) by "fingerprint"? No but computers might as well do, much as you identify someone by their face. You might refer to someone by their public key fingerprint too (also similarly non-collision resistant) > That people choose their fingerprints based on what they think will be a good one? People rarely choose their names, nicknames, or usernames. Why is choice an issue here? > That there can just be a simple process to arbitrarily change their fingerprint if they later decide they'd prefer another one? People find it difficult to arbitrarily change their face, most are reluctant to change their given names - and indeed there's significant pressure from 'the system' to make it difficult for you, and also what about the many who find it annoying when their preferred username is unavailable, etc. I can't see what your point is here? > Because all of those apply to user IDs. A user id, isn't a primary key in the real world - only when it comes to a particular computer system. Finally your fingerprints do change over time, though not necessarily in a manner which will confuse current matching techniques

xoa 8y ago

No, we shouldn't because that is entirely wrong. "corpMaverick" is a user ID. Your real name could be a form of user ID. "Something you are" is not a user ID. For root's sake, are you really actually thinking it through when you say stuff like this? In one breath your argument is "well biometrics aren't changeable so not like passwords" then you suggest it is equivalent to user IDs which by definition are all changeable, since they are essentially aesthetic symbolic pointers towards primary keys and bundles of identity. How easily or not any given entity makes it to change pointers in their own sphere varies based on subjective goals and tradeoffs, but there is nothing fundamental about it.

modzu 8y ago
wow dude i duno if the comments have been edited, but that's wrong. biometrics are much more like usernames than passwords. its a common sentiment among those educated in security
- xoa 8y ago
  It's a common sentiment amongst those who think they're educated about security. Just like "rotate passwords at rapid intervals and you must satisfy this baroque complex set of requirements for them too" is common sentiment. Unfortunately.
  - modzu 8y ago
    i think we agree more than it might seem, but i can't tell. sure those types of requirements are often absurd and result of ignorance. but back to the point, i don't understand what your argument is about user IDs. remember the context of the comment you criticized is that there are vulnerabilities in biometric security. those vulnerabilities apply when the biometric data is used as a password; it does not apply when the biometric is a username. so if you're merely saying (as i think you are) that biometrics make poor usernames, much as they make poor passwords, your argument is quite trivial/tangential to this thread and really doesn't address the point op is making and doesn't contribute to the thread in any meaningful way (unless you wanted to expound specifically on why its so important for usernames to be, mutable?) and if, instead, you're saying, as you implied to me, that biometrics make better passwords than usernames, i'll reiterate: that's wrong.
    - modzu 8y ago
      having read some of your other comments maybe you're making a point about UX -- where the tradeoff between a biometric password or some long and obtuse string of characters (which is thus more likely to be saved in the browser or written on a sticky note) is not as obvious as it seems: which is worse? that's a valid point. and then about usernames: maybe you're just saying, hey i can't just swipe my finger at gmail.com because which gmail account am i logging into? do i need 1 finger for each account (business, personal, etc)? lol that's kind of valid point too but nobody is proposing that the biometric identifier is the only part of the username anymore than your browser fingerprint is (which google does indeed utilize; sign in from somewhere else and you'll get 2FA vs on your own device, etc etc). think of your biometric data more like your phone number in 2fa. its yours and can help to verify your identify but its not secret and your authenticator should be secret
    - xoa 8y ago
      >i don't understand what your argument is about user IDs Names/User IDs are not equivalent to biometrics. Nor passwords. Nor tokens. They are symbols that exist to enhance human UX. That's it. >remember the context of the comment you criticized is that there are vulnerabilities in biometric security Yes, just like in every single form of authentication. Which is utterly irrelevant. >so if you're merely saying (as i think you are) that biometrics make poor usernames, much as they make poor passwords >that biometrics make better passwords than usernames, i'll reiterate: that's wrong. These are utterly non-sensical statements. Biometrics are not user names (a public symbol) nor are they passwords ("something you know"), "poor" has nothing to do with it, they are one of the other two classes of unique authentication factors. They have their own strengths and weaknesses, and yield different practical results when combined with one (or both) of the other two in a multi-factor authentication system. And a biometric/token MF system can absolutely be superior in security for many common threat scenarios and use cases compared to passwords. Achieving good security requires intelligent deployment of all 3.
      - modzu 8y ago
        defined as such! good grief. anyone can code up a system that uses a fingerprint as a username -- you can't reply "thats not a username!" yes it is, because its defined as such! similarly, lots of applications use the fingerprint as both username and password, again defying your platonic ideal. you can go ahead and define the proper "taxonomy of authentication factors" but the whole irony is you think everyone has this biometric username/password false dichotomy when you fail to recognize that this dichotomy exists in the wild and often in really bad ways ;P
philipodonnell 8y ago
> user IDs which by definition are all changeable, since they are essentially aesthetic symbolic pointers towards primary keys and bundles of identity Citation needed? A fingerprint can absolutely be used to generate a hash that functions as a pointer to primary keys.
- xoa 8y ago
  Are you seriously arguing a fingerprint is an aesthetic symbolic pointer in the way a name is? That you are going to just refer to other people (whether IRL or online) by "fingerprint"? That people choose their fingerprints based on what they think will be a good one? That there can just be a simple process to arbitrarily change their fingerprint if they later decide they'd prefer another one? Because all of those apply to user IDs.
  - opless 8y ago
    Not trolling, but pouring more oil on the fire... TLDR yes, biometrics are the closest thing to a user ID > Are you seriously arguing a fingerprint is an aesthetic symbolic pointer in the way a name is? Absolutely. A given name is non-unique, and not chosen by you. Yet everyone refers you by it, if only by convention. > That you are going to just refer to other people (whether IRL or online) by "fingerprint"? No but computers might as well do, much as you identify someone by their face. You might refer to someone by their public key fingerprint too (also similarly non-collision resistant) > That people choose their fingerprints based on what they think will be a good one? People rarely choose their names, nicknames, or usernames. Why is choice an issue here? > That there can just be a simple process to arbitrarily change their fingerprint if they later decide they'd prefer another one? People find it difficult to arbitrarily change their face, most are reluctant to change their given names - and indeed there's significant pressure from 'the system' to make it difficult for you, and also what about the many who find it annoying when their preferred username is unavailable, etc. I can't see what your point is here? > Because all of those apply to user IDs. A user id, isn't a primary key in the real world - only when it comes to a particular computer system. Finally your fingerprints do change over time, though not necessarily in a manner which will confuse current matching techniques