4 ms·

>i don't understand what your argument is about user IDs Names/User IDs are not equivalent to biometrics. Nor passwords. Nor tokens. They are symbols that exis

by xoa 8y ago

>i don't understand what your argument is about user IDs Names/User IDs are not equivalent to biometrics. Nor passwords. Nor tokens. They are symbols that exist to enhance human UX. That's it. >remember the context of the comment you criticized is that there are vulnerabilities in biometric security Yes, just like in every single form of authentication. Which is utterly irrelevant. >so if you're merely saying (as i think you are) that biometrics make poor usernames, much as they make poor passwords >that biometrics make better passwords than usernames, i'll reiterate: that's wrong. These are utterly non-sensical statements. Biometrics are not user names (a public symbol) nor are they passwords ("something you know"), "poor" has nothing to do with it, they are one of the other two classes of unique authentication factors. They have their own strengths and weaknesses, and yield different practical results when combined with one (or both) of the other two in a multi-factor authentication system. And a biometric/token MF system can absolutely be superior in security for many common threat scenarios and use cases compared to passwords. Achieving good security requires intelligent deployment of all 3.

modzu 8y ago
defined as such! good grief. anyone can code up a system that uses a fingerprint as a username -- you can't reply "thats not a username!" yes it is, because its defined as such! similarly, lots of applications use the fingerprint as both username and password, again defying your platonic ideal. you can go ahead and define the proper "taxonomy of authentication factors" but the whole irony is you think everyone has this biometric username/password false dichotomy when you fail to recognize that this dichotomy exists in the wild and often in really bad ways ;P
- modzu 8y ago
  to be clear i think we can basically agree on the fundamentals: the FFIEC guidelines where two or more of the three basic auth factors are used in combination (biometrics, usernames, and passwords are independent) and our argument is really about the best way to help everyone else who can only see 2 categories. this was fun.
- xoa 8y ago
  >anyone can code up a system that uses a fingerprint as a username Really? Please describe such a system. Will it use a photograph of the fingerprint? A hash value? What hash? How do you deterministically arrive at the exact same one each time, or do you plan to "change the user name every single time" and in that case what is the actual persistent pointer to the account/person? Do you expect people to then use that name in conversation or when they think about it? See, this makes no sense. That's not what "user names" are, it doesn't have any of the properties humans ascribe to them. >similarly, lots of applications use the fingerprint as both username and password Name them. Name one, for that matter. You seem very, very confused about all this but at this point I really don't know how to make it any clearer for you.
  - modzu 8y ago
    im sorry it doesnt make sense to you. when you said, "thats's not what usernames are" it became clear it's a linguistic issue. you are defining terms one way and i have defined them another way (that's fine) so that is why we cannot come to agreement on any corollary. the distinction is that you are sticking to the "formal" definitions, while i am using "functional" definitions. we agree (troll test #1) that auth factors can come in 3 flavors (for the 100th time): something you know, something you have, and something you are. according to this definition, a fingerprint goes into one bucket ("are") and a password goes into another bucket ("know"). peachy. BUT, fingerprints are also something else: GREASE. grease left on a handrail doesnt fit into any of these buckets. that doesnt mean its not a fingerprint! do you see the point? if you can appreciate that, and look at my comments through this lens, they might make sense. functionally, programmers are free to use "usernames" QUA "passwords" if they want to -- we can't just define that out of existence.
  - Phemist 8y ago
    Re the hash value. Are you aware of fuzzy commitment[1]? It is a crypto scheme for protecting and/or deriving encryption keys from data that is subject to noise (such as in biometrics). If you can derive encryption keys, you can also derive hashes. [1] https://dl.acm.org/citation.cfm?id=319714 https://dl.acm.org/citation.cfm?id=319714

by xoa 8y ago

modzu 8y ago

defined as such! good grief. anyone can code up a system that uses a fingerprint as a username -- you can't reply "thats not a username!" yes it is, because its defined as such! similarly, lots of applications use the fingerprint as both username and password, again defying your platonic ideal. you can go ahead and define the proper "taxonomy of authentication factors" but the whole irony is you think everyone has this biometric username/password false dichotomy when you fail to recognize that this dichotomy exists in the wild and often in really bad ways ;P

modzu 8y ago
to be clear i think we can basically agree on the fundamentals: the FFIEC guidelines where two or more of the three basic auth factors are used in combination (biometrics, usernames, and passwords are independent) and our argument is really about the best way to help everyone else who can only see 2 categories. this was fun.
xoa 8y ago
>anyone can code up a system that uses a fingerprint as a username Really? Please describe such a system. Will it use a photograph of the fingerprint? A hash value? What hash? How do you deterministically arrive at the exact same one each time, or do you plan to "change the user name every single time" and in that case what is the actual persistent pointer to the account/person? Do you expect people to then use that name in conversation or when they think about it? See, this makes no sense. That's not what "user names" are, it doesn't have any of the properties humans ascribe to them. >similarly, lots of applications use the fingerprint as both username and password Name them. Name one, for that matter. You seem very, very confused about all this but at this point I really don't know how to make it any clearer for you.
- modzu 8y ago
  im sorry it doesnt make sense to you. when you said, "thats's not what usernames are" it became clear it's a linguistic issue. you are defining terms one way and i have defined them another way (that's fine) so that is why we cannot come to agreement on any corollary. the distinction is that you are sticking to the "formal" definitions, while i am using "functional" definitions. we agree (troll test #1) that auth factors can come in 3 flavors (for the 100th time): something you know, something you have, and something you are. according to this definition, a fingerprint goes into one bucket ("are") and a password goes into another bucket ("know"). peachy. BUT, fingerprints are also something else: GREASE. grease left on a handrail doesnt fit into any of these buckets. that doesnt mean its not a fingerprint! do you see the point? if you can appreciate that, and look at my comments through this lens, they might make sense. functionally, programmers are free to use "usernames" QUA "passwords" if they want to -- we can't just define that out of existence.
- Phemist 8y ago
  Re the hash value. Are you aware of fuzzy commitment[1]? It is a crypto scheme for protecting and/or deriving encryption keys from data that is subject to noise (such as in biometrics). If you can derive encryption keys, you can also derive hashes. [1] https://dl.acm.org/citation.cfm?id=319714 https://dl.acm.org/citation.cfm?id=319714