4 ms·

> Biometric IDs seem to be about as close to a perfect identification system as you can get. This seems a massive assertion that’s not qualified at all in the

by ixtli 8y ago

> Biometric IDs seem to be about as close to a perfect identification system as you can get. This seems a massive assertion that’s not qualified at all in the article. It was my understanding that biometrics in consumer hardware have always been easily circumvented and are largely about convenience.

thedufer 8y ago
I think you need to read that sentence with emphasis on "seem". They make this clear two sentences later: > In recent years, however, security researchers have demonstrated that it is possible to fool many, if not most, forms of biometric identification.
- Izkata 8y ago
  I've personally never considered them secure because of stuff like the gummi bear hack [0] popping up semi-regularly [1]. That they say "in recent years" researchers have demonstrated ways to fool them tells me these occurrences are less well-known than I thought. [0] https://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_fingerprint_sensors/ https://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_... [1] https://whatis.techtarget.com/definition/gummy-bear-hack https://whatis.techtarget.com/definition/gummy-bear-hack
jerrre 8y ago
I don't know where I read it, but it always stuck to me: identification is more like a username, not a password, and should be used as such.
- bluejekyll 8y ago
  You’re right that usernames are an ID, the password allows the system to authenticate you are who you say you are (but it’s easily exploited). There’s no reason why biometrics can’t both Id and authn at the same time, as long as both functions have a high degree of confidence. Multi factor auth is probably always going to have its place. Where the confidence level is low in the authn, it must be increased by adding additional vectors.
- jpalomaki 8y ago
  I believe everybody knows fingerprints or face are not a perfect solution for unlocking mobile phones, but so far they seem to be the best option currently available (taking into account the ease of shoulder surfing and inconvenience of entering secure passwords on small screen).
  - ascar 8y ago
    I'm not going to dispute shoulder surfing is a big problem for unlock patterns, but if you do not care about that attack vector patterns are super efficient and freakingly hard to brute-froce. Considering about 400k combinations [1] on a 3x3 board with a 30sec lockdown every 5 tries it will take on average about 14 days to unlock (given that the pattern is random enough). The average 4 digit pin is doable in about 8 hours on average. I'm willing to neglect the shoulder surfing attack vector as I feel I keep my phone sufficiently secure from pick pocketing and am not afraid of an "inside attack". Might definitely reconsider this, if I would have to carry a business phone with important secret information though. [1] https://math.stackexchange.com/questions/634437/how-many-combinations-does-android-pattern-have https://math.stackexchange.com/questions/634437/how-many-com...
    - pmoriarty 8y ago
      "I'm not going to dispute shoulder surfing is a big problem for unlock patterns..." I always liked the password alternative of showing the user a bunch of pictures or photos in random positions and have them select a number of them in sequence, perhaps showing a whole new set of pictures in between each selection. Humans tend to have much better visual memory than verbal memory, so they're able to remember this kind of sequence better than a password, especially if the pictures they select are somehow meaningful to them. This is also very difficult for someone to shoulder surf effectively, as they'll be seeing these pictures for the first time and the pictures won't have any meaning for them. I heard about this idea decades ago, but have never seen it implemented.
      - JetSpiegel 8y ago
        I think that's even easier to shoulder surf. Android allows pattern unlocks without showing the pattern as you type it, only on error. That's a good trade off.
chongli 8y ago
And honestly they're not that convenient. The Touch ID in my iPhone 8+ rejects my print at least a dozen times a day. On some days it rejects it many times in a row, forcing me to key in my unlock code. Research like this, while ostensibly threatening an increase in false positives (due to unauthorized use of fake prints), will in all likelihood cause vendors to tighten the confidence interval, leading to greatly increased false negatives. If my print is recognized less than half the time I'm just going to disable the feature.
- wingerlang 8y ago
  I didn't use it on my 5S, and thought FaceID and the fingerprint reading on the touch bar was very gimmicky until I got both of them. Now I can barely imagine living without them, unsafe or not.
- Angostura 8y ago
  Sounds like you should maybe retrain it. My iPhone 6, which has the older sensor tech is fine: unless my hands are wet
  - mauriciob 8y ago
    This is the problem I have. If there’s just a little sweat on my finger, it stops working.
    - tomalpha 8y ago
      Just for another piece of anecdata: mine used not to work if my finger was too dry... I resorted to everything up to and including licking the finger and retrying. Which, oddly, usually worked.
  - chongli 8y ago
    I retrain it all the time. It doesn't help. If there's any skin oil or sweat on the sensor it doesn't work. It also gets confused if there's any dead skin on my thumb, something that seems to happen pretty often (and I don't even play Nintendo anymore).
mbrumlow 8y ago
What did you expect. This is on vice.com. A sensationlist ajenda pushing entertainment news site. Why things posted from vice, vox and the likes are always shwoing up on HN I will never know.

by ixtli 8y ago

thedufer 8y ago

I think you need to read that sentence with emphasis on "seem". They make this clear two sentences later: > In recent years, however, security researchers have demonstrated that it is possible to fool many, if not most, forms of biometric identification.

Izkata 8y ago
I've personally never considered them secure because of stuff like the gummi bear hack [0] popping up semi-regularly [1]. That they say "in recent years" researchers have demonstrated ways to fool them tells me these occurrences are less well-known than I thought. [0] https://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_fingerprint_sensors/ https://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_... [1] https://whatis.techtarget.com/definition/gummy-bear-hack https://whatis.techtarget.com/definition/gummy-bear-hack

jerrre 8y ago

I don't know where I read it, but it always stuck to me: identification is more like a username, not a password, and should be used as such.

bluejekyll 8y ago
You’re right that usernames are an ID, the password allows the system to authenticate you are who you say you are (but it’s easily exploited). There’s no reason why biometrics can’t both Id and authn at the same time, as long as both functions have a high degree of confidence. Multi factor auth is probably always going to have its place. Where the confidence level is low in the authn, it must be increased by adding additional vectors.
jpalomaki 8y ago
I believe everybody knows fingerprints or face are not a perfect solution for unlocking mobile phones, but so far they seem to be the best option currently available (taking into account the ease of shoulder surfing and inconvenience of entering secure passwords on small screen).
- ascar 8y ago
  I'm not going to dispute shoulder surfing is a big problem for unlock patterns, but if you do not care about that attack vector patterns are super efficient and freakingly hard to brute-froce. Considering about 400k combinations [1] on a 3x3 board with a 30sec lockdown every 5 tries it will take on average about 14 days to unlock (given that the pattern is random enough). The average 4 digit pin is doable in about 8 hours on average. I'm willing to neglect the shoulder surfing attack vector as I feel I keep my phone sufficiently secure from pick pocketing and am not afraid of an "inside attack". Might definitely reconsider this, if I would have to carry a business phone with important secret information though. [1] https://math.stackexchange.com/questions/634437/how-many-combinations-does-android-pattern-have https://math.stackexchange.com/questions/634437/how-many-com...
  - pmoriarty 8y ago
    "I'm not going to dispute shoulder surfing is a big problem for unlock patterns..." I always liked the password alternative of showing the user a bunch of pictures or photos in random positions and have them select a number of them in sequence, perhaps showing a whole new set of pictures in between each selection. Humans tend to have much better visual memory than verbal memory, so they're able to remember this kind of sequence better than a password, especially if the pictures they select are somehow meaningful to them. This is also very difficult for someone to shoulder surf effectively, as they'll be seeing these pictures for the first time and the pictures won't have any meaning for them. I heard about this idea decades ago, but have never seen it implemented.
    - JetSpiegel 8y ago
      I think that's even easier to shoulder surf. Android allows pattern unlocks without showing the pattern as you type it, only on error. That's a good trade off.

chongli 8y ago

And honestly they're not that convenient. The Touch ID in my iPhone 8+ rejects my print at least a dozen times a day. On some days it rejects it many times in a row, forcing me to key in my unlock code. Research like this, while ostensibly threatening an increase in false positives (due to unauthorized use of fake prints), will in all likelihood cause vendors to tighten the confidence interval, leading to greatly increased false negatives. If my print is recognized less than half the time I'm just going to disable the feature.

wingerlang 8y ago
I didn't use it on my 5S, and thought FaceID and the fingerprint reading on the touch bar was very gimmicky until I got both of them. Now I can barely imagine living without them, unsafe or not.
Angostura 8y ago
Sounds like you should maybe retrain it. My iPhone 6, which has the older sensor tech is fine: unless my hands are wet
- mauriciob 8y ago
  This is the problem I have. If there’s just a little sweat on my finger, it stops working.
  - tomalpha 8y ago
    Just for another piece of anecdata: mine used not to work if my finger was too dry... I resorted to everything up to and including licking the finger and retrying. Which, oddly, usually worked.
- chongli 8y ago
  I retrain it all the time. It doesn't help. If there's any skin oil or sweat on the sensor it doesn't work. It also gets confused if there's any dead skin on my thumb, something that seems to happen pretty often (and I don't even play Nintendo anymore).

mbrumlow 8y ago

What did you expect. This is on vice.com. A sensationlist ajenda pushing entertainment news site. Why things posted from vice, vox and the likes are always shwoing up on HN I will never know.