3 ms·

I don't know where I read it, but it always stuck to me: identification is more like a username, not a password, and should be used as such.

by jerrre 8y ago

bluejekyll 8y ago
You’re right that usernames are an ID, the password allows the system to authenticate you are who you say you are (but it’s easily exploited). There’s no reason why biometrics can’t both Id and authn at the same time, as long as both functions have a high degree of confidence. Multi factor auth is probably always going to have its place. Where the confidence level is low in the authn, it must be increased by adding additional vectors.
jpalomaki 8y ago
I believe everybody knows fingerprints or face are not a perfect solution for unlocking mobile phones, but so far they seem to be the best option currently available (taking into account the ease of shoulder surfing and inconvenience of entering secure passwords on small screen).
- ascar 8y ago
  I'm not going to dispute shoulder surfing is a big problem for unlock patterns, but if you do not care about that attack vector patterns are super efficient and freakingly hard to brute-froce. Considering about 400k combinations [1] on a 3x3 board with a 30sec lockdown every 5 tries it will take on average about 14 days to unlock (given that the pattern is random enough). The average 4 digit pin is doable in about 8 hours on average. I'm willing to neglect the shoulder surfing attack vector as I feel I keep my phone sufficiently secure from pick pocketing and am not afraid of an "inside attack". Might definitely reconsider this, if I would have to carry a business phone with important secret information though. [1] https://math.stackexchange.com/questions/634437/how-many-combinations-does-android-pattern-have https://math.stackexchange.com/questions/634437/how-many-com...
  - pmoriarty 8y ago
    "I'm not going to dispute shoulder surfing is a big problem for unlock patterns..." I always liked the password alternative of showing the user a bunch of pictures or photos in random positions and have them select a number of them in sequence, perhaps showing a whole new set of pictures in between each selection. Humans tend to have much better visual memory than verbal memory, so they're able to remember this kind of sequence better than a password, especially if the pictures they select are somehow meaningful to them. This is also very difficult for someone to shoulder surf effectively, as they'll be seeing these pictures for the first time and the pictures won't have any meaning for them. I heard about this idea decades ago, but have never seen it implemented.
    - JetSpiegel 8y ago
      I think that's even easier to shoulder surf. Android allows pattern unlocks without showing the pattern as you type it, only on error. That's a good trade off.
  - Izkata 8y ago
    > Considering about 400k combinations [1] on a 3x3 board with a 30sec lockdown every 5 tries it will take on average about 14 days to unlock (given that the pattern is random enough). Not very imaginative. One of my brother's friends got into my brother's phone on the very first try by holding it up to a light and looking at the smudge pattern on the screen. A tapped-out 4-digit PIN would at least stop this method from working so easily.

I don't know where I read it, but it always stuck to me: identification is more like a username, not a password, and should be used as such.

by jerrre 8y ago

I don't know where I read it, but it always stuck to me: identification is more like a username, not a password, and should be used as such.

bluejekyll 8y ago

You’re right that usernames are an ID, the password allows the system to authenticate you are who you say you are (but it’s easily exploited). There’s no reason why biometrics can’t both Id and authn at the same time, as long as both functions have a high degree of confidence. Multi factor auth is probably always going to have its place. Where the confidence level is low in the authn, it must be increased by adding additional vectors.

jpalomaki 8y ago

I believe everybody knows fingerprints or face are not a perfect solution for unlocking mobile phones, but so far they seem to be the best option currently available (taking into account the ease of shoulder surfing and inconvenience of entering secure passwords on small screen).

ascar 8y ago
I'm not going to dispute shoulder surfing is a big problem for unlock patterns, but if you do not care about that attack vector patterns are super efficient and freakingly hard to brute-froce. Considering about 400k combinations [1] on a 3x3 board with a 30sec lockdown every 5 tries it will take on average about 14 days to unlock (given that the pattern is random enough). The average 4 digit pin is doable in about 8 hours on average. I'm willing to neglect the shoulder surfing attack vector as I feel I keep my phone sufficiently secure from pick pocketing and am not afraid of an "inside attack". Might definitely reconsider this, if I would have to carry a business phone with important secret information though. [1] https://math.stackexchange.com/questions/634437/how-many-combinations-does-android-pattern-have https://math.stackexchange.com/questions/634437/how-many-com...
- pmoriarty 8y ago
  "I'm not going to dispute shoulder surfing is a big problem for unlock patterns..." I always liked the password alternative of showing the user a bunch of pictures or photos in random positions and have them select a number of them in sequence, perhaps showing a whole new set of pictures in between each selection. Humans tend to have much better visual memory than verbal memory, so they're able to remember this kind of sequence better than a password, especially if the pictures they select are somehow meaningful to them. This is also very difficult for someone to shoulder surf effectively, as they'll be seeing these pictures for the first time and the pictures won't have any meaning for them. I heard about this idea decades ago, but have never seen it implemented.
  - JetSpiegel 8y ago
    I think that's even easier to shoulder surf. Android allows pattern unlocks without showing the pattern as you type it, only on error. That's a good trade off.
- Izkata 8y ago
  > Considering about 400k combinations [1] on a 3x3 board with a 30sec lockdown every 5 tries it will take on average about 14 days to unlock (given that the pattern is random enough). Not very imaginative. One of my brother's friends got into my brother's phone on the very first try by holding it up to a light and looking at the smudge pattern on the screen. A tapped-out 4-digit PIN would at least stop this method from working so easily.