5 ms·

Biometrics will never be a password. It's got to be a combo of something you have and something you know.

by goda90 8y ago

zeta0134 8y ago
Agreed. Biometrics doesn't even quality as something you have. It's something that you are. If your physical key gets compromised in some way, you can generally have a new one issued. But you can't just re-issue your face.
- wlesieutre 8y ago
  You can, it’s just risky and expensive and probably not something you want to do.
- deleted 8y ago
  [deleted]
matt4077 8y ago
<something you have> + <something you know> = <something you are> Sounds ok to me, at least in the weird arithmetic of this tired talking point that invariable makes an appearance every time the subject is discussed, usually in a tone of letting us in on some great, newly discovered revelation.
- deleted 8y ago
  [deleted]
- kgwxd 8y ago
  It's hard to resist stating "1+1=2" when everyone knows it's true but keep behaving like its not.
  - mikeash 8y ago
    I don’t think people keep behaving like it’s not true. They just have different priorities. Yes, “something you have + something you know” is more secure, but security is not a binary thing, and people’s real world behaviors need to be accounted for. Before biometric authentication was available in cell phones, I had no passcode at all. My device’s security was just the physical security of the device itself. Constantly entering a passcode was just too much hassle, let alone a proper high-strength passcode. Moving to biometric authentication massively improved my security. Lots of people I know were in the same boat, or maybe had a four-digit passcode equal to their birthday and/or ATM PIN. It’s not foolproof but it’s good enough for almost everyone.
PeterisP 8y ago
On the other hand, biometrics is a quite decent username, better for this purpose than some nickname or email address.
- dragonwriter 8y ago
  > On the other hand, biometrics is a quite decent username, better for this purpose than some nickname or email address. Well, biometrics may be better than an a third-party email address in some cases (harder to lose throguht third-party action), but often worse than a first-party email address (e.g., Gmail for a Google account) or a nickname, for the same consideration.
- biometrics 8y ago
  Right you are!
PhasmaFelis 8y ago
The way it was explained to me is, a fingerprint (or whatever) is quite difficult to copy...but as soon as you scan it and send it over a network for verification, it's no longer a fingerprint but a datastream just like any other password, except that this is a password you can't change if it gets compromised. Therefore, biometrics can conceivably be useful if used cautiously on a single device or a well-secured local network. As soon as you start sending them over the public internet or anywhere else that it's possible for a hacker to intercept, all advantage is lost.
- leppr 8y ago
  One would hope it's properly salted before being sent over any kind of network.
- illumin8 8y ago
  If you're sending the biometric over the network you're doing it wrong. Apple uses a secure enclave and the biometric (fingerprint or facial scan) never gets extracted from the chip, ever.
bsenftner 8y ago
Within the security & digital forensics industry, it is best practices to require a minimum of 3 separate biometrics for anything requiring financial authentication capabilities. Apple is not respecting this best practice.
Andre607 8y ago
Biometrics is third-factor authentication (something you are). Its purpose is to supplement second-factor authentication (something you have), which is in turn meant to supplement first-factor authentication (something you know). You can also add a fourth factor (somewhere you are, or location) as an additional authentication factor as well. But it's this key point --that biometrics is meant to be one layer of multi-factor authentication -- which vendors seem to have ignored by conflating its function as supplement with its function as replacement, which it is decidedly not.
- edoo 8y ago
  It seems similar to a personal challenge question like "What is the name of your High School". Your face is public information, just like that knowledge, but can be used in a security process to statistically decrease security breaches.
ridgeguy 8y ago
It could be a combination of something you have (your face) and something you know (for example, that your right eyebrow has to be raised for face unlock to work).
- danlugo92 8y ago
  nice idea
dgzl 8y ago
Biometrics is a difficult-to-guess user_id and not much more.
kalleboo 8y ago
Still works better as authentication than a 4-digit PIN or 4-point unlock pattern that you're entering right infront of strangers tens of times a day.
ClassyJacket 8y ago
I disagree. It's far easier to look over somebody's shoulder as they type in their password than it is to 3D print a copy of their head. I think most of the disdain for biometrics on phones is because Apple were the ones to popularise it, and tech people hate anything Apple does.
- fmj 8y ago
  >I think most of the disdain for biometrics on phones is because Apple were the ones to popularise it, and tech people hate anything Apple does. I've been hearing the exact same arguments against biometrics in every thread on the topic long before Apple even did biometrics.

Biometrics will never be a password. It's got to be a combo of something you have and something you know.

by goda90 8y ago

Biometrics will never be a password. It's got to be a combo of something you have and something you know.

Agreed. Biometrics doesn't even quality as something you have. It's something that you are. If your physical key gets compromised in some way, you can generally have a new one issued. But you can't just re-issue your face.

wlesieutre 8y ago
You can, it’s just risky and expensive and probably not something you want to do.
deleted 8y ago
[deleted]

matt4077 8y ago

<something you have> + <something you know> = <something you are> Sounds ok to me, at least in the weird arithmetic of this tired talking point that invariable makes an appearance every time the subject is discussed, usually in a tone of letting us in on some great, newly discovered revelation.

deleted 8y ago
[deleted]
kgwxd 8y ago
It's hard to resist stating "1+1=2" when everyone knows it's true but keep behaving like its not.
- mikeash 8y ago
  I don’t think people keep behaving like it’s not true. They just have different priorities. Yes, “something you have + something you know” is more secure, but security is not a binary thing, and people’s real world behaviors need to be accounted for. Before biometric authentication was available in cell phones, I had no passcode at all. My device’s security was just the physical security of the device itself. Constantly entering a passcode was just too much hassle, let alone a proper high-strength passcode. Moving to biometric authentication massively improved my security. Lots of people I know were in the same boat, or maybe had a four-digit passcode equal to their birthday and/or ATM PIN. It’s not foolproof but it’s good enough for almost everyone.

PeterisP 8y ago

On the other hand, biometrics is a quite decent username, better for this purpose than some nickname or email address.

dragonwriter 8y ago
> On the other hand, biometrics is a quite decent username, better for this purpose than some nickname or email address. Well, biometrics may be better than an a third-party email address in some cases (harder to lose throguht third-party action), but often worse than a first-party email address (e.g., Gmail for a Google account) or a nickname, for the same consideration.
biometrics 8y ago
Right you are!

PhasmaFelis 8y ago

The way it was explained to me is, a fingerprint (or whatever) is quite difficult to copy...but as soon as you scan it and send it over a network for verification, it's no longer a fingerprint but a datastream just like any other password, except that this is a password you can't change if it gets compromised. Therefore, biometrics can conceivably be useful if used cautiously on a single device or a well-secured local network. As soon as you start sending them over the public internet or anywhere else that it's possible for a hacker to intercept, all advantage is lost.

leppr 8y ago
One would hope it's properly salted before being sent over any kind of network.
illumin8 8y ago
If you're sending the biometric over the network you're doing it wrong. Apple uses a secure enclave and the biometric (fingerprint or facial scan) never gets extracted from the chip, ever.

bsenftner 8y ago

Within the security & digital forensics industry, it is best practices to require a minimum of 3 separate biometrics for anything requiring financial authentication capabilities. Apple is not respecting this best practice.

Andre607 8y ago

Biometrics is third-factor authentication (something you are). Its purpose is to supplement second-factor authentication (something you have), which is in turn meant to supplement first-factor authentication (something you know). You can also add a fourth factor (somewhere you are, or location) as an additional authentication factor as well. But it's this key point --that biometrics is meant to be one layer of multi-factor authentication -- which vendors seem to have ignored by conflating its function as supplement with its function as replacement, which it is decidedly not.

edoo 8y ago
It seems similar to a personal challenge question like "What is the name of your High School". Your face is public information, just like that knowledge, but can be used in a security process to statistically decrease security breaches.

ridgeguy 8y ago

It could be a combination of something you have (your face) and something you know (for example, that your right eyebrow has to be raised for face unlock to work).

danlugo92 8y ago
nice idea

dgzl 8y ago

Biometrics is a difficult-to-guess user_id and not much more.

kalleboo 8y ago

Still works better as authentication than a 4-digit PIN or 4-point unlock pattern that you're entering right infront of strangers tens of times a day.

ClassyJacket 8y ago

I disagree. It's far easier to look over somebody's shoulder as they type in their password than it is to 3D print a copy of their head. I think most of the disdain for biometrics on phones is because Apple were the ones to popularise it, and tech people hate anything Apple does.

fmj 8y ago
>I think most of the disdain for biometrics on phones is because Apple were the ones to popularise it, and tech people hate anything Apple does. I've been hearing the exact same arguments against biometrics in every thread on the topic long before Apple even did biometrics.