4 ms·

Why are we still trying to do biometric security? - Biometrics are public, unlike passwords. Biometric data can usually be gathered from a person, often discre

by tbabb 8y ago

Why are we still trying to do biometric security? - Biometrics are public, unlike passwords. Biometric data can usually be gathered from a person, often discreetly, by cameras or whatever other sensors are used for authentication, and replayed with sufficient effort to fool the same sensors. - Biometrics are not revokable, unlike passwords. If you give your biometric data to someone and they mishandle it, it's compromised for life. - Biometrics cannot be uniquified for different authenticators, which is like using the same password for every service-- terribly insecure. - Biometrics pose secondary privacy concerns, because they inherently destroy anonymity. Why is this still a thing?

B-Con 8y ago
> Why is this still a thing? Because it's cool and the people building it often aren't security experts.
- opless 8y ago
  And because the people wanting it don't listen to experts either.
yholio 8y ago
>Biometric data can usually be gathered from a person, often discreetly Not only that, but merely authenticating a user into the system will always produce a full duplicate of their secret. So unless all terminals have the same clearance level, any compromised terminal allows for escalation. Since the number of biometric markers is limited, you are bound to have overlap, hence this ridiculous race towards more exotic and extreme biometrics like "vein auth".
Freak_NL 8y ago
Because of the convenience, and because Apple and Google have managed to convince users that it is safe enough for them. Most people only encounter biometrics on their smartphone, where it prevents unwanted access by others, and acts as a master-password. Most people feel that they are never going to be the target of anyone capable of bypassing the biometric security of their device, and are more then happy to make their fingerprint or face the key to their castle. They also don't really have any alternative. Entering passwords is a chore on those devices, and the PIN or swipe pattern is way too easy to observe by a would-be adversary (which often includes family members or others near to the owner who want to explore (saucy) photos taken and texts sent).
- Pawamoy 8y ago
  About the SWIPE pattern: on Android 8.1 I can completely hide it. You don't see the dots, you don't see the drawn lines, you don't the pattern in case of error. The only thing that I still cannot hide is the vibration when I hit a dot. I also specifically chosen a pattern that goes through the same dot two or more times, to confuse even more a potential observer. I tested it with friends: I let them observe when I unlock my device, and ask them to try and unlock it. Not one has managed to unlock it.
stewbrew 8y ago
Such kind of biometric authentication sometimes/often is used in combination with something else - a pin, password etc. You then get authenticated by something that matches your body and a secret.
imron 8y ago
> Why is this still a thing? Movies.
IshKebab 8y ago
This is the "binary view" of security that many programmers hold. Either something is 100% secure or out can be broken and is effectively 0% secure. Of course the real world is not like that. Biometrics add a real later of security even though they are not theoretically perfect and unbeatable.
- consp 8y ago
  Not all, but some do. It is actually every shade of grey with respect to what you try to secure. If it is you cat pictures you probably are fine with just a fingerprint scanner on your phone. Want to secure your passwords and accounts, I would at minimum amend that with a proper passphrase or at least a N-digit pin (with N bigger if needed). And also get a proper scanner as most cheap things are notoriously bad. Though it also depends on the attack vector as most biometric 'abuse' is done by people around you and not strangers. In which again; a passphrase is a simple solution.
FakeComments 8y ago
Because in most people’s threat models, it’s still a win. Biometrics do three things: - It greatly reduces the friction of “showing” who you are. - It moves the mechanism into an “off-main-CPU” chip, while the main CPU just sees limited APIs, and strong crypto which can be rekeyed. You can’t rekey your bio-signature, but this architecture is better in a number of ways. - It creates a non-digital interaction as part of the auth flow. I personally subscribe to somewhere between “not a wrench” and “not Mossad” security: most things I’ll tell anyone who will hit me with a $20 wrench, and I’m definitely not in the business of trying to stop Mossad reading my papers. From that perspective, my security doesn’t need to be better than biometric on almost anything, because that’s good enough to make a wrench (or a warrant) a cheaper option — so I don’t care there are exotic attacks like copying my vein pattern, printing a fake hand, and touching things. It also stops my main concern from the government: warrantless mass-surveillance. There’s a scaling limit on using fake vein prints to break into things. And the non-digital step forces an actual interaction. Frequent, low-friction requests also allows for minimizing credential caching and for non-digital requests for confirmation before proceeding. This helps a lot against malware and escalation attacks. Note: every power cycle and few days, as well as “major” actions, I have to use an actual password — I mind this less precisely because I don’t have to use it as often. So the biometrics are also only a low credential auth when the device is already authenticated through a better mechanism. Is this perfect? No. But again, it’s a numbers game. So in most people’s usage, biometrics are a huge solution to a tricky set of trade offs, while even in the really secure setting that you’re worried about fake hands, it remains a useful part of multi-factor because fake hands are complicated to make and deploy.
- marcosdumay 8y ago
  > It creates a non-digital interaction as part of the auth flow. Well, that's not correct. You may have an analogical sensor somewhere to collect the data, but all the data, communication and storage is still digital. You can always bypass the data collection.
  - FakeComments 8y ago
    You can’t digitally do so, no. You would have to physically interact with the device to change how the circuit operated, or else the only way for the CPU to access the cryptographic data is by allowing a different specialized circuit to unlock a value based on analog input. You can’t meaningfully “bypass” that digitally, unless you already know the secret. So if the auth flow depends on that secret, it can’t bypass the analog sensor feeding in the values to unlock it. The bypasses we see are where you can, eg, attach a debug cable to feed in values without going through the sensor (which is a non-digital interaction). Or bugs in correctly implementing the logic, eg, the crypto chip accidentally exposes information. It’s much the same protection a yubikey left in the side of your laptop provides: someone physically at the device pushed a button, with a cryptographic witness that’s hard to fake.
baxtr 8y ago
Because like with almost anything else this is a question trade-offs? Yes, by your measures it is less secure but it is also more convenient. People are ok with trading (the risk of losing) security, and, privacy for convenience.
EGreg 8y ago
Biometrics have ONE proper use case: On your own devices that are under your control, like a phone. Anything else is trivially susceptible to replay attacks by a rogue hardware. China, for example is doing it wrong with WeChat. They let you pay without carrying anything, with just your face. See it play out in real time: Good: https://techcrunch.com/2018/11/13/biometrics-payment-china-singles-day/amp/ https://techcrunch.com/2018/11/13/biometrics-payment-china-s... Bad: https://techcrunch.com/2017/09/03/alibaba-debuts-smile-to-pay/ https://techcrunch.com/2017/09/03/alibaba-debuts-smile-to-pa...
friendlybus 8y ago
Because sufficiently advanced Biometrics is a free "in" to your health data. I'm really curious how many health implications can be guesstimated accurately from Apple's FaceID. There's already milliwave heartbeat detectors being researched to detect people around corners and their health statuses.

by tbabb 8y ago

B-Con 8y ago

> Why is this still a thing? Because it's cool and the people building it often aren't security experts.

opless 8y ago
And because the people wanting it don't listen to experts either.

yholio 8y ago

>Biometric data can usually be gathered from a person, often discreetly Not only that, but merely authenticating a user into the system will always produce a full duplicate of their secret. So unless all terminals have the same clearance level, any compromised terminal allows for escalation. Since the number of biometric markers is limited, you are bound to have overlap, hence this ridiculous race towards more exotic and extreme biometrics like "vein auth".

Freak_NL 8y ago

Because of the convenience, and because Apple and Google have managed to convince users that it is safe enough for them. Most people only encounter biometrics on their smartphone, where it prevents unwanted access by others, and acts as a master-password. Most people feel that they are never going to be the target of anyone capable of bypassing the biometric security of their device, and are more then happy to make their fingerprint or face the key to their castle. They also don't really have any alternative. Entering passwords is a chore on those devices, and the PIN or swipe pattern is way too easy to observe by a would-be adversary (which often includes family members or others near to the owner who want to explore (saucy) photos taken and texts sent).

Pawamoy 8y ago
About the SWIPE pattern: on Android 8.1 I can completely hide it. You don't see the dots, you don't see the drawn lines, you don't the pattern in case of error. The only thing that I still cannot hide is the vibration when I hit a dot. I also specifically chosen a pattern that goes through the same dot two or more times, to confuse even more a potential observer. I tested it with friends: I let them observe when I unlock my device, and ask them to try and unlock it. Not one has managed to unlock it.

stewbrew 8y ago

Such kind of biometric authentication sometimes/often is used in combination with something else - a pin, password etc. You then get authenticated by something that matches your body and a secret.

imron 8y ago

> Why is this still a thing? Movies.

IshKebab 8y ago

This is the "binary view" of security that many programmers hold. Either something is 100% secure or out can be broken and is effectively 0% secure. Of course the real world is not like that. Biometrics add a real later of security even though they are not theoretically perfect and unbeatable.

consp 8y ago
Not all, but some do. It is actually every shade of grey with respect to what you try to secure. If it is you cat pictures you probably are fine with just a fingerprint scanner on your phone. Want to secure your passwords and accounts, I would at minimum amend that with a proper passphrase or at least a N-digit pin (with N bigger if needed). And also get a proper scanner as most cheap things are notoriously bad. Though it also depends on the attack vector as most biometric 'abuse' is done by people around you and not strangers. In which again; a passphrase is a simple solution.

FakeComments 8y ago

Because in most people’s threat models, it’s still a win. Biometrics do three things: - It greatly reduces the friction of “showing” who you are. - It moves the mechanism into an “off-main-CPU” chip, while the main CPU just sees limited APIs, and strong crypto which can be rekeyed. You can’t rekey your bio-signature, but this architecture is better in a number of ways. - It creates a non-digital interaction as part of the auth flow. I personally subscribe to somewhere between “not a wrench” and “not Mossad” security: most things I’ll tell anyone who will hit me with a $20 wrench, and I’m definitely not in the business of trying to stop Mossad reading my papers. From that perspective, my security doesn’t need to be better than biometric on almost anything, because that’s good enough to make a wrench (or a warrant) a cheaper option — so I don’t care there are exotic attacks like copying my vein pattern, printing a fake hand, and touching things. It also stops my main concern from the government: warrantless mass-surveillance. There’s a scaling limit on using fake vein prints to break into things. And the non-digital step forces an actual interaction. Frequent, low-friction requests also allows for minimizing credential caching and for non-digital requests for confirmation before proceeding. This helps a lot against malware and escalation attacks. Note: every power cycle and few days, as well as “major” actions, I have to use an actual password — I mind this less precisely because I don’t have to use it as often. So the biometrics are also only a low credential auth when the device is already authenticated through a better mechanism. Is this perfect? No. But again, it’s a numbers game. So in most people’s usage, biometrics are a huge solution to a tricky set of trade offs, while even in the really secure setting that you’re worried about fake hands, it remains a useful part of multi-factor because fake hands are complicated to make and deploy.

marcosdumay 8y ago
> It creates a non-digital interaction as part of the auth flow. Well, that's not correct. You may have an analogical sensor somewhere to collect the data, but all the data, communication and storage is still digital. You can always bypass the data collection.
- FakeComments 8y ago
  You can’t digitally do so, no. You would have to physically interact with the device to change how the circuit operated, or else the only way for the CPU to access the cryptographic data is by allowing a different specialized circuit to unlock a value based on analog input. You can’t meaningfully “bypass” that digitally, unless you already know the secret. So if the auth flow depends on that secret, it can’t bypass the analog sensor feeding in the values to unlock it. The bypasses we see are where you can, eg, attach a debug cable to feed in values without going through the sensor (which is a non-digital interaction). Or bugs in correctly implementing the logic, eg, the crypto chip accidentally exposes information. It’s much the same protection a yubikey left in the side of your laptop provides: someone physically at the device pushed a button, with a cryptographic witness that’s hard to fake.

baxtr 8y ago

Because like with almost anything else this is a question trade-offs? Yes, by your measures it is less secure but it is also more convenient. People are ok with trading (the risk of losing) security, and, privacy for convenience.

EGreg 8y ago

Biometrics have ONE proper use case: On your own devices that are under your control, like a phone. Anything else is trivially susceptible to replay attacks by a rogue hardware. China, for example is doing it wrong with WeChat. They let you pay without carrying anything, with just your face. See it play out in real time: Good: https://techcrunch.com/2018/11/13/biometrics-payment-china-singles-day/amp/ https://techcrunch.com/2018/11/13/biometrics-payment-china-s... Bad: https://techcrunch.com/2017/09/03/alibaba-debuts-smile-to-pay/ https://techcrunch.com/2017/09/03/alibaba-debuts-smile-to-pa...

friendlybus 8y ago

Because sufficiently advanced Biometrics is a free "in" to your health data. I'm really curious how many health implications can be guesstimated accurately from Apple's FaceID. There's already milliwave heartbeat detectors being researched to detect people around corners and their health statuses.