6 ms·
Bio identification is for usernames... not passwords. NEVER use a fingerprint or an iris scan for a password. That's insane! Just don't do it.
by burtonator 8y ago
Bio identification is for usernames... not passwords.
NEVER use a fingerprint or an iris scan for a password. That's insane!
Just don't do it.
- Joky 8y agoWhat about a second factor for TFA?
- parent5446 8y agoMost people don't have attackers going after them who are harvesting fingerprints to get into their devices.
- mLuby 8y agoAm I wrong that an (inevitable) biometric data breach would mean this can be done on the cheap (if you were unlucky enough to have given your data to a third party)?
- Godel_unicode 8y agoYes, at least for finger prints. Getting the print is easy, especially with glass back phones, it's making a good enough fake that's non-trivial.
- lozaning 8y agoDo gummy bears not work anymore? https://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_fingerprint_sensors/ https://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_...
- Nasrudith 8y agoA mugger can get into your device - less relevant now given that wallets are where the value is 99% of the time but given pay with phone options growing in popularity that might be a matter of concern eventually.
- dpark 8y agoA guy with a gun in my face can have my PIN. I’ll also happily provide my fingerprint or look at my phone to unlock it. This idea that digital security is going to solve for physical violence is absurd unless you’re willing to die to protect your digital assets.
- gbaygon 8y agoobligatory https://xkcd.com/538/ https://xkcd.com/538/ edit: - sorry if it's annoying but for me it was a very graphical way to always remember this issue.
- deleted 8y ago[deleted]
- dpark 8y agoNot annoying, just Hacker News. Funny/cute/meme/etc typically gets downvoted, even if it’s directly relevant, because of the strong fear of turning into the circle jerk of endless shitty joke threads like Reddit.
- Dylan16807 8y ago> unless you’re willing to die I feel like that's getting the threat model wrong. The mugger wants to spend as little time with you as possible. If a fingerprint is needed to make purchases, then it can actually be significantly better than a PIN, and even a PIN is a lot better than nothing because they have to memorize it.
- dpark 8y agoSure. Have a fingerprint or PIN or whatever. Totally reasonable. Mugger takes your phone in a rush, can’t unlock it later, sells it for $10 to someone who’ll gut it for the pieces. Sucks, but not as bad as the mugger also emptying your bank account. But my response is to the belief that a security factor that cannot be directly taken by force is somehow more secure. If you’re guarding The Football, sure. You might actually be willing to die for that. If you’re willing to die rather than reveal your PIN to a mugger, though, your advice is not applicable to the vast majority of the population who value their lives more than their bank accounts.
- Angostura 8y agoWhat about for devices that don't have usernames?
- justtopost 8y agoStill a bad idea as a password.
- chrischen 8y agoWell out of convenience you kind of have to. But if you really wanted to you can just disable it at ports of entry.
- Scoundreller 8y agoWhich is easy enough to do on iOS: Hit the sleep/wake button 5 times quickly.
- jonahhorowitz 8y agoCareful - after iOS 12 that defaults to calling 911 for you (while also locking your device). You can change that in the settings though.
- CamperBob2 8y agoCorrect, I just did this yesterday while idly fidgeting around with my phone. Fortunately I cancelled it in time to avoid creating a false alarm. Glad to hear it can be turned off, doing that now. WTF were they thinking, making it so easy to trigger by accident? (Edit: OK, I'm confused. There doesn't seem to be an option to disable the emergency trigger entirely, but there's an "Auto Call" slider whose relationship to the feature is unclear. This slider is turned off, yet the phone still went into emergency mode when I clicked the button a few times. What a half-assed feature, sadly typical of Apple's work lately.)
- URSpider94 8y agoThey made it easy to trigger so that people can use it as a panic button. That was a customer request.
- CamperBob2 8y agoApple gets a lot of customer requests, 99.9% of which they ignore, and 95% of which they should ignore. This was a funny one for them to select for implementation.
- grahamburger 8y agoMeh, convenience matters. The alternative to me using a fingerprint reader oh my phone isn't me typing 16char alphanumeric password every time I pull my phone out, it's to not use a password at all.