4 ms·

All the security experts on HN say you should use a passcode instead of a fingerprint for unlocking your phone. However, it seems fairly easy for someone to jus

All the security experts on HN say you should use a passcode instead of a fingerprint for unlocking your phone. However, it seems fairly easy for someone to just watch you over your shoulder input your passcode (i.e. "shoulder surf"), or have it be recorded on increasingly ever-present surveillance cameras (e.g. buses, subways, food courts, etc.). What about putting buttons along the sides of your phone and using chorded combinations as your passcode? Seems squeezing those buttons would be much harder to observe or record (intentionally or unintentionally).

reportgunner 7y ago
Would be nice if we didn't already have touch id and face id.
- diafygi 7y ago
  https://techsolidarity.org/resources/basic_security.htm https://techsolidarity.org/resources/basic_security.htm "Don't use your fingerprint to lock/unlock devices." "Use a long passphrase to lock your devices." Seems touch id and face id is exactly what security experts tell you not to do.
  - inlined 7y ago
    Yes, I forget how much of this was because of forgeability and how much was because of the ambiguity of digital rights in America. Compelling someone to share a passcode was considered a 5th amendment violation but we collect biological samples all the time with just a warrant so biological locks seemed less safe.
  - freehunter 7y ago
    >Basic security precautions for non-profits and journalists in the United States, early 2019. Those are recommendations for a specific group of highly targeted individuals in specific situations. It's not "basic security", it's "basic security for people who have such damaging information on certain subjects that they may be killed for it". For the general population, TouchID and FaceID are more secure than the most common alternative (which tends to be no passcode at all) and secure enough that common criminals aren't going to bother with it. Stopping nation-states from intercepting your data and using it as a flimsy basis for your murder isn't something an average person needs to worry about on a day to day basis.
api_or_ipa 7y ago
On my Galaxy S9+, I have 4 buttons: power, vol up/down and a stupid useless bixby button. Ignoring how to put it into 'password' mode, each of these buttons is effectively a bit. I assume you need at least 1 key to register an input (otherwise wait for a pause which I won't consider), so you get 15 possibilities. I think you could make a reasonably strong password using 4-8 chords (15^4-15^8 possibilities). Anyways, it's certainly better than those swipe passwords with an effective length of 9 Cr 4 == 128 which are readily seen and copied by nearby people.
- radeklew 7y ago
  Do you mean to say there are 9 choose 4 == 126 possible combinations for a 3x3 pattern? I think this would only be true if you could use a maximum of four dots in the pattern, which isn't the case. Although calculating it this way will double-count some patterns which include long lines, I would say that there ar far closer to 9! == 362880 passwords. Even if long lines cut that space in half, 150000 more than meets your minimum of 15^4.
  - api_or_ipa 7y ago
    You're right. I goofed on my analysis. Instead of chose, it's indeed a factorial. You're also right, you can chose up to 9 dots, so indeed it is up to 9! combinations. Thanks for catching that.

reportgunner 7y ago

Would be nice if we didn't already have touch id and face id.

diafygi 7y ago
https://techsolidarity.org/resources/basic_security.htm https://techsolidarity.org/resources/basic_security.htm "Don't use your fingerprint to lock/unlock devices." "Use a long passphrase to lock your devices." Seems touch id and face id is exactly what security experts tell you not to do.
- inlined 7y ago
  Yes, I forget how much of this was because of forgeability and how much was because of the ambiguity of digital rights in America. Compelling someone to share a passcode was considered a 5th amendment violation but we collect biological samples all the time with just a warrant so biological locks seemed less safe.
- freehunter 7y ago
  >Basic security precautions for non-profits and journalists in the United States, early 2019. Those are recommendations for a specific group of highly targeted individuals in specific situations. It's not "basic security", it's "basic security for people who have such damaging information on certain subjects that they may be killed for it". For the general population, TouchID and FaceID are more secure than the most common alternative (which tends to be no passcode at all) and secure enough that common criminals aren't going to bother with it. Stopping nation-states from intercepting your data and using it as a flimsy basis for your murder isn't something an average person needs to worry about on a day to day basis.

api_or_ipa 7y ago

On my Galaxy S9+, I have 4 buttons: power, vol up/down and a stupid useless bixby button. Ignoring how to put it into 'password' mode, each of these buttons is effectively a bit. I assume you need at least 1 key to register an input (otherwise wait for a pause which I won't consider), so you get 15 possibilities. I think you could make a reasonably strong password using 4-8 chords (15^4-15^8 possibilities). Anyways, it's certainly better than those swipe passwords with an effective length of 9 Cr 4 == 128 which are readily seen and copied by nearby people.

radeklew 7y ago
Do you mean to say there are 9 choose 4 == 126 possible combinations for a 3x3 pattern? I think this would only be true if you could use a maximum of four dots in the pattern, which isn't the case. Although calculating it this way will double-count some patterns which include long lines, I would say that there ar far closer to 9! == 362880 passwords. Even if long lines cut that space in half, 150000 more than meets your minimum of 15^4.
- api_or_ipa 7y ago
  You're right. I goofed on my analysis. Instead of chose, it's indeed a factorial. You're also right, you can chose up to 9 dots, so indeed it is up to 9! combinations. Thanks for catching that.