5 ms·

Touch based are not better. Your fingerprint is not a password, it's just an identifier and shouldn't be treated as a secret.

dustinmoris 7y ago
> Your fingerprint is not a password Correct, because a fingerprint makes a password to some extent redundant. > it's just an identifier and shouldn't be treated as a secret Correct, identifiers are not secrets. Your face is not a secret and your fingerprint either. The problem is that we use secrets to identfy someone, when we potentially already have tech which can identify someone without having to remember a secret and store it in a dictionary of secrets on someone else's computer in the cloud. The sole purpose of a password is to identify someone with a certain degree of confidence. If a fingerprint taken from a handheld device, which has already been proven to belong to a person, can provide the same if not even a higher level of certainty about someone's identy, then a password or as you say "secret" is not required at all anymore.
- Santosh83 7y ago
  Anonymity is weakened if we tie authentication to biometrics. Something you know (as in password) is always theoretically more secure than something you are (your physical characteristics).
  - dustinmoris 7y ago
    Anonymity is of course weakened, but that is a different debate. Currently there is no anonymity at all if your account is linked to your email address, which you've also used to register your online banking account, your credit card verification, your PayPal account, etc. and when you have your mobile phone number confirmed, etc. A password gives you 0 extra anonymity in this case. All it is used if for "identifycation" and in this regard it sucks in comparison to true biologial identification.
    - cuu508 7y ago
      You are mixing up terminology. When logging in a website, your username identifies you, and your password authenticates you.
  - deleted 7y ago
    [deleted]
  - scient 7y ago
    I think the statement you make about "something you know" always being more secure is not nearly as clear cut as you present it. A combination of "something you know" and "something you have" is always going to be a very strong authentication scenario, and making "something you have" a non-hackable thing that truly only you can have (i.e not a USB key or a TOTP seed etc.) is a good choice. The catch here is that when you mention biometrics, you make the assumption of static biometrics (rightfully so, as most methods like Touch ID and Face ID are static), but if you combine lets say face biometrics with liveness checks, you are getting into a territory where faking them becomes much much more difficult (there are various mechanisms out there, the good ones rely on completely random interactions and light-bouncing detection methods as an example). The real challenge is how do you make these very strong biometric methods frictionless and cheap? Or how do you introduce similar controls - like liveness - for easier methods like fingerprints? And using any of these (ideally) has absolutely nothing to do with anonymity. You are not anonymous online regardless of what you use for authentication - and you are frankly not smart if you assume thats the case. A company offering a service with biometrics is no different from a company doing the same based on email/username and a password, if they do privacy and security right. I could actually get into a much longer rant about this last part, as it blows my mind how many netizens are all about privacy and whatnot, yet are willing to expose every single detail about them when its convenient from them...
    - Santosh83 7y ago
      > And using any of these (ideally) has absolutely nothing to do with anonymity. You are not anonymous online regardless of what you use for authentication - and you are frankly not smart if you assume thats the case. A company offering a service with biometrics is no different from a company doing the same based on email/username and a password, if they do privacy and security right. Why should I use unchangeable, personally identifiable details when logging into some random joe's website? The mechanics of it are also tied to specific devices if I'm not wrong. I can't just login anywhere without risking leaking secrets. When did fingerprints, iris patterns and DNA go from necessary tools in law enforcement and biology (and for highly secure installations) into casual usage all over the place?
  - enriquepablo 7y ago
    > Anonymity is weakened if we tie authentication to biometrics. I think you mean pseudonimity. There should be no authentication in anonimity. > Something you know (as in password) is always theoretically more secure than something you are (your physical characteristics). If you authenticate, you can use methods that are more or less secure. If you use a password method, and use a secret as password, it will be more secure than if you use a biometric as password. But the security of the authentication method will bear no weight on the "pseudonimization" - meaning on the difficulty of linking the authenticated identity with your real, legal identity.
    - Santosh83 7y ago
      It's effectively like using one password for every app/site authentication. What if the hashes/keys leak out? Then how easy would it be to change your keys for other sites while still using the same biometrics?
- NeedMoreTea 7y ago
  Um no. The user Name or ID is to identify. The password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security. > then a password or as you say "secret" is not required at all anymore Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfie etc. There's been dozens of ways to exploit over the years, many of which have hit HN.
  - dustinmoris 7y ago
    > the password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security. You talk absolute nonsense. You ID is not secured by your password LOOOOL. For example, your email is not secure. It is public. I can send you.. drumroll.. a mail there. So is your Facebook username. It is not secure. It is just a name which is public and tells everyone who you are. The password is the only thing that is used to make sure that only you can log in as you. It is a way of identifying that you are you. Nothing else. > Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfir etc. There is more and less secure biometrics. There are biometrics, which cannot be copied or cut off that easily. At the end of the day, your biological composition makes you who you are. If someone can truly fake all your biological attributes, then maybe you have a bigger problem than someone logging in with your online account. They probably can do worse things at this point.
    - NeedMoreTea 7y ago
      How many emails require a password to send to them? None. It's identifier. The password is the security. Using biometrics - an identifier - for security as well is a compromise for convenience. As you say yourself biometrics make you who you are, they don't secure who you are.
  - dustinmoris 7y ago
    What is the compromise? What is insecure about me being me? Either we talk past each other not understanding each other's point, or I feel like you profoundly misunderstand the reason for people using username/password for authentication nowadays? With most things you need to authenticate to gain access. Authentication is only trying to solve one question - identifying that a person is who they say they are. If I walk home and my wife sees me, she can identify me immediately by simply seeing my face and other biological attributes which gives her 100% certainty that I am who I am, therefore she doesn't question me on entering the house or calls the police. If I was to go through some top secret lab experiment which would change my look (make me younger by 10 years or something) then I'd struggle to walk home and convince my wife that I am me without providing additional evidence, like sharing some secrets which only she and I know and we know that nobody else would know. With technology so far we didn't have the ability to identify someone as confidently and as fast via biometrics (like my wife does) as via other means, which is why a few decades ago we had to invent a workaround, namely username and password - which is a secret that hopefully only me and the website knows. This was to date the best way to identify someone, but times are changing fast, as as biometric identificaiton via technology is advancing fast, we are more and more removing the need of username + password for authentication. Hope now my point makes sense.
- enriquepablo 7y ago
  > The password ... is a way of identifying that you are you. That is not correct. The "system" identifies you by your ID (username - biometrics - whatever). And for the system to ensure that whatever actions you perform on it, are really coming from you, you have to add proof of your identity to the orders for those actions. You use a secret to create that proof of identity. The secret is yours, the identity is the system's (what it uses to identify you). If you use something you don't treat as a secret (such as your fingerprint) as your proof of identity, you'll be loosing it left and right - you'll be inviting everyone around to impersonate you. Drinking a can of coke and throwing it to the bin would be the same as printing your password in cards and passing them around.
- Natanael_L 7y ago
  Password authenticated key exchange algorithms (PAKE) solves the dictionary of secrets problem, by hiding the password from the server.
geofft 7y ago
Your fingerprint is an additional factor (something you are) for the actual better-than-passwords thing here, the isolates processor/storage in your laptop that handles Touch ID (something you have). Without physical possession of the laptop, the fingerprint is useless.

dustinmoris 7y ago

> Your fingerprint is not a password Correct, because a fingerprint makes a password to some extent redundant. > it's just an identifier and shouldn't be treated as a secret Correct, identifiers are not secrets. Your face is not a secret and your fingerprint either. The problem is that we use secrets to identfy someone, when we potentially already have tech which can identify someone without having to remember a secret and store it in a dictionary of secrets on someone else's computer in the cloud. The sole purpose of a password is to identify someone with a certain degree of confidence. If a fingerprint taken from a handheld device, which has already been proven to belong to a person, can provide the same if not even a higher level of certainty about someone's identy, then a password or as you say "secret" is not required at all anymore.

Santosh83 7y ago
Anonymity is weakened if we tie authentication to biometrics. Something you know (as in password) is always theoretically more secure than something you are (your physical characteristics).
- dustinmoris 7y ago
  Anonymity is of course weakened, but that is a different debate. Currently there is no anonymity at all if your account is linked to your email address, which you've also used to register your online banking account, your credit card verification, your PayPal account, etc. and when you have your mobile phone number confirmed, etc. A password gives you 0 extra anonymity in this case. All it is used if for "identifycation" and in this regard it sucks in comparison to true biologial identification.
  - cuu508 7y ago
    You are mixing up terminology. When logging in a website, your username identifies you, and your password authenticates you.
- deleted 7y ago
  [deleted]
- scient 7y ago
  I think the statement you make about "something you know" always being more secure is not nearly as clear cut as you present it. A combination of "something you know" and "something you have" is always going to be a very strong authentication scenario, and making "something you have" a non-hackable thing that truly only you can have (i.e not a USB key or a TOTP seed etc.) is a good choice. The catch here is that when you mention biometrics, you make the assumption of static biometrics (rightfully so, as most methods like Touch ID and Face ID are static), but if you combine lets say face biometrics with liveness checks, you are getting into a territory where faking them becomes much much more difficult (there are various mechanisms out there, the good ones rely on completely random interactions and light-bouncing detection methods as an example). The real challenge is how do you make these very strong biometric methods frictionless and cheap? Or how do you introduce similar controls - like liveness - for easier methods like fingerprints? And using any of these (ideally) has absolutely nothing to do with anonymity. You are not anonymous online regardless of what you use for authentication - and you are frankly not smart if you assume thats the case. A company offering a service with biometrics is no different from a company doing the same based on email/username and a password, if they do privacy and security right. I could actually get into a much longer rant about this last part, as it blows my mind how many netizens are all about privacy and whatnot, yet are willing to expose every single detail about them when its convenient from them...
  - Santosh83 7y ago
    > And using any of these (ideally) has absolutely nothing to do with anonymity. You are not anonymous online regardless of what you use for authentication - and you are frankly not smart if you assume thats the case. A company offering a service with biometrics is no different from a company doing the same based on email/username and a password, if they do privacy and security right. Why should I use unchangeable, personally identifiable details when logging into some random joe's website? The mechanics of it are also tied to specific devices if I'm not wrong. I can't just login anywhere without risking leaking secrets. When did fingerprints, iris patterns and DNA go from necessary tools in law enforcement and biology (and for highly secure installations) into casual usage all over the place?
- enriquepablo 7y ago
  > Anonymity is weakened if we tie authentication to biometrics. I think you mean pseudonimity. There should be no authentication in anonimity. > Something you know (as in password) is always theoretically more secure than something you are (your physical characteristics). If you authenticate, you can use methods that are more or less secure. If you use a password method, and use a secret as password, it will be more secure than if you use a biometric as password. But the security of the authentication method will bear no weight on the "pseudonimization" - meaning on the difficulty of linking the authenticated identity with your real, legal identity.
  - Santosh83 7y ago
    It's effectively like using one password for every app/site authentication. What if the hashes/keys leak out? Then how easy would it be to change your keys for other sites while still using the same biometrics?
NeedMoreTea 7y ago
Um no. The user Name or ID is to identify. The password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security. > then a password or as you say "secret" is not required at all anymore Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfie etc. There's been dozens of ways to exploit over the years, many of which have hit HN.
- dustinmoris 7y ago
  > the password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security. You talk absolute nonsense. You ID is not secured by your password LOOOOL. For example, your email is not secure. It is public. I can send you.. drumroll.. a mail there. So is your Facebook username. It is not secure. It is just a name which is public and tells everyone who you are. The password is the only thing that is used to make sure that only you can log in as you. It is a way of identifying that you are you. Nothing else. > Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfir etc. There is more and less secure biometrics. There are biometrics, which cannot be copied or cut off that easily. At the end of the day, your biological composition makes you who you are. If someone can truly fake all your biological attributes, then maybe you have a bigger problem than someone logging in with your online account. They probably can do worse things at this point.
  - NeedMoreTea 7y ago
    How many emails require a password to send to them? None. It's identifier. The password is the security. Using biometrics - an identifier - for security as well is a compromise for convenience. As you say yourself biometrics make you who you are, they don't secure who you are.
- dustinmoris 7y ago
  What is the compromise? What is insecure about me being me? Either we talk past each other not understanding each other's point, or I feel like you profoundly misunderstand the reason for people using username/password for authentication nowadays? With most things you need to authenticate to gain access. Authentication is only trying to solve one question - identifying that a person is who they say they are. If I walk home and my wife sees me, she can identify me immediately by simply seeing my face and other biological attributes which gives her 100% certainty that I am who I am, therefore she doesn't question me on entering the house or calls the police. If I was to go through some top secret lab experiment which would change my look (make me younger by 10 years or something) then I'd struggle to walk home and convince my wife that I am me without providing additional evidence, like sharing some secrets which only she and I know and we know that nobody else would know. With technology so far we didn't have the ability to identify someone as confidently and as fast via biometrics (like my wife does) as via other means, which is why a few decades ago we had to invent a workaround, namely username and password - which is a secret that hopefully only me and the website knows. This was to date the best way to identify someone, but times are changing fast, as as biometric identificaiton via technology is advancing fast, we are more and more removing the need of username + password for authentication. Hope now my point makes sense.
enriquepablo 7y ago
> The password ... is a way of identifying that you are you. That is not correct. The "system" identifies you by your ID (username - biometrics - whatever). And for the system to ensure that whatever actions you perform on it, are really coming from you, you have to add proof of your identity to the orders for those actions. You use a secret to create that proof of identity. The secret is yours, the identity is the system's (what it uses to identify you). If you use something you don't treat as a secret (such as your fingerprint) as your proof of identity, you'll be loosing it left and right - you'll be inviting everyone around to impersonate you. Drinking a can of coke and throwing it to the bin would be the same as printing your password in cards and passing them around.
Natanael_L 7y ago
Password authenticated key exchange algorithms (PAKE) solves the dictionary of secrets problem, by hiding the password from the server.

geofft 7y ago

Your fingerprint is an additional factor (something you are) for the actual better-than-passwords thing here, the isolates processor/storage in your laptop that handles Touch ID (something you have). Without physical possession of the laptop, the fingerprint is useless.