3 ms·

Um no. The user Name or ID is to identify. The password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security.

Um no. The user Name or ID is to identify. The password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security. > then a password or as you say "secret" is not required at all anymore Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfie etc. There's been dozens of ways to exploit over the years, many of which have hit HN.

dustinmoris 7y ago
> the password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security. You talk absolute nonsense. You ID is not secured by your password LOOOOL. For example, your email is not secure. It is public. I can send you.. drumroll.. a mail there. So is your Facebook username. It is not secure. It is just a name which is public and tells everyone who you are. The password is the only thing that is used to make sure that only you can log in as you. It is a way of identifying that you are you. Nothing else. > Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfir etc. There is more and less secure biometrics. There are biometrics, which cannot be copied or cut off that easily. At the end of the day, your biological composition makes you who you are. If someone can truly fake all your biological attributes, then maybe you have a bigger problem than someone logging in with your online account. They probably can do worse things at this point.
- NeedMoreTea 7y ago
  How many emails require a password to send to them? None. It's identifier. The password is the security. Using biometrics - an identifier - for security as well is a compromise for convenience. As you say yourself biometrics make you who you are, they don't secure who you are.
dustinmoris 7y ago
What is the compromise? What is insecure about me being me? Either we talk past each other not understanding each other's point, or I feel like you profoundly misunderstand the reason for people using username/password for authentication nowadays? With most things you need to authenticate to gain access. Authentication is only trying to solve one question - identifying that a person is who they say they are. If I walk home and my wife sees me, she can identify me immediately by simply seeing my face and other biological attributes which gives her 100% certainty that I am who I am, therefore she doesn't question me on entering the house or calls the police. If I was to go through some top secret lab experiment which would change my look (make me younger by 10 years or something) then I'd struggle to walk home and convince my wife that I am me without providing additional evidence, like sharing some secrets which only she and I know and we know that nobody else would know. With technology so far we didn't have the ability to identify someone as confidently and as fast via biometrics (like my wife does) as via other means, which is why a few decades ago we had to invent a workaround, namely username and password - which is a secret that hopefully only me and the website knows. This was to date the best way to identify someone, but times are changing fast, as as biometric identificaiton via technology is advancing fast, we are more and more removing the need of username + password for authentication. Hope now my point makes sense.
- Dylan16807 7y ago
  If we had technology that doesn't exist, we could have secure biometrics. In practice the computer is just getting a picture, which is semi-public information, and that's why the only thing you can rely on is that it's an identifier. It's not enough to authenticate when you really need security, only in more casual situations.
- NeedMoreTea 7y ago
  A biometric identifies you. An identity does not inherently authenticate you. Identification is knowing which account to log in. dustinmoris, User123 or user124. That alone is useless, as anyone who knows your name could log in. So we need to add security to authenticate you. To authenticate with reasonable certainty that the person accessing dustinmoris actually is Dustin Moris, at this moment willingly accessing their own account, willingly transferring £1m to NeedMoreTea. :) Now, it's certainly true that biometrics are uniquely associated with you, but prove identity not authentication - bear with me here. You leak DNA and fingerprints all over the place, constantly. Fingerprints have even been picked up from photos. That makes fingerprints surprisingly weak authentication. Face IDs have been fooled by video and photos. I'm not at all current on what the state of the art on FaceID hacking and devices is, so can't say more there. In a police interview they can place your thumb on the phone or wave phone under your face. Maybe borrow your thumb while you sleep to transfer that £1m. The bank will say you fully authenticated it, in their highly secure app, you will deny it. In combining biometrics as identification and authentication we've compromised the system. It does not give certainty, or even especially high confidence. If motivated, anyone in your office could lift a print while you're out. Computer or phone says Dustin Moris is believed awake and accessing, but you're certainly not doing so willingly, nor can you resist if just a touch or look unlocks. In this context, your wife might easily pick up on whether you were willing in a police interview or not, the phone can't, because mere identification is the unlock. With a password they have to persuade you to reveal it. It is very easy to not leak passwords accidentally on PostIts, and manage the complex with a password manager. The police can certainly beat it out of you, but most places are supposed to have rules against that. Many places actually honour those rules. A judge might question the bruises and missing teeth. For a lot of people that's a fine distinction that doesn't matter, the convenience of it probably being you willingly unlocking the phone with your thumb is good enough. If security actually matters, it's not. Sorry that got a bit long.

dustinmoris 7y ago

> the password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security. You talk absolute nonsense. You ID is not secured by your password LOOOOL. For example, your email is not secure. It is public. I can send you.. drumroll.. a mail there. So is your Facebook username. It is not secure. It is just a name which is public and tells everyone who you are. The password is the only thing that is used to make sure that only you can log in as you. It is a way of identifying that you are you. Nothing else. > Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfir etc. There is more and less secure biometrics. There are biometrics, which cannot be copied or cut off that easily. At the end of the day, your biological composition makes you who you are. If someone can truly fake all your biological attributes, then maybe you have a bigger problem than someone logging in with your online account. They probably can do worse things at this point.

NeedMoreTea 7y ago
How many emails require a password to send to them? None. It's identifier. The password is the security. Using biometrics - an identifier - for security as well is a compromise for convenience. As you say yourself biometrics make you who you are, they don't secure who you are.

dustinmoris 7y ago

What is the compromise? What is insecure about me being me? Either we talk past each other not understanding each other's point, or I feel like you profoundly misunderstand the reason for people using username/password for authentication nowadays? With most things you need to authenticate to gain access. Authentication is only trying to solve one question - identifying that a person is who they say they are. If I walk home and my wife sees me, she can identify me immediately by simply seeing my face and other biological attributes which gives her 100% certainty that I am who I am, therefore she doesn't question me on entering the house or calls the police. If I was to go through some top secret lab experiment which would change my look (make me younger by 10 years or something) then I'd struggle to walk home and convince my wife that I am me without providing additional evidence, like sharing some secrets which only she and I know and we know that nobody else would know. With technology so far we didn't have the ability to identify someone as confidently and as fast via biometrics (like my wife does) as via other means, which is why a few decades ago we had to invent a workaround, namely username and password - which is a secret that hopefully only me and the website knows. This was to date the best way to identify someone, but times are changing fast, as as biometric identificaiton via technology is advancing fast, we are more and more removing the need of username + password for authentication. Hope now my point makes sense.

Dylan16807 7y ago
If we had technology that doesn't exist, we could have secure biometrics. In practice the computer is just getting a picture, which is semi-public information, and that's why the only thing you can rely on is that it's an identifier. It's not enough to authenticate when you really need security, only in more casual situations.
NeedMoreTea 7y ago
A biometric identifies you. An identity does not inherently authenticate you. Identification is knowing which account to log in. dustinmoris, User123 or user124. That alone is useless, as anyone who knows your name could log in. So we need to add security to authenticate you. To authenticate with reasonable certainty that the person accessing dustinmoris actually is Dustin Moris, at this moment willingly accessing their own account, willingly transferring £1m to NeedMoreTea. :) Now, it's certainly true that biometrics are uniquely associated with you, but prove identity not authentication - bear with me here. You leak DNA and fingerprints all over the place, constantly. Fingerprints have even been picked up from photos. That makes fingerprints surprisingly weak authentication. Face IDs have been fooled by video and photos. I'm not at all current on what the state of the art on FaceID hacking and devices is, so can't say more there. In a police interview they can place your thumb on the phone or wave phone under your face. Maybe borrow your thumb while you sleep to transfer that £1m. The bank will say you fully authenticated it, in their highly secure app, you will deny it. In combining biometrics as identification and authentication we've compromised the system. It does not give certainty, or even especially high confidence. If motivated, anyone in your office could lift a print while you're out. Computer or phone says Dustin Moris is believed awake and accessing, but you're certainly not doing so willingly, nor can you resist if just a touch or look unlocks. In this context, your wife might easily pick up on whether you were willing in a police interview or not, the phone can't, because mere identification is the unlock. With a password they have to persuade you to reveal it. It is very easy to not leak passwords accidentally on PostIts, and manage the complex with a password manager. The police can certainly beat it out of you, but most places are supposed to have rules against that. Many places actually honour those rules. A judge might question the bruises and missing teeth. For a lot of people that's a fine distinction that doesn't matter, the convenience of it probably being you willingly unlocking the phone with your thumb is good enough. If security actually matters, it's not. Sorry that got a bit long.