4 ms·

A biometric identifies you. An identity does not inherently authenticate you. Identification is knowing which account to log in. dustinmoris, User123 or user12

A biometric identifies you. An identity does not inherently authenticate you. Identification is knowing which account to log in. dustinmoris, User123 or user124. That alone is useless, as anyone who knows your name could log in. So we need to add security to authenticate you. To authenticate with reasonable certainty that the person accessing dustinmoris actually is Dustin Moris, at this moment willingly accessing their own account, willingly transferring £1m to NeedMoreTea. :) Now, it's certainly true that biometrics are uniquely associated with you, but prove identity not authentication - bear with me here. You leak DNA and fingerprints all over the place, constantly. Fingerprints have even been picked up from photos. That makes fingerprints surprisingly weak authentication. Face IDs have been fooled by video and photos. I'm not at all current on what the state of the art on FaceID hacking and devices is, so can't say more there. In a police interview they can place your thumb on the phone or wave phone under your face. Maybe borrow your thumb while you sleep to transfer that £1m. The bank will say you fully authenticated it, in their highly secure app, you will deny it. In combining biometrics as identification and authentication we've compromised the system. It does not give certainty, or even especially high confidence. If motivated, anyone in your office could lift a print while you're out. Computer or phone says Dustin Moris is believed awake and accessing, but you're certainly not doing so willingly, nor can you resist if just a touch or look unlocks. In this context, your wife might easily pick up on whether you were willing in a police interview or not, the phone can't, because mere identification is the unlock. With a password they have to persuade you to reveal it. It is very easy to not leak passwords accidentally on PostIts, and manage the complex with a password manager. The police can certainly beat it out of you, but most places are supposed to have rules against that. Many places actually honour those rules. A judge might question the bruises and missing teeth. For a lot of people that's a fine distinction that doesn't matter, the convenience of it probably being you willingly unlocking the phone with your thumb is good enough. If security actually matters, it's not. Sorry that got a bit long.

kortilla 7y ago
You highlight flaws in faceid, etc but passwords also have flaws. - Fingerprints can be lifted from pictures. - Passwords can be forgotten and thus have seriously flawed reset schemes that often fallback to something as simple as having the right phone or backup code. - passwords can be lifted by keyloggers - passwords can easily be phished - passwords can be shared Authenticating access can come from 1 or more of: something you know, something you have, something you are. They each have flaws. They all do the same thing.
- NeedMoreTea 7y ago
  They don't do the same thing. All the flaws in passwords can be avoided, the semi-public state of biometrics cannot. Authenticating access, if you follow standard security practice, should be at least two of, and preferably all three of: something you know, something you have, something you are. Not one or more.
  - kortilla 7y ago
    There is no axiom that the flaws of biometrics cannot be avoided. “Something you know” is in fact a biometric property of the brain that can easily be transferred. Touch ID combines something you have with something you are. It’s easily better for 99.9% of the threats out there that result from weak passwords shares across sites and users trained to type them into anything that resembles the real logon page.

kortilla 7y ago

You highlight flaws in faceid, etc but passwords also have flaws. - Fingerprints can be lifted from pictures. - Passwords can be forgotten and thus have seriously flawed reset schemes that often fallback to something as simple as having the right phone or backup code. - passwords can be lifted by keyloggers - passwords can easily be phished - passwords can be shared Authenticating access can come from 1 or more of: something you know, something you have, something you are. They each have flaws. They all do the same thing.

NeedMoreTea 7y ago
They don't do the same thing. All the flaws in passwords can be avoided, the semi-public state of biometrics cannot. Authenticating access, if you follow standard security practice, should be at least two of, and preferably all three of: something you know, something you have, something you are. Not one or more.
- kortilla 7y ago
  There is no axiom that the flaws of biometrics cannot be avoided. “Something you know” is in fact a biometric property of the brain that can easily be transferred. Touch ID combines something you have with something you are. It’s easily better for 99.9% of the threats out there that result from weak passwords shares across sites and users trained to type them into anything that resembles the real logon page.