4 ms·

Really depends on your threat model and what kind of access you want to prevent. Random person tries to get in (eg phone was stolen in the subway, ...): biomet

by nolok 7y ago

Really depends on your threat model and what kind of access you want to prevent. Random person tries to get in (eg phone was stolen in the subway, ...): biometrics work, password works. Close person tries to get in (significant other, coworker, ...): biometrics is flawed, password works. Government respecting your rights tries to get in: biometrics is completly broken, password works. Government that don't respect your rights tries to get in: https://xkcd.com/538/ https://xkcd.com/538/ Although in that last case, as-in the case of Government respecting your rights but the court order you to give access, password still allows you to have the ability to block/brick/wipe the phone. All of this of course is if you have a good password hygiene, but if you don't I don't think you have a claim to complain about weak security models.

xoa 7y ago
You're correct about always having to evaluate security in terms of threat models, but you're off about a lot of your examples. >Close person tries to get in (significant other, coworker, ...): biometrics is flawed, password works. >Government respecting your rights tries to get in: biometrics is completly broken, password works. The first is fully incorrect, the second far too generalized and heavily incorrect. PINs/passwords are far, FAR more trivial to skim then biometrics. Even mere shoulder surfing isn't hard, but in a world with approaching ubiquitous hard to notice downward looking cameras if you ever input a password anywhere that isn't physically secure, and with no one looking, you can easily have it compromised. And it of course takes essentially zero resource expenditure and offers zero visibility to merely use the password once it's acquired. If it's at a random incident and a first-world type government wants to look, you can trivially disable biometrics on any decent implementation without even looking. So lack of biometrics buys you nothing. If it's a sting against you specifically then they can shoulder surf/camera it (remember the constant improvements in drones, are you REALLY not being watched well away from buildings even?) or just wait for you to unlock it and then swoop in and try to physically grab you while it's unlocked anyway. The scenario space where it'd make a difference is very, very minimal. Really, you want both: a strong password and biometrics for public usage. And for scenarios like border searches they can lawfully cause you enough inconvenience regardless that standard passcode is still not really the right response anyway. A burner, clean+remote load later, or alt-codes or the like would be the right way to go, though sadly I think only the first two are available right now. >Government that don't respect your rights tries to get in: https://xkcd.com/538/ https://xkcd.com/538/ Possibly the dumbest xkcd ever made.
- saagarjha 7y ago
  On the contrary, I think it’s one of the most accurate xkcd comics ever made. We’ve already seen how thieves savvy with how phone locking works will force you at gunpoint to disable any security; it doesn’t matter at that point how strong the encryption protecting your phone is at that point.
xnzakg 7y ago
I would say there is one case where a fingerprint scanner is more secure than a password though, which is if you're trying to unlock your phone with someone peeking over your shoulder (or in an area with video surveillance).
- r00fus 7y ago
  There's also the "I have a complex passphraess for various apps/websites" but use iCloud keychain, 1Password, etc instead of typing in the password. From a usability perspective, passwords are a nightmare, TouchID is a bit better (e.g. dry or wet fingers don't reliably work), FaceID is quite usable. Apple seems the only company worth criticizing in this space.
andrewla 7y ago
I'm not sure why you're downvoted -- I don't agree with your conclusions, but many of the sibling posts are making grand statements about "biometrics are usernames" while disregarding the threat model entirely. I do disagree with a couple of your conclusions though, because the attacks you describe are all targeting you as an individual. There's a much broader class of attacks that should be worrisome -- adversaries seeking _any_ compromise of _any_ individual. Like getting a dump of passwords from neopets or something and trying all those passwords on Chase. For that kind of adversary, password is vulnerable, and biometrics is secure. And that kind of adversary is by far the most dangerous and prevelant. Especially biometrics in the Apple secure enclave model, where the key material is secured by the biometrics but is very strong -- far stronger than a password can be.
- tjoff 7y ago
  For phone login and such you can't really attempt a password without being physically in front of the phone anyway, so any device from any individual doesn't really apply, in this case.
- perl4ever 7y ago
  "For that kind of adversary, password is vulnerable, and biometrics is secure." The applications I'm familiar with, the password takes precedence. It doesn't require password and fingerprint. The thing is, if you add an extra factor, either you are required to use all of them, in which case it increases the risk of being wrongly locked out, or you are required to use any of them, in which case it increases the risk of the wrong person getting in.
  - mantap 7y ago
    I have an iPhone (fingerprints) and Android phone (password only). My adversary: my jealous girlfriend. I found it functionally impossible to secure the android against my girlfriend as she could watch me enter any code or password multiple times. She was not able to get into the iPhone, because the biometrics prevented her from being able to view the passcode being entered. Summary: biometrics are a reasonable substitute for a trusting relationship. :)

by nolok 7y ago

xoa 7y ago

You're correct about always having to evaluate security in terms of threat models, but you're off about a lot of your examples. >Close person tries to get in (significant other, coworker, ...): biometrics is flawed, password works. >Government respecting your rights tries to get in: biometrics is completly broken, password works. The first is fully incorrect, the second far too generalized and heavily incorrect. PINs/passwords are far, FAR more trivial to skim then biometrics. Even mere shoulder surfing isn't hard, but in a world with approaching ubiquitous hard to notice downward looking cameras if you ever input a password anywhere that isn't physically secure, and with no one looking, you can easily have it compromised. And it of course takes essentially zero resource expenditure and offers zero visibility to merely use the password once it's acquired. If it's at a random incident and a first-world type government wants to look, you can trivially disable biometrics on any decent implementation without even looking. So lack of biometrics buys you nothing. If it's a sting against you specifically then they can shoulder surf/camera it (remember the constant improvements in drones, are you REALLY not being watched well away from buildings even?) or just wait for you to unlock it and then swoop in and try to physically grab you while it's unlocked anyway. The scenario space where it'd make a difference is very, very minimal. Really, you want both: a strong password and biometrics for public usage. And for scenarios like border searches they can lawfully cause you enough inconvenience regardless that standard passcode is still not really the right response anyway. A burner, clean+remote load later, or alt-codes or the like would be the right way to go, though sadly I think only the first two are available right now. >Government that don't respect your rights tries to get in: https://xkcd.com/538/ https://xkcd.com/538/ Possibly the dumbest xkcd ever made.

saagarjha 7y ago
On the contrary, I think it’s one of the most accurate xkcd comics ever made. We’ve already seen how thieves savvy with how phone locking works will force you at gunpoint to disable any security; it doesn’t matter at that point how strong the encryption protecting your phone is at that point.

xnzakg 7y ago

I would say there is one case where a fingerprint scanner is more secure than a password though, which is if you're trying to unlock your phone with someone peeking over your shoulder (or in an area with video surveillance).

r00fus 7y ago
There's also the "I have a complex passphraess for various apps/websites" but use iCloud keychain, 1Password, etc instead of typing in the password. From a usability perspective, passwords are a nightmare, TouchID is a bit better (e.g. dry or wet fingers don't reliably work), FaceID is quite usable. Apple seems the only company worth criticizing in this space.

andrewla 7y ago

I'm not sure why you're downvoted -- I don't agree with your conclusions, but many of the sibling posts are making grand statements about "biometrics are usernames" while disregarding the threat model entirely. I do disagree with a couple of your conclusions though, because the attacks you describe are all targeting you as an individual. There's a much broader class of attacks that should be worrisome -- adversaries seeking _any_ compromise of _any_ individual. Like getting a dump of passwords from neopets or something and trying all those passwords on Chase. For that kind of adversary, password is vulnerable, and biometrics is secure. And that kind of adversary is by far the most dangerous and prevelant. Especially biometrics in the Apple secure enclave model, where the key material is secured by the biometrics but is very strong -- far stronger than a password can be.

tjoff 7y ago
For phone login and such you can't really attempt a password without being physically in front of the phone anyway, so any device from any individual doesn't really apply, in this case.
perl4ever 7y ago
"For that kind of adversary, password is vulnerable, and biometrics is secure." The applications I'm familiar with, the password takes precedence. It doesn't require password and fingerprint. The thing is, if you add an extra factor, either you are required to use all of them, in which case it increases the risk of being wrongly locked out, or you are required to use any of them, in which case it increases the risk of the wrong person getting in.
- mantap 7y ago
  I have an iPhone (fingerprints) and Android phone (password only). My adversary: my jealous girlfriend. I found it functionally impossible to secure the android against my girlfriend as she could watch me enter any code or password multiple times. She was not able to get into the iPhone, because the biometrics prevented her from being able to view the passcode being entered. Summary: biometrics are a reasonable substitute for a trusting relationship. :)