5 ms·
In general, I'm on board with what you're saying, but there's a thing with security credentials: it's important for me to allow me to give them away to the guy
by scarejunba 7y ago
In general, I'm on board with what you're saying, but there's a thing with security credentials: it's important for me to allow me to give them away to the guy with a knife.
If knife guy comes for me and says "Your phone and password or your life" I can give it to him. It's kind of important that I can or else he'll take my bloody finger with him and body integrity is way more important to me than any amount of my data.
Literally, I prefer my fingers attached and you can clear my bank account rather than the alternative.
- Marsymars 7y agoThe solution here seems to be some credentialing solution that can neither be given away voluntarily nor taken by force. Is such a thing possible?
- munk-a 7y agoI disagree, I don't think there is any need for proof of identity to not be voluntarily relinquishable. I think relinquishable credentials are quite useful for a number of delegation related uses - but if they are relinquishable then they need to be expirable as well.
- Marsymars 7y agoThe guy with a knife won't ask for proof of identity that he knows you can't give up.
- rolph 7y agothe guy with the knife is why fingerprints retinal or iris scans, and facial metrics shouldnt be used. You may not be able to give these things but they can be taken, using that knife.
- godelski 7y agoYou don't even have to be alive for those things either.
- munk-a 7y agoIf a guy with a knife wants my password I'm going to give it up and walk away alive, then try and recoup the loss of whatever I gave up... maybe I get the debit against an account reversed or purge recent account activity from social media. There currently is nothing secret like that that I'd give up my life to protect, and I can't conceive of anything of such import existing... for those cases where the item is truly dangerous (like the nuclear football) then a guy with a knife being a threat is already a failure of security.
- lonelappde 7y agoThis is how iPhone works today. Apple bricks your phone if it is stolen, as a disincentive against theft.
- scarface74 7y agoDetached fingers don’t work with modern implementations of fingerprint sensors.
- munk-a 7y agoOh, I was unaware of that - so I'm not certain I want to rely on the knowledge of someone in a position to cut off my finger... additionally, they don't currently work, but I'm sure there could be developed ways to spoof them by artificially circulating warmed blood or some such. Just... biometrics are such a terrible idea - let's not even open that door.
- rolph 7y agothe problem isnt weather or not its true, the problem is how likely someone is to try using a severed part any way, because it just might be FUD and a dead finger is just as good as attached. aside from that, a severed finger continues to live for a while afterward, it doesnt instantly perish. it has to metabolize its oxygen reserves.
- scarface74 7y agoThe most popular and high priced phone has had fingerprint authentication since 2013. If there was going to be a rash of people cutting off fingers, wouldn’t it have happened by now?
- rolph 7y agoIf it happened would any PR department admit it? so far the tactic of waiting for someone to unlock a phone then robbing them has been effective. as soon as it becomes required behaviour it will happen. so far there are methods of hijacking a phone from its original owner, even without the phone in hand [simjacking] and as such tactics are stymied, other more brutal force methods would be required.
- scarface74 7y ago