6 ms·

Biometrics are a userid, not a password.

by andyv 7y ago

smt88 7y ago
Not on iOS or Android phones. On most recent phones, they're both.
- djsumdog 7y ago
  Which is why I will never enable fingerprint or face unlocking ever. I'm fine with physically typing in my password. I like real security.
  - dannyw 7y ago
    For the average user whose password is 0000, maybe face unlocking IS more secure for them.
    - luxuryballs 7y ago
      unfortunately for that user, face unlock doesn’t disable passcode unlock
  - leokennis 7y ago
    I have an iPhone with Face ID and an 8 digit passcode. If I were to be arrested or whatever, all I need to do is press the power button 5 times in quick succession and Face ID is disabled and my passcode is required. So I can choose: - Unlock my phone with ease for 10’s of years and then quickly lock it once - Struggle to unlock it for 10’s of years to avoid having to quickly lock it once
    - Crosseye_Jack 7y ago
      If you enable voice control in accessibility you can reboot the device using a voice command “reboot this device”. After which you will need your passcode/word to unlock the device. Handy if you foresee a time you won’t be able to reach your device and tap the unlock button 5 times.
    - BiteCode_dev 7y ago
      Rebooting does that by default on android: it always requires your pin. No need to remember to press the x button n times. Just shut it down. A good habit anyway: you don't want them to be able to poke the ram.
      - anamexis 7y ago
        Rebooting resets the passcode requirement on iOS as well.
    - kebbekaise 7y ago
      If they tell you to unlock it but you 5 tap instead, then it wouldn't surprise me if it counts as obstructing justice. You'd need to do it quickly before the cuffs come on. And make sure the officer doesn't mistake you reaching for your pocket as you grabbing your gun.
  - coldcode 7y ago
    Physically typing in a passcode is less secure that you think given the wide range of cameras everywhere. All I have to do is observe you entering it once with a camera (likely from any angle where your movements are visible) and your security now belongs to me. FaceID cannot be recorded in any way. Of course you have to occasionally enter the PIN so it's still not perfect.
- Semaphor 7y ago
  Not really both. If anything, they are a temporary quick-unlock key. After a restart, before an extra-sensitive operation, and also after a certain amount of time/unlocks you can’t use your fingerprint to unlock things anymore and need to use your normal passcode/pattern.
dpark 7y ago
Biometrics are not usernames or passwords. They are a separate thing that has some similarly to both. A unique key is likewise neither a username nor a password but could act as both in the right circumstance. The discussion of biometrics is not advanced by parroting this hollow statement again and again. Please stop. There are compelling arguments why biometrics can be problematic. “It’s username not a password” is neither compelling nor truthful.
- mkeedlinger 7y ago
  I found their comment to be a useful way to easily explain it to those who are less technical. In that way I find it has value. Your comment, however, has quite an aggressive feel. I don't think it was warranted.
  - brewmarche 7y ago
    It seems a bit harsh to me as well but since you read the "fingerprints are just user names" mantra way too often on Hacker News, maybe the author of the comment thought it was time to become a bit louder. Here's my take on it: If you enter a passcode anyone close to you can see you enter it. It's much easier to figure out what you're typing on a smartphone than on a keyboard, and the oily residue on the touchscreen makes it even easier. A fingerprint on the other hand cannot be observed. Someone has to follow you or already know where you live and take fingerprints off doorknobs or something like it. Takes a lot of time and failure rate is still high. Then they have to use it on your device, so they have to have access to the device as well. Fingerprint scenarios make sense for _targeted_ attacks_ when you are way more likely to be hit by a scalable attack. It is much easier to brute force your password on a non-proof website or to find it in leaked password database. It scales very well and needs no physical access where no 2FA is enabled. One could argue that most users still will use weak passwords in combination with biometrics. Still, it pushes them to at least have a password. And if you're a more professional user the combination of a strong and random password in a password manager plus fingerprint for convenience seems like an okay trade-off, especially since you will know how to deactivate it temporarily (reboot device or press power button 10 times on iPhone for example).

Biometrics are a userid, not a password.

by andyv 7y ago

Biometrics are a userid, not a password.

smt88 7y ago

Not on iOS or Android phones. On most recent phones, they're both.

djsumdog 7y ago
Which is why I will never enable fingerprint or face unlocking ever. I'm fine with physically typing in my password. I like real security.
- dannyw 7y ago
  For the average user whose password is 0000, maybe face unlocking IS more secure for them.
  - luxuryballs 7y ago
    unfortunately for that user, face unlock doesn’t disable passcode unlock
- leokennis 7y ago
  I have an iPhone with Face ID and an 8 digit passcode. If I were to be arrested or whatever, all I need to do is press the power button 5 times in quick succession and Face ID is disabled and my passcode is required. So I can choose: - Unlock my phone with ease for 10’s of years and then quickly lock it once - Struggle to unlock it for 10’s of years to avoid having to quickly lock it once
  - Crosseye_Jack 7y ago
    If you enable voice control in accessibility you can reboot the device using a voice command “reboot this device”. After which you will need your passcode/word to unlock the device. Handy if you foresee a time you won’t be able to reach your device and tap the unlock button 5 times.
  - BiteCode_dev 7y ago
    Rebooting does that by default on android: it always requires your pin. No need to remember to press the x button n times. Just shut it down. A good habit anyway: you don't want them to be able to poke the ram.
    - anamexis 7y ago
      Rebooting resets the passcode requirement on iOS as well.
  - kebbekaise 7y ago
    If they tell you to unlock it but you 5 tap instead, then it wouldn't surprise me if it counts as obstructing justice. You'd need to do it quickly before the cuffs come on. And make sure the officer doesn't mistake you reaching for your pocket as you grabbing your gun.
- coldcode 7y ago
  Physically typing in a passcode is less secure that you think given the wide range of cameras everywhere. All I have to do is observe you entering it once with a camera (likely from any angle where your movements are visible) and your security now belongs to me. FaceID cannot be recorded in any way. Of course you have to occasionally enter the PIN so it's still not perfect.
Semaphor 7y ago
Not really both. If anything, they are a temporary quick-unlock key. After a restart, before an extra-sensitive operation, and also after a certain amount of time/unlocks you can’t use your fingerprint to unlock things anymore and need to use your normal passcode/pattern.

dpark 7y ago

Biometrics are not usernames or passwords. They are a separate thing that has some similarly to both. A unique key is likewise neither a username nor a password but could act as both in the right circumstance. The discussion of biometrics is not advanced by parroting this hollow statement again and again. Please stop. There are compelling arguments why biometrics can be problematic. “It’s username not a password” is neither compelling nor truthful.

mkeedlinger 7y ago
I found their comment to be a useful way to easily explain it to those who are less technical. In that way I find it has value. Your comment, however, has quite an aggressive feel. I don't think it was warranted.
- brewmarche 7y ago
  It seems a bit harsh to me as well but since you read the "fingerprints are just user names" mantra way too often on Hacker News, maybe the author of the comment thought it was time to become a bit louder. Here's my take on it: If you enter a passcode anyone close to you can see you enter it. It's much easier to figure out what you're typing on a smartphone than on a keyboard, and the oily residue on the touchscreen makes it even easier. A fingerprint on the other hand cannot be observed. Someone has to follow you or already know where you live and take fingerprints off doorknobs or something like it. Takes a lot of time and failure rate is still high. Then they have to use it on your device, so they have to have access to the device as well. Fingerprint scenarios make sense for _targeted_ attacks_ when you are way more likely to be hit by a scalable attack. It is much easier to brute force your password on a non-proof website or to find it in leaked password database. It scales very well and needs no physical access where no 2FA is enabled. One could argue that most users still will use weak passwords in combination with biometrics. Still, it pushes them to at least have a password. And if you're a more professional user the combination of a strong and random password in a password manager plus fingerprint for convenience seems like an okay trade-off, especially since you will know how to deactivate it temporarily (reboot device or press power button 10 times on iPhone for example).