8 ms·

>- Passcode or biometric locks on an app are a gimmick and offer negligible value. Biometric locks are interfaces that the OS does not expose to users, and tha

>- Passcode or biometric locks on an app are a gimmick and offer negligible value. Biometric locks are interfaces that the OS does not expose to users, and that are backed via an HSM. On the iPhone and modern Android, they allow you to envelope encrypt a message via biometrics in such a way that it can only be unlocked from within the app that locked it AND via enrolled biometric signatures. Passcodes are the same, but easier to phish. It is incorrect to say that they "are a gimmick and offer negligible value". In this document, they lay out these mechanisms in great detail. Anyone with an interest in security should read this, imo. It's a magnificent "blue team" effort https://www.apple.com/ca/business-docs/iOS_Security_Guide.pdf https://www.apple.com/ca/business-docs/iOS_Security_Guide.pd...

trickstra 7y ago
Your biometrics are already getting analyzed from all angles somewhere in China just from all the face apps that predict which Disney princess you are. And you cannot change it like a password. So that's why it's a gimmick.
- aneutron 7y ago
  That is not very civil of you. OP is making a very solid point. Consider your threat model first. If you're a high value target, then yes it's probably a gimmick as you're more likely to have a gun to your head. But for other attack vectors that are more automatable and deployed at large (e.g. Trojan Apps), as OP suggests, it is a lot of things, but not a gimmick.
  - sV5OvuqTZXPSqw1 7y ago
    First, shoutout to HN for not blocking my Tor throwaway. I am someone who would be considered to be a "high value target" since I have had some of these things happen to me and I'm certain they will happen again in the future. I work in a politically sensitive industry where it turns out these things are commonplace. When I was younger I was always security conscious and took serious trade-offs to maintain my privacy. You could have called me paranoid, but I think I was more excited at the idea of being protected against all of these high-level threats, even if most of them were nonexistent at the time. While this discipline certainly benefited me later in life, I've realized that I will never again get the chance to reasonably evaluate my threats as "average" and enjoy some of the simpler conveniences of technology that come at the cost of compromising some high-severity threat models. Of course I still think there are a lot of precautions the average person can take to protect their privacy without major trade-offs, but those don't usually include state actor-level threats against your devices. I wouldn't change a thing now, but when I talk to people who see no reason to take anything more than the average precautions, I no longer think it's "cool" to do anything more than that because I know for a fact I would too if I was in their shoes.
  - inetknght 7y ago
    > That is not very civil of you. I think @trickstra was quite civil in their comment. And they also brought up a completely valid point: > > And you cannot change it like a password. So that's why it's a gimmick. Regardless of threat model, not being able to change biometrics makes them very high value to an opposing force. Using biometrics "for the masses" to whom they don't have that completely different threat model practically eliminates their ability to upgrade their threat model since their biometrics have potentially been compromised already. Therefore, it very much is a gimmick.
    - Karunamon 7y ago
      I'd say the threat model is critical. If your adversary is a state power targeting you personally, you have already lost. They'll just throw you in jail, or worse, until you put your thumb on the button. If your adversary is a random thief, or the untrustworthy general public, then it works great, and is a significant upgrade from the zero security that most people had prior to the proliferation of biometrics on phones.
      - trickstra 7y ago
        You are missing the point - it would be an upgrade, if it wasn't coupled with the proliferation of random apps scanning faces and fingerprints and people randomly giving out their biometrics to anyone. It won't take long before script kiddies will crawl the internet using the latest biometric leak just checking which other services the victims used.
lima 7y ago
> It is incorrect to say that they "are a gimmick and offer negligible value". I'm well aware of how the mechanism works. If the host OS or the app is compromised, it won't help - the attacker can just steal the codes after they're unlocked by the enclave. For physical theft, it only provides a meaningful advantage if the phone is unlocked. Someone stealing your unlocked phone to get at your 2FA codes is well outside of most people's threat model.
- renton_tacos 7y ago
  >If the host OS or the app is compromised, it won't help - the attacker can just steal the codes after they're unlocked by the enclave. If the host OS or app is compromised, then it absolutely helps! The codes cannot be stolen until the user unlocks. Considering that the most recent iOS jailbreak was not persistent, due to their chain or trust, this is absolutely helpful. It's one component of defense in depth. In a system with a properly established chain of trust (as ios and android have now), compromising only one component is not enough to ensure complete user compromise. In your "advanced threat" example, where a fed compromises a device, powering off and then on the device will hopefully put the device into a trusted state again. Aside from the boot0 exploit that nailed ios a few months ago, a few revealed state-level attacks _were not persistent_. Even here, it helps! >For physical theft, it only provides a meaningful advantage if the phone is unlocked. These biometric mechanisms are implemented in such a way that "opportunistic" theft (such a as a mugging) yields a positive outcome for average users. >Someone stealing your unlocked phone to get at your 2FA codes is well outside of most people's threat model. Aside from the aforementioned compromised host example, which has been a problem on android in the past.... 2FA, sure, that's a bit more esoteric... except... not really. Since 2FA can be used for payments, or other sensitive info, we should probably give users the opportunity to protect against. I work for a personal finance company and we enforce biometrics for a 2nd factor on login to help protect against both the compromised host threat, but also to prevent against spousal, familial id theft (more common than you'd think, sadly). Your familial member may know your passcode, but they will be unable to access your financial data.
  - lima 7y ago
    I agree with you that it's a good defense in depth measure for exactly the reasons you describe.
CraneWorm 7y ago
Your biometrics cannot be changed nor revoked; they are neither a login nor a password.
- renton_tacos 7y ago
  They are a weak mechanism against individual targeted attacks, but a great mechanism for herd immunity. It's not perfect, for sure, but it helps raise the posture for the general user in a way that's easy and accessible. That's a win, imo.
  - CraneWorm 7y ago
    > They are a [...] great mechanism for herd immunity. I don't see how, could you elaborate what you mean? Imagine a leak from a database storing biometric keys, is this a disaster on par with a normal leak? In my opinion it's even worse! You might say we only use biometrics for a local authentication, but that would limit their application. If you convince people biometrics are great, such database will inevitably be created - what are the chances we store and guard biometrics better than we do with passwords?
    - ryukafalz 7y ago
      Sure, but keep in mind the prerequisites for using that leaked data. You have to either place yourself in between the sensor and the rest of the device or physically recreate the biometric with enough fidelity to fool the sensor. These are both possible, yes, but they’re significantly less trivial than using a password. This, by the way, still also requires physical access to the device if used for local authentication. And in the event biometrics are used in a physical location (which I’m not personally a fan of, but let’s consider it anyway), there’s often also a human there as well. Your clever mask may fool the sensor, but it probably also still looks like a mask to the guard behind the desk.

trickstra 7y ago

Your biometrics are already getting analyzed from all angles somewhere in China just from all the face apps that predict which Disney princess you are. And you cannot change it like a password. So that's why it's a gimmick.

aneutron 7y ago
That is not very civil of you. OP is making a very solid point. Consider your threat model first. If you're a high value target, then yes it's probably a gimmick as you're more likely to have a gun to your head. But for other attack vectors that are more automatable and deployed at large (e.g. Trojan Apps), as OP suggests, it is a lot of things, but not a gimmick.
- sV5OvuqTZXPSqw1 7y ago
  First, shoutout to HN for not blocking my Tor throwaway. I am someone who would be considered to be a "high value target" since I have had some of these things happen to me and I'm certain they will happen again in the future. I work in a politically sensitive industry where it turns out these things are commonplace. When I was younger I was always security conscious and took serious trade-offs to maintain my privacy. You could have called me paranoid, but I think I was more excited at the idea of being protected against all of these high-level threats, even if most of them were nonexistent at the time. While this discipline certainly benefited me later in life, I've realized that I will never again get the chance to reasonably evaluate my threats as "average" and enjoy some of the simpler conveniences of technology that come at the cost of compromising some high-severity threat models. Of course I still think there are a lot of precautions the average person can take to protect their privacy without major trade-offs, but those don't usually include state actor-level threats against your devices. I wouldn't change a thing now, but when I talk to people who see no reason to take anything more than the average precautions, I no longer think it's "cool" to do anything more than that because I know for a fact I would too if I was in their shoes.
- inetknght 7y ago
  > That is not very civil of you. I think @trickstra was quite civil in their comment. And they also brought up a completely valid point: > > And you cannot change it like a password. So that's why it's a gimmick. Regardless of threat model, not being able to change biometrics makes them very high value to an opposing force. Using biometrics "for the masses" to whom they don't have that completely different threat model practically eliminates their ability to upgrade their threat model since their biometrics have potentially been compromised already. Therefore, it very much is a gimmick.
  - Karunamon 7y ago
    I'd say the threat model is critical. If your adversary is a state power targeting you personally, you have already lost. They'll just throw you in jail, or worse, until you put your thumb on the button. If your adversary is a random thief, or the untrustworthy general public, then it works great, and is a significant upgrade from the zero security that most people had prior to the proliferation of biometrics on phones.
    - trickstra 7y ago
      You are missing the point - it would be an upgrade, if it wasn't coupled with the proliferation of random apps scanning faces and fingerprints and people randomly giving out their biometrics to anyone. It won't take long before script kiddies will crawl the internet using the latest biometric leak just checking which other services the victims used.

lima 7y ago

> It is incorrect to say that they "are a gimmick and offer negligible value". I'm well aware of how the mechanism works. If the host OS or the app is compromised, it won't help - the attacker can just steal the codes after they're unlocked by the enclave. For physical theft, it only provides a meaningful advantage if the phone is unlocked. Someone stealing your unlocked phone to get at your 2FA codes is well outside of most people's threat model.

renton_tacos 7y ago
>If the host OS or the app is compromised, it won't help - the attacker can just steal the codes after they're unlocked by the enclave. If the host OS or app is compromised, then it absolutely helps! The codes cannot be stolen until the user unlocks. Considering that the most recent iOS jailbreak was not persistent, due to their chain or trust, this is absolutely helpful. It's one component of defense in depth. In a system with a properly established chain of trust (as ios and android have now), compromising only one component is not enough to ensure complete user compromise. In your "advanced threat" example, where a fed compromises a device, powering off and then on the device will hopefully put the device into a trusted state again. Aside from the boot0 exploit that nailed ios a few months ago, a few revealed state-level attacks _were not persistent_. Even here, it helps! >For physical theft, it only provides a meaningful advantage if the phone is unlocked. These biometric mechanisms are implemented in such a way that "opportunistic" theft (such a as a mugging) yields a positive outcome for average users. >Someone stealing your unlocked phone to get at your 2FA codes is well outside of most people's threat model. Aside from the aforementioned compromised host example, which has been a problem on android in the past.... 2FA, sure, that's a bit more esoteric... except... not really. Since 2FA can be used for payments, or other sensitive info, we should probably give users the opportunity to protect against. I work for a personal finance company and we enforce biometrics for a 2nd factor on login to help protect against both the compromised host threat, but also to prevent against spousal, familial id theft (more common than you'd think, sadly). Your familial member may know your passcode, but they will be unable to access your financial data.
- lima 7y ago
  I agree with you that it's a good defense in depth measure for exactly the reasons you describe.

CraneWorm 7y ago

Your biometrics cannot be changed nor revoked; they are neither a login nor a password.

renton_tacos 7y ago
They are a weak mechanism against individual targeted attacks, but a great mechanism for herd immunity. It's not perfect, for sure, but it helps raise the posture for the general user in a way that's easy and accessible. That's a win, imo.
- CraneWorm 7y ago
  > They are a [...] great mechanism for herd immunity. I don't see how, could you elaborate what you mean? Imagine a leak from a database storing biometric keys, is this a disaster on par with a normal leak? In my opinion it's even worse! You might say we only use biometrics for a local authentication, but that would limit their application. If you convince people biometrics are great, such database will inevitably be created - what are the chances we store and guard biometrics better than we do with passwords?
  - ryukafalz 7y ago
    Sure, but keep in mind the prerequisites for using that leaked data. You have to either place yourself in between the sensor and the rest of the device or physically recreate the biometric with enough fidelity to fool the sensor. These are both possible, yes, but they’re significantly less trivial than using a password. This, by the way, still also requires physical access to the device if used for local authentication. And in the event biometrics are used in a physical location (which I’m not personally a fan of, but let’s consider it anyway), there’s often also a human there as well. Your clever mask may fool the sensor, but it probably also still looks like a mask to the guard behind the desk.