4 ms·

So passwords are also two factors because you must be physically present and have a text input device? Most people I know now access their phone with fingerpri

So passwords are also two factors because you must be physically present and have a text input device? Most people I know now access their phone with fingerprint and can transfer fairly significant amounts of money from a banking app on that phone by doing a second authorisation with the same fingerprint. I'm honestly surprised that I've yet to read an account of this attack vector being exploited, but it doesn't seem safe to me.

dustinmoris 7y ago
> So passwords are also two factors because you must be physically present and have a text input device? No, password is 1 factor. An input device <> YOUR input device which you had to specifically configure/authorise to enable for NFC based payments or banking on your app. You cannot log in with your FaceID on any iphone which has your bank’s app installed and then do payments. You must have the app on your device and initially authenticate with much stronger credentials before your phone is then permitted to use FaceID subsequently. This is only allowed on the premise/assumption that you would have never done it on a stranger’s device and therefore your personal device or to say the possession of it is seen as an additional factor after initial setup.
filoleg 7y ago
Someone could find out your password and use your card. Doubt someone can perfectly steal and use your vein pattern and gait. Remember, biometrics are not supposed to be a replacement for passwords, they are supposed to be an extra auth factor.