4 ms·

The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go. I'd rather see Apple pick up something like SQRL[0] than con

The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go. I'd rather see Apple pick up something like SQRL[0] than continue down this path of pseudo-security. They work, but it's like having a half-blind doorman who can't tell if you're wearing a mask or if it's your real face. 0: https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm

jmull 6y ago
> The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go. Sounds vague and overly general. I don't think anyone can take this seriously without some more information.
- LockAndLol 6y ago
  You are but a duck-search away Face ID defeated with glasses and tape https://appleinsider.com/articles/19/08/08/face-id-security-defeated-with-glasses-and-tape https://appleinsider.com/articles/19/08/08/face-id-security-... Touch ID defeated by lifted fingerprints 2013: https://arstechnica.com/information-technology/2013/09/defeating-apples-touch-id-its-easier-than-you-may-think/ https://arstechnica.com/information-technology/2013/09/defea... 2016: https://appleinsider.com/articles/13/09/22/apples-touch-id-already-bypassed-with-established-fake-finger-technique https://appleinsider.com/articles/13/09/22/apples-touch-id-a... 2019: https://www.forbes.com/sites/daveywinder/2019/11/02/smartphone-security-alert-as-hackers-claim-any-fingerprint-lock-broken-in-20-minutes/ https://www.forbes.com/sites/daveywinder/2019/11/02/smartpho... Biometric "security" on phones is a gimmick.
  - jmull 6y ago
    These demos are useful to help understand the limitations of these security measures, but hardly invalidate them. E.g. from the first article you linked: > the attack is only really useful against unconscious victims, requiring both physical access and the tricky move of placing glasses on their face without waking them up. All authentication mechanisms have limitations, BTW.
Rafert 6y ago
On Android any way you've set up to unlock the device can be used to also authenticate locally for unlocking the key material (stored inside a TEE): swipe pattern, finger print, PIN code, password, etc. Once that is done the key material is used with WebAuthn protocol which is fairly straightforward public key crypto operations that have been well vetted. Based on this video we don't know exactly if Apple allows that to be done as well, but it seems within the realm of possibility based on how Apple Pay works (which AFAIK can use a passcode). Either way discarding the entire protocol because of one implementation is silly. With Apple joining Google, Microsoft and many other companies supporting WebAuthn (a W3C standard) there's a lot of support for it to make logging in easier and more secure. SQRL never got any real traction.

jmull 6y ago

> The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go. Sounds vague and overly general. I don't think anyone can take this seriously without some more information.

LockAndLol 6y ago
You are but a duck-search away Face ID defeated with glasses and tape https://appleinsider.com/articles/19/08/08/face-id-security-defeated-with-glasses-and-tape https://appleinsider.com/articles/19/08/08/face-id-security-... Touch ID defeated by lifted fingerprints 2013: https://arstechnica.com/information-technology/2013/09/defeating-apples-touch-id-its-easier-than-you-may-think/ https://arstechnica.com/information-technology/2013/09/defea... 2016: https://appleinsider.com/articles/13/09/22/apples-touch-id-already-bypassed-with-established-fake-finger-technique https://appleinsider.com/articles/13/09/22/apples-touch-id-a... 2019: https://www.forbes.com/sites/daveywinder/2019/11/02/smartphone-security-alert-as-hackers-claim-any-fingerprint-lock-broken-in-20-minutes/ https://www.forbes.com/sites/daveywinder/2019/11/02/smartpho... Biometric "security" on phones is a gimmick.
- jmull 6y ago
  These demos are useful to help understand the limitations of these security measures, but hardly invalidate them. E.g. from the first article you linked: > the attack is only really useful against unconscious victims, requiring both physical access and the tricky move of placing glasses on their face without waking them up. All authentication mechanisms have limitations, BTW.

Rafert 6y ago

On Android any way you've set up to unlock the device can be used to also authenticate locally for unlocking the key material (stored inside a TEE): swipe pattern, finger print, PIN code, password, etc. Once that is done the key material is used with WebAuthn protocol which is fairly straightforward public key crypto operations that have been well vetted. Based on this video we don't know exactly if Apple allows that to be done as well, but it seems within the realm of possibility based on how Apple Pay works (which AFAIK can use a passcode). Either way discarding the entire protocol because of one implementation is silly. With Apple joining Google, Microsoft and many other companies supporting WebAuthn (a W3C standard) there's a lot of support for it to make logging in easier and more secure. SQRL never got any real traction.