3 ms·

Why are we still using passwords anyway? I want to log in everywhere with my iPhone. My iPhone has my FaceID stored locally, so in order to log in somewhere wi

Why are we still using passwords anyway? I want to log in everywhere with my iPhone. My iPhone has my FaceID stored locally, so in order to log in somewhere with my account someone has to be in possession of my iPhone first. That's the 1st factor. Secondly they have to be me, or at least somehow fake my face so that my iPhone can match my FaceID. That's the second factor. That is already a super convenient two factor authentication scheme. Why can't websites not send a request which invokes my iPhones two factor auth model to log in? Passwords AND password managers should be made redundant.

bkircher 6y ago
I can't change my face. I can change all my passwords, though. Also, I don't own an iPhone.
- tialaramex 6y ago
  You don't need to change your face. Your face is only authenticating you to your device because that's what you chose. If you don't want that (e.g. your identical twin sister loves pranking you) you can just use a different authenticator. The remote web site deliberately has no idea your face was involved, it just knows your identity was verified on its behalf by the hardware storing your private key.
- Jaruzel 6y ago
  This is why I don't like bio-metrics... I can have a near infinite number of passwords, but I only have 1 face, or 10 fingers. When all of my fingerprints are compromised, and the system only allows fingerprint login, now what do I do ?
tialaramex 6y ago
iOS 14 is announced to include a platform authenticator for WebAuthn that does exactly this. Pixel family and similar Android phones already do this.
snypox 6y ago
What happens if your face gets deformed in an accident? You unlock your phone with a pincode a re-add your face id?
Jaruzel 6y ago
Your two factors solve your 'identity' but not your 'authority'. This is why we have both usernames AND passwords. 'Who you are' is your username. 'Are you allowed into this system' is your password.

bkircher 6y ago

I can't change my face. I can change all my passwords, though. Also, I don't own an iPhone.

tialaramex 6y ago
You don't need to change your face. Your face is only authenticating you to your device because that's what you chose. If you don't want that (e.g. your identical twin sister loves pranking you) you can just use a different authenticator. The remote web site deliberately has no idea your face was involved, it just knows your identity was verified on its behalf by the hardware storing your private key.
Jaruzel 6y ago
This is why I don't like bio-metrics... I can have a near infinite number of passwords, but I only have 1 face, or 10 fingers. When all of my fingerprints are compromised, and the system only allows fingerprint login, now what do I do ?

tialaramex 6y ago

iOS 14 is announced to include a platform authenticator for WebAuthn that does exactly this. Pixel family and similar Android phones already do this.

snypox 6y ago

What happens if your face gets deformed in an accident? You unlock your phone with a pincode a re-add your face id?

Jaruzel 6y ago

Your two factors solve your 'identity' but not your 'authority'. This is why we have both usernames AND passwords. 'Who you are' is your username. 'Are you allowed into this system' is your password.