7 ms·

These all seem to be examples that use faceID/touchID as a password. That’s not what biometrics should be though, they should be the username. I hope that this

by jjcm 6y ago

These all seem to be examples that use faceID/touchID as a password. That’s not what biometrics should be though, they should be the username. I hope that this is supported as a flow as well. Identify who you are with biometrics, and prove your access with a correlated password.

arnarbi 6y ago
First, the model in FIDO is that it's the piece of hardware (in this case, your laptop or iOS device) that is your authentication factor. The biometric is a local facility for unlocking that device and approving that specific action. Second, the primary threat identity providers (and their users) deal with are remote, impersonal hijacking of accounts, where the password is either guessed (because it existed in a leak) or the user was phished. That's the primary value of something like this. Attacks where someone can lift your fingerprints or has your device are real but much much less common.
dlivingston 6y ago
Maybe (probably) I’m just ignorant of the actual state of the industry, but it seems to me that biometrics have always been about providing full user authentication. I’m not personally aware of any instance where an alphanumeric password is still required as a secondary authenticator to biometrics.
- DaiPlusPlus 6y ago
  > I’m not personally aware of any instance where an alphanumeric password is still required as a secondary authenticator to biometrics. It's straightforward to configure Active Directory / Group Policy to require biometric and password factors for interactive authentication. The main reason not to allow _only_ biometrics is to disincentivize chopping fingers off (well, it's more because [it's still surprisingly easy to fool biometric systems](https://www.theguardian.com/technology/2014/dec/30/hacker-fakes-german-ministers-fingerprints-using-photos-of-her-hands https://www.theguardian.com/technology/2014/dec/30/hacker-fa...)).
  - Spivak 6y ago
    I mean you're referencing an article from 2014 about a relatively unsophisticated biometric auth system. It's like saying "TSA locks are stupidly easy to pick." There are extremely high-security biometric auth systems that you would have a much harder time fooling. The high-res retina scanners that take a 3d map of your eye and detect blood flow would be a much better assessment of what's possible.
gumby 6y ago
But I like to use touchID to authenticate with multiple usernames on the same site. Using it as the username would reduce it to only working in a single case.
dustinmoris 6y ago
That doesn't make sense. Username + Password is a cumbersome workaround because (so far) machines couldn't use biometrics to authenticate a user. Now they can, so we can let go of that very problematic and often insecure model. Think like this, when you go to visit your grandmother and knock on her door you don't have to provide a password. You don't have to provide anything, because the human brain is capable of determining your identity in less than a fraction of a second. This is why as soon as your grandmother opens the door she'll have a smile on her face and welcome you in. That IS biometrics. Now machines can do the same. It's the oldest and most secure form of authentication in human history.
- JoeAltmaier 6y ago
  Biometrics fails every test for a password. 1) A password is secret 2) You don't leave copies of it lying around everywhere 3) You can change it periodically 4) If discovered, it can't be traced back to you No, biometrics can only be a username. It can never be an acceptable password.
  - dustinmoris 6y ago
    It falls short, because biometrics <> passwords. As I said, biometrics == identity. Compare biometrics with identity: 1) Your identity is not secret. Your mother knows you, your entire school knows you, your neighbour knows you, when you go anywhere the police may ask for your ID at any time and knows you. Biometrics is the same. 2) You don't hide every day from the world. You don't cover your face (ok maybe before COVID) when entering a shop ;) 3) You cannot change who you are. You shouldn't have to and shouldn't want to. Same for biometrics. 4) If your identity is discovered then of course they know who you are. Same applies for biometrics. So yes, biometrics isn't passwords, it's identity. Username + Password is a workaround to establish a person's identity and will never be as good as a biometric. The fact that you can have multiple usernames but only the same right index fingerprint is proof that biometrics is superior in establishing your identity than username + password.
    - bnj 6y ago
samatman 6y ago
This is a good doctrine, and a bad dogma. Under the hood, [bio]ID generates a one-time token with a signature that serves as a superior substitute to a password. If your face or fingerprint don't happen to be around, you can always use the password for the same account to reset it. If you have legal concerns about being coerced into using a biometric system, you should disable it. One of the problems "biometrics shouldn't be a password" is meant to expose, is that you can't reset a biometric if it leaks. By keeping the biometrics inside a device at all times, the T2 system substantially mitigates this risk. I'm fairly certain you can remove a device from your Apple account, and the ID system will no longer work, even if provided with your face or fingerprint.
whereistimbo 6y ago
Authentication and authorization If the machine can prove that you are indeed you through biometric authentication, why take another step for authorization?
- whereistimbo 6y ago
  This only makes sense if you have multiple personality disorder. if there are many alters that shares one body, after successful biometric authentication, the machine might need to request password for authorization to prevent unsolicited access from another alter in one body.
Polylactic_acid 6y ago
I might be wrong but I don't think thats how its working. It sounds like your phone saves a password/key locally and then when you load a website, faceid is used by your phone to unlock the keyring and sends the normal password to the website. I'm not sure what the UX is when moving devices though.
anang 6y ago
I know I’m just repeating what a lot of other have said, but this is sort of missing how this works. To use SSH as an example: What you’re describing is essentially using a fingerprint instead of a private key or password for logging into a server via ssh. The way this works is more akin to using a private key to login via SSH, but that private key is protected by a fingerprint instead of a password. Ultimately the security comes from not sharing your private key, rather than the mechanism used to protect that key.

by jjcm 6y ago

arnarbi 6y ago

First, the model in FIDO is that it's the piece of hardware (in this case, your laptop or iOS device) that is your authentication factor. The biometric is a local facility for unlocking that device and approving that specific action. Second, the primary threat identity providers (and their users) deal with are remote, impersonal hijacking of accounts, where the password is either guessed (because it existed in a leak) or the user was phished. That's the primary value of something like this. Attacks where someone can lift your fingerprints or has your device are real but much much less common.

dlivingston 6y ago

Maybe (probably) I’m just ignorant of the actual state of the industry, but it seems to me that biometrics have always been about providing full user authentication. I’m not personally aware of any instance where an alphanumeric password is still required as a secondary authenticator to biometrics.

DaiPlusPlus 6y ago
> I’m not personally aware of any instance where an alphanumeric password is still required as a secondary authenticator to biometrics. It's straightforward to configure Active Directory / Group Policy to require biometric and password factors for interactive authentication. The main reason not to allow _only_ biometrics is to disincentivize chopping fingers off (well, it's more because [it's still surprisingly easy to fool biometric systems](https://www.theguardian.com/technology/2014/dec/30/hacker-fakes-german-ministers-fingerprints-using-photos-of-her-hands https://www.theguardian.com/technology/2014/dec/30/hacker-fa...)).
- Spivak 6y ago
  I mean you're referencing an article from 2014 about a relatively unsophisticated biometric auth system. It's like saying "TSA locks are stupidly easy to pick." There are extremely high-security biometric auth systems that you would have a much harder time fooling. The high-res retina scanners that take a 3d map of your eye and detect blood flow would be a much better assessment of what's possible.

gumby 6y ago

But I like to use touchID to authenticate with multiple usernames on the same site. Using it as the username would reduce it to only working in a single case.

dustinmoris 6y ago

That doesn't make sense. Username + Password is a cumbersome workaround because (so far) machines couldn't use biometrics to authenticate a user. Now they can, so we can let go of that very problematic and often insecure model. Think like this, when you go to visit your grandmother and knock on her door you don't have to provide a password. You don't have to provide anything, because the human brain is capable of determining your identity in less than a fraction of a second. This is why as soon as your grandmother opens the door she'll have a smile on her face and welcome you in. That IS biometrics. Now machines can do the same. It's the oldest and most secure form of authentication in human history.

JoeAltmaier 6y ago
Biometrics fails every test for a password. 1) A password is secret 2) You don't leave copies of it lying around everywhere 3) You can change it periodically 4) If discovered, it can't be traced back to you No, biometrics can only be a username. It can never be an acceptable password.
- dustinmoris 6y ago
  It falls short, because biometrics <> passwords. As I said, biometrics == identity. Compare biometrics with identity: 1) Your identity is not secret. Your mother knows you, your entire school knows you, your neighbour knows you, when you go anywhere the police may ask for your ID at any time and knows you. Biometrics is the same. 2) You don't hide every day from the world. You don't cover your face (ok maybe before COVID) when entering a shop ;) 3) You cannot change who you are. You shouldn't have to and shouldn't want to. Same for biometrics. 4) If your identity is discovered then of course they know who you are. Same applies for biometrics. So yes, biometrics isn't passwords, it's identity. Username + Password is a workaround to establish a person's identity and will never be as good as a biometric. The fact that you can have multiple usernames but only the same right index fingerprint is proof that biometrics is superior in establishing your identity than username + password.
  - bnj 6y ago

samatman 6y ago

This is a good doctrine, and a bad dogma. Under the hood, [bio]ID generates a one-time token with a signature that serves as a superior substitute to a password. If your face or fingerprint don't happen to be around, you can always use the password for the same account to reset it. If you have legal concerns about being coerced into using a biometric system, you should disable it. One of the problems "biometrics shouldn't be a password" is meant to expose, is that you can't reset a biometric if it leaks. By keeping the biometrics inside a device at all times, the T2 system substantially mitigates this risk. I'm fairly certain you can remove a device from your Apple account, and the ID system will no longer work, even if provided with your face or fingerprint.

whereistimbo 6y ago

Authentication and authorization If the machine can prove that you are indeed you through biometric authentication, why take another step for authorization?

whereistimbo 6y ago
This only makes sense if you have multiple personality disorder. if there are many alters that shares one body, after successful biometric authentication, the machine might need to request password for authorization to prevent unsolicited access from another alter in one body.

Polylactic_acid 6y ago

I might be wrong but I don't think thats how its working. It sounds like your phone saves a password/key locally and then when you load a website, faceid is used by your phone to unlock the keyring and sends the normal password to the website. I'm not sure what the UX is when moving devices though.

anang 6y ago

I know I’m just repeating what a lot of other have said, but this is sort of missing how this works. To use SSH as an example: What you’re describing is essentially using a fingerprint instead of a private key or password for logging into a server via ssh. The way this works is more akin to using a private key to login via SSH, but that private key is protected by a fingerprint instead of a password. Ultimately the security comes from not sharing your private key, rather than the mechanism used to protect that key.