4 ms·

That doesn't make sense. Username + Password is a cumbersome workaround because (so far) machines couldn't use biometrics to authenticate a user. Now they can,

That doesn't make sense. Username + Password is a cumbersome workaround because (so far) machines couldn't use biometrics to authenticate a user. Now they can, so we can let go of that very problematic and often insecure model. Think like this, when you go to visit your grandmother and knock on her door you don't have to provide a password. You don't have to provide anything, because the human brain is capable of determining your identity in less than a fraction of a second. This is why as soon as your grandmother opens the door she'll have a smile on her face and welcome you in. That IS biometrics. Now machines can do the same. It's the oldest and most secure form of authentication in human history.

JoeAltmaier 6y ago
Biometrics fails every test for a password. 1) A password is secret 2) You don't leave copies of it lying around everywhere 3) You can change it periodically 4) If discovered, it can't be traced back to you No, biometrics can only be a username. It can never be an acceptable password.
- dustinmoris 6y ago
  It falls short, because biometrics <> passwords. As I said, biometrics == identity. Compare biometrics with identity: 1) Your identity is not secret. Your mother knows you, your entire school knows you, your neighbour knows you, when you go anywhere the police may ask for your ID at any time and knows you. Biometrics is the same. 2) You don't hide every day from the world. You don't cover your face (ok maybe before COVID) when entering a shop ;) 3) You cannot change who you are. You shouldn't have to and shouldn't want to. Same for biometrics. 4) If your identity is discovered then of course they know who you are. Same applies for biometrics. So yes, biometrics isn't passwords, it's identity. Username + Password is a workaround to establish a person's identity and will never be as good as a biometric. The fact that you can have multiple usernames but only the same right index fingerprint is proof that biometrics is superior in establishing your identity than username + password.
  - bnj 6y ago
    I see what you’re saying about real world identity but digital identities don’t [have to] share those constraints. Digital identities can be instantiated and discarded at will.
    - JoeAltmaier 6y ago
      Not if they're 'secured' by biometrics. Then they are almost trivially subvertable.
  - ogre_codes 6y ago
    > It falls short, because biometrics <> passwords. As I said, biometrics == identity. This is just dogma, it's not based on the actual implementation details. TouchID for the web requires: Something you are (biometric), and something you have (Your phone/ computer). If someone "Discovers" my fingerprints, they are worthless without the phone/ computer which has the Secure Enclave I've matched them to. If my phone is stolen, I can invalidate the entire device as a method of authentication.
- coder543 6y ago
  You don't seem to be aware of what is under discussion here. You just raised a huge strawman. Websites are not receiving your biometrics in this context, and your biometrics would be meaningless to the website if captured and somehow provided. Your biometric signature is stored solely inside the Secure Enclave in the Apple device. If and only if the Secure Enclave recognizes you via your biometrics will the Enclave uses a non-transferrable key stored only in the Enclave to attest to the website that you are the user "JoeAltmaier". - The key is secret. - The key is kept in only one place. - The key can easily be discarded and a new one made. - The key is never given to anything outside of the Enclave, so... I'm not sure how it could be traced to you, besides the whole fact that it is being used to authenticate you, which is necessary. Sounds pretty acceptable to me as a password. The usability issue here is that a website needs to be able to accept a different password from each device you own, since the password is non-transferrable, and you might accidentally drop your iPhone to the bottom of the ocean. Good news: FIDO2 is an entire standard built around this concept, originally intended for use on YubiKeys and similar FIDO2-compliant USB sticks. Apple is building an implementation of FIDO2 that uses the iPhone that's already in the person's hand. If the Secure Enclave is compromised (which does happen sometimes), then Bad Things could happen... but that's also what happens when a password manager tool is compromised.
  - JoeAltmaier 6y ago
    That's sophistry. The fact is, the laptop is 'secured' by biometrics, which can be spoofed. Having a key-to-the-key is not safe if the biometrics are not safe.
    - coder543 6y ago
      It is not sophistry, and sophistry is not a word I've ever seen used in a genuine conversation, so I immediately doubt your sincerity in this conversation. If someone wants to fake biometrics on an iPhone, they have a very limited window of time to do so, and the user can lock out the biometrics in less than 3 seconds just by "squeezing" the phone. (power button + either volume key, 2 seconds later the biometrics are locked out.) It's much harder to fake the biometrics in that very brief window of time (maximum 48 hours) than it is to shoulder surf a password. Unless your threat model includes State Level Actors, biometric bypass is a very remote concern. If your threat model includes State Level Actors, you're probably screwed either way, since they can easily afford to shoulder surf you. For everyone else, the main concern is that someone not physically present will manage to acquire your password and log into your services. Passwords suck at this threat model. FIDO2 makes this scenario impossible without that remote person managing to execute a Secure Enclave 0day on your personal device... and even then, it's still way harder than acquiring your password. Not even the website you're authenticating against receives your FIDO2 key... websites always receive your password, which is awful for security. Some related info here: https://news.ycombinator.com/item?id=24830642 https://news.ycombinator.com/item?id=24830642
- deleted 6y ago
  [deleted]
- Spivak 6y ago
  You're missing the point of biometrics. Something you are is a form of authentication that only you can use. Your face, fingerprints, blood, retinas are all public but try as you might you can't make another living human with the same features. If your view of fingerprint auth is "a picture of your face is the password" then of course it sounds stupid. It's actually "a face with the correct features attached to an alive human" which is much harder to fake. The whole point of biometric auth and all the advancements in the industry are about correctly identifying alive humans and the strength of any system that uses biometrics is directly related to that. You can say current systems aren't good enough at this yet for your personal thread models but it's real security, and beats the hell out of a 4/5 digit lock screen passcode.
  - JoeAltmaier 6y ago
    That's trivially refutable. Fingerprints are left everywhere, and can be lifted and reproduced with common household substances (tape, glue etc). A face can be photographed, printed and presented trivially. And so far, biometrics falls far short of a 4/5 digit lock passcode. The entropy in most fingerprint sensors is a few bits. They are famously defeatable. Nothing will change the fact that you cannot keep your face and fingerprints secret, cannot/won't change them, and they are always, always traceable to you. Using them to secure a 'better' key is not security at all.
    - Spivak 6y ago
      It doesn't matter since your fingerprint isn't secret. It's not enough to have a picture of my fingerprint, you have to produce a convincing enough fake of a real human with the right fingerprint. Take this to meatspace for a second. If you had a security guard sitting at a desk inspecting your hands and taking fingerprints you couldn't trick them with pictures. You can't hold up a picture of my face to a guard and expect that they'll suddenly think you're me. Biometric auth systems are trying to the same thing but without the human. > They are famously defeatable. And most locks in wide-use today are also defeatable by amateur locksmiths, that's not really the point. There are sophisticated biometric auth systems that aren't fooled by pictures. FaceID is one example.
- roughly 6y ago
  Biometrics fail every test for a password, but, assuming sufficient accuracy, work pretty well for Authentication, which is the actual purpose of a password. Biometrics are closer to a public key than a password.

JoeAltmaier 6y ago

Biometrics fails every test for a password. 1) A password is secret 2) You don't leave copies of it lying around everywhere 3) You can change it periodically 4) If discovered, it can't be traced back to you No, biometrics can only be a username. It can never be an acceptable password.

dustinmoris 6y ago
It falls short, because biometrics <> passwords. As I said, biometrics == identity. Compare biometrics with identity: 1) Your identity is not secret. Your mother knows you, your entire school knows you, your neighbour knows you, when you go anywhere the police may ask for your ID at any time and knows you. Biometrics is the same. 2) You don't hide every day from the world. You don't cover your face (ok maybe before COVID) when entering a shop ;) 3) You cannot change who you are. You shouldn't have to and shouldn't want to. Same for biometrics. 4) If your identity is discovered then of course they know who you are. Same applies for biometrics. So yes, biometrics isn't passwords, it's identity. Username + Password is a workaround to establish a person's identity and will never be as good as a biometric. The fact that you can have multiple usernames but only the same right index fingerprint is proof that biometrics is superior in establishing your identity than username + password.
- bnj 6y ago
  I see what you’re saying about real world identity but digital identities don’t [have to] share those constraints. Digital identities can be instantiated and discarded at will.
  - JoeAltmaier 6y ago
    Not if they're 'secured' by biometrics. Then they are almost trivially subvertable.
- ogre_codes 6y ago
  > It falls short, because biometrics <> passwords. As I said, biometrics == identity. This is just dogma, it's not based on the actual implementation details. TouchID for the web requires: Something you are (biometric), and something you have (Your phone/ computer). If someone "Discovers" my fingerprints, they are worthless without the phone/ computer which has the Secure Enclave I've matched them to. If my phone is stolen, I can invalidate the entire device as a method of authentication.
coder543 6y ago
You don't seem to be aware of what is under discussion here. You just raised a huge strawman. Websites are not receiving your biometrics in this context, and your biometrics would be meaningless to the website if captured and somehow provided. Your biometric signature is stored solely inside the Secure Enclave in the Apple device. If and only if the Secure Enclave recognizes you via your biometrics will the Enclave uses a non-transferrable key stored only in the Enclave to attest to the website that you are the user "JoeAltmaier". - The key is secret. - The key is kept in only one place. - The key can easily be discarded and a new one made. - The key is never given to anything outside of the Enclave, so... I'm not sure how it could be traced to you, besides the whole fact that it is being used to authenticate you, which is necessary. Sounds pretty acceptable to me as a password. The usability issue here is that a website needs to be able to accept a different password from each device you own, since the password is non-transferrable, and you might accidentally drop your iPhone to the bottom of the ocean. Good news: FIDO2 is an entire standard built around this concept, originally intended for use on YubiKeys and similar FIDO2-compliant USB sticks. Apple is building an implementation of FIDO2 that uses the iPhone that's already in the person's hand. If the Secure Enclave is compromised (which does happen sometimes), then Bad Things could happen... but that's also what happens when a password manager tool is compromised.
- JoeAltmaier 6y ago
  That's sophistry. The fact is, the laptop is 'secured' by biometrics, which can be spoofed. Having a key-to-the-key is not safe if the biometrics are not safe.
  - coder543 6y ago
    It is not sophistry, and sophistry is not a word I've ever seen used in a genuine conversation, so I immediately doubt your sincerity in this conversation. If someone wants to fake biometrics on an iPhone, they have a very limited window of time to do so, and the user can lock out the biometrics in less than 3 seconds just by "squeezing" the phone. (power button + either volume key, 2 seconds later the biometrics are locked out.) It's much harder to fake the biometrics in that very brief window of time (maximum 48 hours) than it is to shoulder surf a password. Unless your threat model includes State Level Actors, biometric bypass is a very remote concern. If your threat model includes State Level Actors, you're probably screwed either way, since they can easily afford to shoulder surf you. For everyone else, the main concern is that someone not physically present will manage to acquire your password and log into your services. Passwords suck at this threat model. FIDO2 makes this scenario impossible without that remote person managing to execute a Secure Enclave 0day on your personal device... and even then, it's still way harder than acquiring your password. Not even the website you're authenticating against receives your FIDO2 key... websites always receive your password, which is awful for security. Some related info here: https://news.ycombinator.com/item?id=24830642 https://news.ycombinator.com/item?id=24830642
deleted 6y ago
[deleted]
Spivak 6y ago
You're missing the point of biometrics. Something you are is a form of authentication that only you can use. Your face, fingerprints, blood, retinas are all public but try as you might you can't make another living human with the same features. If your view of fingerprint auth is "a picture of your face is the password" then of course it sounds stupid. It's actually "a face with the correct features attached to an alive human" which is much harder to fake. The whole point of biometric auth and all the advancements in the industry are about correctly identifying alive humans and the strength of any system that uses biometrics is directly related to that. You can say current systems aren't good enough at this yet for your personal thread models but it's real security, and beats the hell out of a 4/5 digit lock screen passcode.
- JoeAltmaier 6y ago
  That's trivially refutable. Fingerprints are left everywhere, and can be lifted and reproduced with common household substances (tape, glue etc). A face can be photographed, printed and presented trivially. And so far, biometrics falls far short of a 4/5 digit lock passcode. The entropy in most fingerprint sensors is a few bits. They are famously defeatable. Nothing will change the fact that you cannot keep your face and fingerprints secret, cannot/won't change them, and they are always, always traceable to you. Using them to secure a 'better' key is not security at all.
  - Spivak 6y ago
    It doesn't matter since your fingerprint isn't secret. It's not enough to have a picture of my fingerprint, you have to produce a convincing enough fake of a real human with the right fingerprint. Take this to meatspace for a second. If you had a security guard sitting at a desk inspecting your hands and taking fingerprints you couldn't trick them with pictures. You can't hold up a picture of my face to a guard and expect that they'll suddenly think you're me. Biometric auth systems are trying to the same thing but without the human. > They are famously defeatable. And most locks in wide-use today are also defeatable by amateur locksmiths, that's not really the point. There are sophisticated biometric auth systems that aren't fooled by pictures. FaceID is one example.
roughly 6y ago
Biometrics fail every test for a password, but, assuming sufficient accuracy, work pretty well for Authentication, which is the actual purpose of a password. Biometrics are closer to a public key than a password.