7 ms·

You can change a password but you can't change your fingerprint / palm / etc. Am I missing something? How is Face / Touch ID more secure that user + pass? What

by Zaheer 6y ago

You can change a password but you can't change your fingerprint / palm / etc. Am I missing something? How is Face / Touch ID more secure that user + pass? What happens when biometric data is leaked?

atty 6y ago
As far as Apple devices are concerned, biometric data never leaves the Secure Enclave, so risk of data leak is non-zero, but sufficiently low for everyday life. Compare that to the massive number of people who use password123 as their password for every account across the web, and yes, biometrics are far more secure. :) More secure than a random 30 character string? Probably not. And if you’re targeted by individuals who are sufficiently motivated to steal your biometrics and the physical device, then neither the password nor the biometrics will be enough to protect you.
wmf 6y ago
Biometric data is never leaked because it never leaves the secure enclave in the device.
- henryfjordan 6y ago
  Your face can easily be mimicked. Biometric data is not stored in the phone, it is stored in you. See: https://www.macrumors.com/2018/12/16/3d-printed-head-android-face-id/ https://www.macrumors.com/2018/12/16/3d-printed-head-android...
  - kryptozinc 6y ago
    > The final model took a few days to generate at the cost of just over £300. "easily"
    - 10000truths 6y ago
      £300 is chump change in most any organization's budget.
      - acdha 6y ago
        This is why real security starts with a threat model. If you are worried that someone will kidnap you, take you to a 3-D imaging system, hit you with an amnesiac so you forget that happened, build a mask realistic enough to unlock your iPhone – which that article noted could NOT be done for £300 — and then use that to unlock your devices you have to start by asking why they wouldn’t simply unlock the device when they had enough control over you to run an invasive scan. That’s a movie-plot threat, not something anyone reading this needs to worry about and if they did they should be investing in bodyguards. Similarly, in the real world you have to make trade-offs. In this case, the alternative is using a password. Those are not only much, much easier to observe with a camera but also open rich new areas for an attacker to try: passwords are generated by normal people so they’re often weak, notoriously reused across multiple sites, and people are convinced by phishers to enter their passwords on the wrong site. Trying to protect against the Hollywood threats makes you more vulnerable to the kinds of things which befall many people on a daily basis.
  - Anechoic 6y ago
    Your face can easily be mimicked. Article: "I was ushered into a dome-like studio containing 50 cameras [...] The final model took a few days to generate at the cost of just over £300." I don't how that can be characterized as "easily." Possible, yes, but not easy. And it still didn't fool FaceID.
    - shakna 6y ago
      Maybe not easily in 2017, though there were other successful attempts to fool FaceID at the time [1], there are also successful and easier attempts to fool FaceID today [0] that can successfully bypass it. [0] https://www.technologyreview.com/2020/02/29/905599/how-coronavirus-turned-the-dystopian-joke-of-faceid-masks-into-a-reality/ https://www.technologyreview.com/2020/02/29/905599/how-coron... [1] https://www.forbes.com/sites/daveywinder/2019/08/10/apples-iphone-faceid-hacked-in-less-than-120-seconds/ https://www.forbes.com/sites/daveywinder/2019/08/10/apples-i...
      - minikites 6y ago
        Torture can extract an alphanumeric password.
        userbinator 6y ago
        But is it the right password, or the duress one?
  - syspec 6y ago
    This thread is about Apple. From the link: > 3D Printed Head Fools Android Face Recognition, iPhone X 'Impenetrable'
    - Dahoon 6y ago
      Saying "Android face recognition" is like saying "car security". Just because Ford and Jeep are easy to break into doesn't mean it's easy to break into BMW's and Audi's just because they happen to also be cars.
- swebs 6y ago
  Biometric data is leaked whenever you touch a doorknob.
  - zeepzeep 6y ago
    This. Biometrics are perfect for tracking but sh*t for security!
saagarjha 6y ago
> What happens when biometric data is leaked? Like when someone takes your picture? Nothing.
notatoad 6y ago
you're right that using biometric data for authentication is bad, but that's not what's happening here. faceid/touchid stores a private key on your device, and uses your biometrics to unlock that private key. it's the same idea as using a yubikey or something where you have to press the button on the 2fa dongle to prove it's physically in your posession and unlock the private key stored within it, but it goes beyond just pressing a button by doing some biometric identification. the concern isn't what if the biometric data is leaked, because the biometrics are only used to allow local access to your phone. the concern is what if the private keys stored in your phone are leaked. and the secure enclave makes that as close to impossible as any other existing solution.
- mrwnmonm 6y ago
  I know very little about security. Could you please explain it in simpler way? So, does my iPhone create a private key (which my Face ID data) on the phone itself, then the browser ask the phone to do something to authenticate the user? I am lost here.
  - Polylactic_acid 6y ago
    Your phone holds the passwords for the websites but they passwords never get presented to the user. FaceID is just used to unlock the password store. You would have to steal a phone and trick faceid on the phone to gain access to someones account.
    - mrwnmonm 6y ago
      Sorry, I still don't see the improvement here, doesn't that already happen using chrome for example, or Touch ID with 1password? (I think IOS has that too)
      - Rafert 6y ago
        That's correct, but 1Password stores a static secret (the password) and this may be re-used by less security-minded folks as you probably know. WebAuthn servers only store a public key which is useless in case the server gets compromised. WebAuthn also is phsihing proof by having browsers verify the domain the credentials are used for. See more at https://webauthn.guide/ https://webauthn.guide/
kalleboo 6y ago
> How is Face / Touch ID more secure that user + pass Because the password that the average user is using is shared among 100 sites and has been leaked 10 times over, and meanwhile there is nobody dusting their leftover coke can for prints.
zeepzeep 6y ago
It's not.

by Zaheer 6y ago

You can change a password but you can't change your fingerprint / palm / etc. Am I missing something? How is Face / Touch ID more secure that user + pass? What happens when biometric data is leaked?

atty 6y ago

As far as Apple devices are concerned, biometric data never leaves the Secure Enclave, so risk of data leak is non-zero, but sufficiently low for everyday life. Compare that to the massive number of people who use password123 as their password for every account across the web, and yes, biometrics are far more secure. :) More secure than a random 30 character string? Probably not. And if you’re targeted by individuals who are sufficiently motivated to steal your biometrics and the physical device, then neither the password nor the biometrics will be enough to protect you.

wmf 6y ago

Biometric data is never leaked because it never leaves the secure enclave in the device.

henryfjordan 6y ago
Your face can easily be mimicked. Biometric data is not stored in the phone, it is stored in you. See: https://www.macrumors.com/2018/12/16/3d-printed-head-android-face-id/ https://www.macrumors.com/2018/12/16/3d-printed-head-android...
- kryptozinc 6y ago
  > The final model took a few days to generate at the cost of just over £300. "easily"
  - 10000truths 6y ago
    £300 is chump change in most any organization's budget.
    - acdha 6y ago
      This is why real security starts with a threat model. If you are worried that someone will kidnap you, take you to a 3-D imaging system, hit you with an amnesiac so you forget that happened, build a mask realistic enough to unlock your iPhone – which that article noted could NOT be done for £300 — and then use that to unlock your devices you have to start by asking why they wouldn’t simply unlock the device when they had enough control over you to run an invasive scan. That’s a movie-plot threat, not something anyone reading this needs to worry about and if they did they should be investing in bodyguards. Similarly, in the real world you have to make trade-offs. In this case, the alternative is using a password. Those are not only much, much easier to observe with a camera but also open rich new areas for an attacker to try: passwords are generated by normal people so they’re often weak, notoriously reused across multiple sites, and people are convinced by phishers to enter their passwords on the wrong site. Trying to protect against the Hollywood threats makes you more vulnerable to the kinds of things which befall many people on a daily basis.
- Anechoic 6y ago
  Your face can easily be mimicked. Article: "I was ushered into a dome-like studio containing 50 cameras [...] The final model took a few days to generate at the cost of just over £300." I don't how that can be characterized as "easily." Possible, yes, but not easy. And it still didn't fool FaceID.
  - shakna 6y ago
    Maybe not easily in 2017, though there were other successful attempts to fool FaceID at the time [1], there are also successful and easier attempts to fool FaceID today [0] that can successfully bypass it. [0] https://www.technologyreview.com/2020/02/29/905599/how-coronavirus-turned-the-dystopian-joke-of-faceid-masks-into-a-reality/ https://www.technologyreview.com/2020/02/29/905599/how-coron... [1] https://www.forbes.com/sites/daveywinder/2019/08/10/apples-iphone-faceid-hacked-in-less-than-120-seconds/ https://www.forbes.com/sites/daveywinder/2019/08/10/apples-i...
    - minikites 6y ago
      Torture can extract an alphanumeric password.
      - userbinator 6y ago
        But is it the right password, or the duress one?
- syspec 6y ago
  This thread is about Apple. From the link: > 3D Printed Head Fools Android Face Recognition, iPhone X 'Impenetrable'
  - Dahoon 6y ago
    Saying "Android face recognition" is like saying "car security". Just because Ford and Jeep are easy to break into doesn't mean it's easy to break into BMW's and Audi's just because they happen to also be cars.
swebs 6y ago
Biometric data is leaked whenever you touch a doorknob.
- zeepzeep 6y ago
  This. Biometrics are perfect for tracking but sh*t for security!

saagarjha 6y ago

> What happens when biometric data is leaked? Like when someone takes your picture? Nothing.

notatoad 6y ago

you're right that using biometric data for authentication is bad, but that's not what's happening here. faceid/touchid stores a private key on your device, and uses your biometrics to unlock that private key. it's the same idea as using a yubikey or something where you have to press the button on the 2fa dongle to prove it's physically in your posession and unlock the private key stored within it, but it goes beyond just pressing a button by doing some biometric identification. the concern isn't what if the biometric data is leaked, because the biometrics are only used to allow local access to your phone. the concern is what if the private keys stored in your phone are leaked. and the secure enclave makes that as close to impossible as any other existing solution.

mrwnmonm 6y ago
I know very little about security. Could you please explain it in simpler way? So, does my iPhone create a private key (which my Face ID data) on the phone itself, then the browser ask the phone to do something to authenticate the user? I am lost here.
- Polylactic_acid 6y ago
  Your phone holds the passwords for the websites but they passwords never get presented to the user. FaceID is just used to unlock the password store. You would have to steal a phone and trick faceid on the phone to gain access to someones account.
  - mrwnmonm 6y ago
    Sorry, I still don't see the improvement here, doesn't that already happen using chrome for example, or Touch ID with 1password? (I think IOS has that too)
    - Rafert 6y ago
      That's correct, but 1Password stores a static secret (the password) and this may be re-used by less security-minded folks as you probably know. WebAuthn servers only store a public key which is useless in case the server gets compromised. WebAuthn also is phsihing proof by having browsers verify the domain the credentials are used for. See more at https://webauthn.guide/ https://webauthn.guide/

kalleboo 6y ago

> How is Face / Touch ID more secure that user + pass Because the password that the average user is using is shared among 100 sites and has been leaked 10 times over, and meanwhile there is nobody dusting their leftover coke can for prints.

zeepzeep 6y ago

It's not.