6 ms·
If passwords are the original sin, then Face ID and Touch ID are Sodom and Gomorrah. Authentication is something you KNOW. Strong authentication is something y
by bjt2n3904 6y ago
If passwords are the original sin, then Face ID and Touch ID are Sodom and Gomorrah.
Authentication is something you KNOW. Strong authentication is something you KNOW, and something you HAVE.
Something you ARE is great for identification, but terrible for authentication. Something you are cannot be changed like a password.
- ericpauley 6y agoAt least, in the case of biometric authentication on device, the ability to use biometrics expires automatically when the device is turned off (and other times), so biometric credential theft has a limited window of vulnerability. This contrasts with many fixed biometric authentication systems that aren't used as often as a cell phone.
- bjt2n3904 6y agoMaybe... but if I steal your fingerprint, I have it forever. And the courts can't yet force you to reveal secrets from your mind. But you can be compelled to use your fingerprint to unlock things.
- laurent92 6y agoIn USA? I’m not even sure. In France there are many circumstances where you must reveal your phone password or any hard drive’s encryption key, if there is legit suspicion it has been used for general criminality (case in court with a cannabis dealer).
- ryukafalz 6y agoThe “something you have” is the key stored in the secure enclave/yubikey/whatever. That’s the real authenticator in this scenario. That it’s (maybe) unlocked biometrically is nice, but secondary.
- robinson-wall 6y agoIn this case Face/Touch ID represents something you have (the iOS device with a persisted credential in its secure enclave), and something you are (fingerprint/face).