10 ms·

You don't need to burn off your fingertips (and other biometric myths)

106 points by Corrado 5y ago

wolverine876 5y ago
The arguments are built on hyperbole. People who are concerned are compared with people burning off their fingerprints and anti-vaxxers. For passwords, it's possible for "any kid anywhere in the world with an internet connection to grab troves of them with ease."
- raman162 5y ago
  The approach is undeniably dramatic but the primary purpose is to highlight that using biometrics for passwords is beneficial for most people and shouldn't be dismissed. I personally used a pin code on my second phone because I was fearful of the biometrics chatter but this article convinced me that using the fingerprint scanner is safer in most scenarios than otherwise.
  - fragmede 5y ago
    The core of Troy Hunt's argument about the legal difference of biometrics vs a password seems to be that the cops are "going to shoot you (too) and take your phone". Which is dramatic but doesn't really address the issue. Yeah fine sure, if you're a criminal drug dealer and Denzel Washington's crooked narcotics cop character from Training Day rolls up on you and wants your phone, you're either going to give up the phone or you're going to die. Back in the real world, we saw civil unrest (of varying types) in the past 12 months, but the rule of law is still there. See how the case against Backpage for sex trafficking is being re-run.
    - bryanrasmussen 5y ago
      >Back in the real world, we saw civil unrest (of varying types) in the past 12 months, a lot of that civil unrest because cops rolled up on people and killed them?
ceejayoz 5y ago
The slides showing passcode adoption going from about half to 90% with Touch ID's addition are fascinating, and an aspect I hadn't considered. Anyone know if the research there is publicly available?
- eli 5y ago
  Didn’t they also introduce other software changes? Can you buy apps from the store without a code set?
  - ceejayoz 5y ago
    That's why I'm wondering if there's underlying research or just puffery.
Johnny555 5y ago
I've lost count of the number of times I've heard someone say, "don't use biometrics because you can't change your fingerprints". That's an absurd statement... because you can. There are acids, blowtorches, belt sanders and the good old boxcutter, to name but a few approaches None of those will change your fingerprints, they'll grow back unless you took off so much skin that your fingers are scarred and the prints won't grow back. Which doesn't really help with the supposed problem that if someone steals your fingerprints, you can't easily change them to another pattern. My kids, for one. They're sneaky little buggers and I could envisage them observing my password as I type it into my PC. I can't, however, see them having the sophistication to lift a clean print off a glass, melt down a bunch of gummy bears and create a prosthetic that could fool the fingerprint reader on my PC. I think it won't be too long until they can dust your fingerprints, take a picture of it, then have it 3d printed on a substrate that will fool a simple fingerprint scanner.
- raman162 5y ago
  It's definitely a lot easier for anyone to create a fingerprint with today's technology and will get easier as time passes. I still think the author's main point stands, it's way easier for them to remember a pin that they observed and unlock your phone when you're not around versus the recreation of a "perfect" fingerprint
  - ziml77 5y ago
    This is why I hate if my phone decides I need to use my PIN to unlock it while I'm out. It's too easy to watch the PIN being entered. No one even has to be looking over my shoulder, it could be captured by a security camera.
- kjs3 5y ago
  See: "fingerprint fuming". The tech has been around for decades, and doesn't require a 3d printer.
- paranoidrobot 5y ago
  > I think it won't be too long until they can dust your fingerprints, take a picture of it, then have it 3d printed on a substrate that will fool a simple fingerprint scanner. I'm struggling to find good references right at this moment - but I've seen reports/video of this being done using more basic means, years ago. But I may be misremembering details. It seems that it's already possible to produce usable fingerprints using a laser printer, printable transparencies (i.e for overhead projectors), and some glue. The idea is that you print the inverted fingerprint on a transparency. Because the transparency doesn't allow the toner to absorb in, it remains on the surface as a 3D structure. You then apply glue to that structure, and wait for it to cure. After it cures it can be removed and trimmed to fit your finger, and then applied to your finger. This apparently is reliable enough to fool basic fingerprint scanners, even ones with 'liveness' checks for conductivity/pulse because the glue is conductive and transparent enough for those basic checks. Examples of similar things: https://blog.lookout.com/why-i-hacked-apples-touchid-and-still-think-it-is-awesome https://blog.lookout.com/why-i-hacked-apples-touchid-and-sti... https://www.instructables.com/How-To-Fool-a-Fingerprint-Security-System-As-Easy-/ https://www.instructables.com/How-To-Fool-a-Fingerprint-Secu...
sailfast 5y ago
This article thinks you need to be physically present to steal a fingerprint when OPM stores them on hard drives by the millions that have already been hacked? I’m confused about the conclusions. “It’s okay - you’re not worth hacking enough to worry about weaknesses in biometric security” seems like a better title for the assertions made here.
- deleted 5y ago
  [deleted]
recursive 5y ago
When the biometrics on the client client send the credential for the server for authentication, it's going to be serialized somehow. This is the part I'm worried about. I'm not so worried about someone lifting my print off a wine glass. Somehow a print (or iris or face or whatever) is encoded into bits and bytes. And that's going to be handled by every service I want to authenticate with? I don't trust them. Passwords leak all the time from leaky databases. Why wouldn't my fingerprints? The only difference is... I can't change my prints.
- fragmede 5y ago
  Which is a really big deal! I don't buy into Apple's flashy marketing crap, but TouchID got a few things right. Things that are easy to get wrong. Specifically, if an attacker steals my phone, getting my fingerprint out of the touchID chip is (supposed to be) nigh impossible, but no matter how possible that is/isn't, the point is that an attacker can't snoop the wires between the touchID chip and the phone's CPU, and then replay that conversation. There's a ton of ways to implement it wrongly. That the iPhone did it well isn't a reason that it would be okay to YOLO post picture of your fingerprints on Twitter.
- munchbunny 5y ago
  They don't necessarily serialize and send your biometrics over the internet. FIDO biometric implementations, for example, use it to unlock an on-device private key, which is then used to sign a challenge for the server to authenticate. No secrets, biometrics included, leave the device.
  - recursive 5y ago
    So how would I be able to use a new device to authenticate using an existing account. How would I be able to do that if the original device was cast into the fires of Mount Doom? IMO biometric auth will never completely displace passwords unless it can beat the user experience of a password manager. But, as it may be obvious, I really don't understand how the biometric stuff works.
    - 5y ago
aaron695 5y ago
Chinese Woman Surgically Switches Fingerprints To Evade Japanese Immigration Officers https://www.popsci.com/technology/article/2009-12/chinese-woman-surgically-switches-fingerprints-evade-japanese-immigation-officers/ https://www.popsci.com/technology/article/2009-12/chinese-wo... > "Use biometrics. It incentivises people to secure more things, it's resilient to all sorts of risks passwords are not and as an added bonus, it makes your digital life a whole lot easier" The articles conclusion sums up IT well, people being clever talking about the problems with biometrics are the problem.
pope_meat 5y ago
Security is an illusion we must maintain for our mental health.
- ironmagma 5y ago
  Not really. Security is built around likelihoods, and most attacks are really not likely, so it’s just a question of which attacks are likely and mitigating them.
bb88 5y ago
> We've all since watched enough crime shows to understand that fingerprints are unique personal biometric attributes and to date, no two people have ever been found to have a matching set. Maybe that's true or not, but that's never been conclusive. What has happened was that after the 3/11 attacks in Madrid , an American was suspected because his fingerprint was misidentified, partially because of this reasoning. http://www.latent-prints.com/images/Final%20OIG%20Executive%20Summarylow.pdf http://www.latent-prints.com/images/Final%20OIG%20Executive%...
quantified 5y ago
The difference between biometric and password is extremely simple. A password requires your action to provide. A biometric can be taken from you without much force. I may need to torture you or hold you in a cell to get a password, but I can just put the phone to your finger or hold it to your face to get a biometric. (Who can forget Demolition Man?) So the dynamic with the threat actor is very different. [https://www.universalhub.com/2021/facing-facts-police-say-thieves-downtown-using https://www.universalhub.com/2021/facing-facts-police-say-th...] Did I skip over this difference being discussed in the article?
- nimbius 5y ago
  Don't forget: biometrics are NOT protected by the 5th amendment.
  - dcow 5y ago
    Do you need a warrant to obtain biometrics from somebody?
    - bbarnett 5y ago
      2065. They just grow your finger and an eye in a lab, and use those to unlock your device.
      - juloo 5y ago
        2020. They just make a virtual 3D model of you from all the data they collected and stream it directly to the device. 2022. They can now engrave fingertips on paper.
    - VenTatsu 5y ago
      That is complicated, but also not related to the 5th amendment. Warrants are a part of 4th amendment rights. The 4th amendment is intended to ensure (among other things) that the government can't search some locations for evidence without first proving they have a good cause for that search. The 5th amendment is intended to ensure (among other things) that the government can't use force or threats to make you admit to a crime, regardless of if you committed or didn't commit that crime. The distinction is that a court could grant the right to force someone to put their thumb on a phone, or look at a phone's camera, but they (in some but not all cases) cannot force you to type in your passcode. The argument is that your fingerprint or face is not "testimony" but a fact of who you are, but your passcode is a testimony, a declaration that you have some specific knowledge. A phone unlocking is equivalent to it saying "Yes that is my owner/user", and that is not that person testifying, it is the device testifying against that person. Similarly it would be as if someone kept a picture of them committing a crime that was found with a valid warrant, they could not claim that having taken the picture it is their own testimony and can't be used against them. Taking the picture is a past event and requires no compelling of testimony to be used as evidence. Getting biometrics without a warrant is a contentious issue. There are situations where a warrant is not needed, and these have also been abused to gather biometrics in situations that should have required a warrant but it was denied.
jrm4 5y ago
I dismissed this guy a long time ago as a Microsoft (or more precisely, mediocre and big-company biased) shill -- then I read a few of his articles and gained a bit of respect for him. And then I read this and I'm back to square one. Forest/trees man. He just sounds like he's trying too hard to hand-wave away serious flaws in biometrics by trying to reassure us "well, it's not likely to happen to you personally, so you shouldn't worry about it," which is always always the worst, and perhaps most dangerous privacy argument ever given -- because of its unreasonable effectiveness against the "common man." Done with this guy, I am.
- arglebarglegar 5y ago
  the whole argument is “biometrics are harder than you think to fake, better than nothing, and in a scenario where you’re being physically assaulted a password isn’t much safer” what’s the issue? he’s not advocating for you to stop using a strong password if you already are, he’s saying people who use nothing should be encouraged to use something… perfect is the enemy of good
  - piaste 5y ago
    > he’s not advocating for you to stop using a strong password if you already are Did you read the article? He is exactly saying that acquiring your password (however strong) is in most circumstances much easier than acquiring your fingerprints. He's not just saying that biometrics are better than nothing, because of course everybody agrees with that - no privacy/security activist ever said 'the police could compel you to unlock your phone with a finger, therefore you should keep your phone unlocked'!
    - jrm4 5y ago
      Correct. I'm not saying he's wrong, I'm saying he's irresponsible. I absolutely want any so-called security expert to always also include the big picture or shut up forever. There's too much confusion and too at stake for people as big as him to isolate personal security from big picture privacy.
bigiain 5y ago
I think my favourite Usenix paper is appropriate here: "Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT." -- https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf Good passwords and biometrics help if your adversary is not-Mossad. Anybody who thinks biometrics or encryption or anything short of "Magical amulets? Fake your own death, move into a submarine?" is going to protect them again a nation state level adversary is kidding themselves.
- smnrchrds 5y ago
  Whether passwords are considered testimony or not is not quite settled in US and Canada yet. There are instances where the court has determined that the accused can be forced to put their finger on the fingerprint reader of their device, but cannot be forced to give up their password. Although there are cases where the password was forced to be given up as well. Until this is resolved one way or another, passwords remain potentially safer than biometrics.
  - Aulig 5y ago
    It's similar in Germany. Police may just take your finger and put it on the sensor. But you can't be forced to give out your password.
    - fastball 5y ago
      FaceID might be useful here? Won't work if your eyes are closed.
      - Thlom 5y ago
        I think you can disable that by disabling "require attention". If "require attention" is enabled FaceID won't work unless you are looking at your phone. I believe it is enabled by default. But pro-tip if you are being apprehended by police is to furiously click on the side button as the phone will require pin code after that.
alpb 5y ago
It's worth noting are some countries out there collecting innocent citizens' fingerprints at the time of common operations such as obtaining a drivers' license (presumably to match them later early on). Does a citizen even have any protection against these practices, perhaps with hard to notice prosthetics?
- vbezhenar 5y ago
  You can use non-standard finger like little finger. This way they'll probably waste attempts on common fingers (like thumbs).
brendangregg 5y ago
For anyone thinking of using fingerprints: There's a number of people, especially some older women (due to a lifetime of hand washing dishes) and chemotherapy survivors, who no longer have legible fingerprints. Insisting all users authenticate with legible fingerprints becomes discriminatory. I'm not saying fingerprints are bad, just that there must be a process to support those that do not have them.
- deirdres 5y ago
  Basically anyone who washes their hands frequently (ie all medical personnel, food handlers, etc.) or does manual work with ungloved hands (including home gardening) can later in life have fingerprints so abraded as to be unidentifiable. Using a lot of hand lotion, as anyone with dry hands might, also tends to flatten the ridges. Any requirement for fingerprints as a biometric can render systems inaccessible for entire classes of people - it's a growing problem in banking for the elderly, for example.
  - bryanrasmussen 5y ago
    >Using a lot of hand lotion, as anyone with dry hands might, also tends to flatten the ridges. so, several years of corona may in the future have the side effect of many more people without finger prints.
    - bbarnett 5y ago
      Yes, yes... corona. That's why all the lotion! It has nothing to do with looking at pron!
      - Freak_NL 5y ago
        Curiously, the association of hand lotion with male masturbation is strongly culturally dependant — or rather, it is seemingly exclusively a US thing apparently because of the (dwindling) prevalence of male circumcision without the orthodox religious framework that usually accompanies it (and which seems to either banish or hide this feature in those cultural settings). Cum-socks, curiously stiffened towels, copious supplies of paper towels, and sticky sheets: these are all familiar to parents of teenage boys worldwide, but the lotion thing? It's an established trope in films and series, which is why people outside of the US 'get it', but the actual practice seems as localized as eating a Vegemite sandwich.
dataflow 5y ago
Mostly off-topic, but what do you do when Android forces you to type your password again for "additional security" and you're in front of a bunch of people you can't practically hide your phone from? Do security-conscious folks disable it somehow (and if so, how)? It happens when you least expect it which makes it actually worse than just a plain password in that respect.
- p410n3 5y ago
  I turn off my phone when I go to sleep and turn it on in the morning. It requires me to enter the password then, while I'm still at home and never prompted me to enter it over the day again
bambax 5y ago
> And when you do unlock your biometric-enabled device, you can do so in front of people whom you wouldn't want to know your PIN. You can be on public transport, standing in a queue or even sitting down at your biometric-enabled PC with a friend and authenticate without disclosing an easily reusable secret. YES! Both Android and iOS insist we re-type our password at random times when using biometrics, and of course "random time" is always the worst possible time (in the subway, on a plane, etc.) I don't understand this. Why force me to type a password at the risk of divulging it? What's the point of this?
- vbezhenar 5y ago
  I think it's just timeout of few days. Point is that if your phone got stolen or taken away from you, attackers have a limited time to attempt a fingerprint attack, after which they must use more sophisticated pin bruteforce attack. Not sure if it adds much to security, but it's something.
- juloo 5y ago
  The actual reason is to make you practice your password so you don't forget. You might scratch your finger or the sensor might get dirty or break. Biometric in (current) phones is convenience, not security.
croes 5y ago
>So, what was required to obtain the print and how does it differ from obtaining a password? […] A knowledge of spy tradecraft, specialist equipment and perhaps most importantly, physical presence." Physical presence isn't needed, a photo is enough. https://www.dw.com/en/german-defense-minister-von-der-leyens-fingerprint-copied-by-chaos-computer-club/a-18154832 https://www.dw.com/en/german-defense-minister-von-der-leyens... And then try to argue it wasn't you who unlocked your phone and made the expensive purchase because someone stole your fingerprints.
IndySun 5y ago
Using biometrics is far riskier than passwords at short physical distances. Meaning, if you're in the room with your assailant (alive, sleeping, or dead) then your bio-password is in plain sight. In fact, only your head and/or fingers need be present.
- rocqua 5y ago
  The threat model for the vast majority of people does no include "the people in the room with me" with those same people being willing and able to defeat biometrics. The vast majority of people need to worry about ransomware operators and phishers. Biometrics are great for defending against those.
  - IndySun 5y ago
    The article ventured into Mossad territory, so I pointed out the absurdity of such a scenario. Distance or not, biometrics are part of a totalitarian future, and as such are to be avoided. The conversation about passwords will be moribund before you know it.
jillesvangurp 5y ago
Use a password manager and sufficiently high entropy passwords and you are fine for now. You can't brute force them and because you can't remember them, you won't be typing them manually or do any of the other things that make passwords a problem. Bio-metrics are convenient though. I use them with my password manager. For things where it matters, use multi factor authentication. Long term, multi will have to be more than 2. The more factors, the harder it is to break through. For example, I use a separate tool to store my 2FA secrets than my password manager (which can do this). That's almost (not quite) an extra factor. You might call it 2.5FA
ptx 5y ago
> I've lost count of the number of times I've heard someone say, "don't use biometrics because you can't change your fingerprints". That's an absurd statement... because you can. [...] Thing is though, [...] it really provides no benefit whatsoever to those who've had their biometric secrets revealed. Why call the statement "absurd" only to essentially agree with it by the end of the paragraph?
troyvit 5y ago
Man I'm not not worried so much about malicious state or corporate actors getting my biometrics. I'm worried about the incompetent ones (which is all of them). Those are the guys who collect biometric data, store it, and then lose it. Like my social once my face is out there I can't get it back. I know that nobody is going to make a copy of my beautiful face to get access to my iphone, but more about the future when biometrics are used to let us into -- for instance -- a cloud provider's platform[0]. At that point there's no physical device to bypass it's just a question of sending the right bits to a server. Then my biometrics are defeated and I won't be able to reset them. (edit: wrong link) [0] https://www.youtube.com/watch?v=YJg02ivYzSs https://www.youtube.com/watch?v=YJg02ivYzSs
seanw444 5y ago
This is a bit of a strawman, I'd say. I've never been concerned about someone utilizing MI-6 resources to construct a fake duplicate of my prints. I'm worried about someone using my hand while I'm unconscious, or by physically forcing me to do so.
JohnFen 5y ago
Someone stealing your fingerprints may be more difficult than stealing your password, but you can change your password. The essay mentions this as an absurd argument, but then completely fails to explain why it's an absurd argument. He does make a strong case for the use of biometric authentication with the group of people who aren't willing or able to spend any energy on security, but he didn't make the case for why people who are so willing and able should use it.

106 points by Corrado 5y ago

The arguments are built on hyperbole. People who are concerned are compared with people burning off their fingerprints and anti-vaxxers. For passwords, it's possible for "any kid anywhere in the world with an internet connection to grab troves of them with ease."

raman162 5y ago
The approach is undeniably dramatic but the primary purpose is to highlight that using biometrics for passwords is beneficial for most people and shouldn't be dismissed. I personally used a pin code on my second phone because I was fearful of the biometrics chatter but this article convinced me that using the fingerprint scanner is safer in most scenarios than otherwise.
- fragmede 5y ago
  The core of Troy Hunt's argument about the legal difference of biometrics vs a password seems to be that the cops are "going to shoot you (too) and take your phone". Which is dramatic but doesn't really address the issue. Yeah fine sure, if you're a criminal drug dealer and Denzel Washington's crooked narcotics cop character from Training Day rolls up on you and wants your phone, you're either going to give up the phone or you're going to die. Back in the real world, we saw civil unrest (of varying types) in the past 12 months, but the rule of law is still there. See how the case against Backpage for sex trafficking is being re-run.
  - bryanrasmussen 5y ago
    >Back in the real world, we saw civil unrest (of varying types) in the past 12 months, a lot of that civil unrest because cops rolled up on people and killed them?

ceejayoz 5y ago

The slides showing passcode adoption going from about half to 90% with Touch ID's addition are fascinating, and an aspect I hadn't considered. Anyone know if the research there is publicly available?

eli 5y ago
Didn’t they also introduce other software changes? Can you buy apps from the store without a code set?
- ceejayoz 5y ago
  That's why I'm wondering if there's underlying research or just puffery.

Johnny555 5y ago

I've lost count of the number of times I've heard someone say, "don't use biometrics because you can't change your fingerprints". That's an absurd statement... because you can. There are acids, blowtorches, belt sanders and the good old boxcutter, to name but a few approaches None of those will change your fingerprints, they'll grow back unless you took off so much skin that your fingers are scarred and the prints won't grow back. Which doesn't really help with the supposed problem that if someone steals your fingerprints, you can't easily change them to another pattern. My kids, for one. They're sneaky little buggers and I could envisage them observing my password as I type it into my PC. I can't, however, see them having the sophistication to lift a clean print off a glass, melt down a bunch of gummy bears and create a prosthetic that could fool the fingerprint reader on my PC. I think it won't be too long until they can dust your fingerprints, take a picture of it, then have it 3d printed on a substrate that will fool a simple fingerprint scanner.

raman162 5y ago
It's definitely a lot easier for anyone to create a fingerprint with today's technology and will get easier as time passes. I still think the author's main point stands, it's way easier for them to remember a pin that they observed and unlock your phone when you're not around versus the recreation of a "perfect" fingerprint
- ziml77 5y ago
  This is why I hate if my phone decides I need to use my PIN to unlock it while I'm out. It's too easy to watch the PIN being entered. No one even has to be looking over my shoulder, it could be captured by a security camera.
kjs3 5y ago
See: "fingerprint fuming". The tech has been around for decades, and doesn't require a 3d printer.
paranoidrobot 5y ago
> I think it won't be too long until they can dust your fingerprints, take a picture of it, then have it 3d printed on a substrate that will fool a simple fingerprint scanner. I'm struggling to find good references right at this moment - but I've seen reports/video of this being done using more basic means, years ago. But I may be misremembering details. It seems that it's already possible to produce usable fingerprints using a laser printer, printable transparencies (i.e for overhead projectors), and some glue. The idea is that you print the inverted fingerprint on a transparency. Because the transparency doesn't allow the toner to absorb in, it remains on the surface as a 3D structure. You then apply glue to that structure, and wait for it to cure. After it cures it can be removed and trimmed to fit your finger, and then applied to your finger. This apparently is reliable enough to fool basic fingerprint scanners, even ones with 'liveness' checks for conductivity/pulse because the glue is conductive and transparent enough for those basic checks. Examples of similar things: https://blog.lookout.com/why-i-hacked-apples-touchid-and-still-think-it-is-awesome https://blog.lookout.com/why-i-hacked-apples-touchid-and-sti... https://www.instructables.com/How-To-Fool-a-Fingerprint-Security-System-As-Easy-/ https://www.instructables.com/How-To-Fool-a-Fingerprint-Secu...

sailfast 5y ago

This article thinks you need to be physically present to steal a fingerprint when OPM stores them on hard drives by the millions that have already been hacked? I’m confused about the conclusions. “It’s okay - you’re not worth hacking enough to worry about weaknesses in biometric security” seems like a better title for the assertions made here.

deleted 5y ago
[deleted]

recursive 5y ago

When the biometrics on the client client send the credential for the server for authentication, it's going to be serialized somehow. This is the part I'm worried about. I'm not so worried about someone lifting my print off a wine glass. Somehow a print (or iris or face or whatever) is encoded into bits and bytes. And that's going to be handled by every service I want to authenticate with? I don't trust them. Passwords leak all the time from leaky databases. Why wouldn't my fingerprints? The only difference is... I can't change my prints.

fragmede 5y ago
Which is a really big deal! I don't buy into Apple's flashy marketing crap, but TouchID got a few things right. Things that are easy to get wrong. Specifically, if an attacker steals my phone, getting my fingerprint out of the touchID chip is (supposed to be) nigh impossible, but no matter how possible that is/isn't, the point is that an attacker can't snoop the wires between the touchID chip and the phone's CPU, and then replay that conversation. There's a ton of ways to implement it wrongly. That the iPhone did it well isn't a reason that it would be okay to YOLO post picture of your fingerprints on Twitter.
munchbunny 5y ago
They don't necessarily serialize and send your biometrics over the internet. FIDO biometric implementations, for example, use it to unlock an on-device private key, which is then used to sign a challenge for the server to authenticate. No secrets, biometrics included, leave the device.
- recursive 5y ago
  So how would I be able to use a new device to authenticate using an existing account. How would I be able to do that if the original device was cast into the fires of Mount Doom? IMO biometric auth will never completely displace passwords unless it can beat the user experience of a password manager. But, as it may be obvious, I really don't understand how the biometric stuff works.
  - 5y ago

aaron695 5y ago

Chinese Woman Surgically Switches Fingerprints To Evade Japanese Immigration Officers https://www.popsci.com/technology/article/2009-12/chinese-woman-surgically-switches-fingerprints-evade-japanese-immigation-officers/ https://www.popsci.com/technology/article/2009-12/chinese-wo... > "Use biometrics. It incentivises people to secure more things, it's resilient to all sorts of risks passwords are not and as an added bonus, it makes your digital life a whole lot easier" The articles conclusion sums up IT well, people being clever talking about the problems with biometrics are the problem.

pope_meat 5y ago

Security is an illusion we must maintain for our mental health.

ironmagma 5y ago
Not really. Security is built around likelihoods, and most attacks are really not likely, so it’s just a question of which attacks are likely and mitigating them.

bb88 5y ago

> We've all since watched enough crime shows to understand that fingerprints are unique personal biometric attributes and to date, no two people have ever been found to have a matching set. Maybe that's true or not, but that's never been conclusive. What has happened was that after the 3/11 attacks in Madrid , an American was suspected because his fingerprint was misidentified, partially because of this reasoning. http://www.latent-prints.com/images/Final%20OIG%20Executive%20Summarylow.pdf http://www.latent-prints.com/images/Final%20OIG%20Executive%...

quantified 5y ago

The difference between biometric and password is extremely simple. A password requires your action to provide. A biometric can be taken from you without much force. I may need to torture you or hold you in a cell to get a password, but I can just put the phone to your finger or hold it to your face to get a biometric. (Who can forget Demolition Man?) So the dynamic with the threat actor is very different. [https://www.universalhub.com/2021/facing-facts-police-say-thieves-downtown-using https://www.universalhub.com/2021/facing-facts-police-say-th...] Did I skip over this difference being discussed in the article?

nimbius 5y ago
Don't forget: biometrics are NOT protected by the 5th amendment.
- dcow 5y ago
  Do you need a warrant to obtain biometrics from somebody?
  - bbarnett 5y ago
    2065. They just grow your finger and an eye in a lab, and use those to unlock your device.
    - juloo 5y ago
      2020. They just make a virtual 3D model of you from all the data they collected and stream it directly to the device. 2022. They can now engrave fingertips on paper.
  - VenTatsu 5y ago
    That is complicated, but also not related to the 5th amendment. Warrants are a part of 4th amendment rights. The 4th amendment is intended to ensure (among other things) that the government can't search some locations for evidence without first proving they have a good cause for that search. The 5th amendment is intended to ensure (among other things) that the government can't use force or threats to make you admit to a crime, regardless of if you committed or didn't commit that crime. The distinction is that a court could grant the right to force someone to put their thumb on a phone, or look at a phone's camera, but they (in some but not all cases) cannot force you to type in your passcode. The argument is that your fingerprint or face is not "testimony" but a fact of who you are, but your passcode is a testimony, a declaration that you have some specific knowledge. A phone unlocking is equivalent to it saying "Yes that is my owner/user", and that is not that person testifying, it is the device testifying against that person. Similarly it would be as if someone kept a picture of them committing a crime that was found with a valid warrant, they could not claim that having taken the picture it is their own testimony and can't be used against them. Taking the picture is a past event and requires no compelling of testimony to be used as evidence. Getting biometrics without a warrant is a contentious issue. There are situations where a warrant is not needed, and these have also been abused to gather biometrics in situations that should have required a warrant but it was denied.

jrm4 5y ago

I dismissed this guy a long time ago as a Microsoft (or more precisely, mediocre and big-company biased) shill -- then I read a few of his articles and gained a bit of respect for him. And then I read this and I'm back to square one. Forest/trees man. He just sounds like he's trying too hard to hand-wave away serious flaws in biometrics by trying to reassure us "well, it's not likely to happen to you personally, so you shouldn't worry about it," which is always always the worst, and perhaps most dangerous privacy argument ever given -- because of its unreasonable effectiveness against the "common man." Done with this guy, I am.

arglebarglegar 5y ago
the whole argument is “biometrics are harder than you think to fake, better than nothing, and in a scenario where you’re being physically assaulted a password isn’t much safer” what’s the issue? he’s not advocating for you to stop using a strong password if you already are, he’s saying people who use nothing should be encouraged to use something… perfect is the enemy of good
- piaste 5y ago
  > he’s not advocating for you to stop using a strong password if you already are Did you read the article? He is exactly saying that acquiring your password (however strong) is in most circumstances much easier than acquiring your fingerprints. He's not just saying that biometrics are better than nothing, because of course everybody agrees with that - no privacy/security activist ever said 'the police could compel you to unlock your phone with a finger, therefore you should keep your phone unlocked'!
  - jrm4 5y ago
    Correct. I'm not saying he's wrong, I'm saying he's irresponsible. I absolutely want any so-called security expert to always also include the big picture or shut up forever. There's too much confusion and too at stake for people as big as him to isolate personal security from big picture privacy.

bigiain 5y ago

I think my favourite Usenix paper is appropriate here: "Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT." -- https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf Good passwords and biometrics help if your adversary is not-Mossad. Anybody who thinks biometrics or encryption or anything short of "Magical amulets? Fake your own death, move into a submarine?" is going to protect them again a nation state level adversary is kidding themselves.

smnrchrds 5y ago
Whether passwords are considered testimony or not is not quite settled in US and Canada yet. There are instances where the court has determined that the accused can be forced to put their finger on the fingerprint reader of their device, but cannot be forced to give up their password. Although there are cases where the password was forced to be given up as well. Until this is resolved one way or another, passwords remain potentially safer than biometrics.
- Aulig 5y ago
  It's similar in Germany. Police may just take your finger and put it on the sensor. But you can't be forced to give out your password.
  - fastball 5y ago
    FaceID might be useful here? Won't work if your eyes are closed.
    - Thlom 5y ago
      I think you can disable that by disabling "require attention". If "require attention" is enabled FaceID won't work unless you are looking at your phone. I believe it is enabled by default. But pro-tip if you are being apprehended by police is to furiously click on the side button as the phone will require pin code after that.

alpb 5y ago

It's worth noting are some countries out there collecting innocent citizens' fingerprints at the time of common operations such as obtaining a drivers' license (presumably to match them later early on). Does a citizen even have any protection against these practices, perhaps with hard to notice prosthetics?

vbezhenar 5y ago
You can use non-standard finger like little finger. This way they'll probably waste attempts on common fingers (like thumbs).

brendangregg 5y ago

For anyone thinking of using fingerprints: There's a number of people, especially some older women (due to a lifetime of hand washing dishes) and chemotherapy survivors, who no longer have legible fingerprints. Insisting all users authenticate with legible fingerprints becomes discriminatory. I'm not saying fingerprints are bad, just that there must be a process to support those that do not have them.

deirdres 5y ago
Basically anyone who washes their hands frequently (ie all medical personnel, food handlers, etc.) or does manual work with ungloved hands (including home gardening) can later in life have fingerprints so abraded as to be unidentifiable. Using a lot of hand lotion, as anyone with dry hands might, also tends to flatten the ridges. Any requirement for fingerprints as a biometric can render systems inaccessible for entire classes of people - it's a growing problem in banking for the elderly, for example.
- bryanrasmussen 5y ago
  >Using a lot of hand lotion, as anyone with dry hands might, also tends to flatten the ridges. so, several years of corona may in the future have the side effect of many more people without finger prints.
  - bbarnett 5y ago
    Yes, yes... corona. That's why all the lotion! It has nothing to do with looking at pron!
    - Freak_NL 5y ago
      Curiously, the association of hand lotion with male masturbation is strongly culturally dependant — or rather, it is seemingly exclusively a US thing apparently because of the (dwindling) prevalence of male circumcision without the orthodox religious framework that usually accompanies it (and which seems to either banish or hide this feature in those cultural settings). Cum-socks, curiously stiffened towels, copious supplies of paper towels, and sticky sheets: these are all familiar to parents of teenage boys worldwide, but the lotion thing? It's an established trope in films and series, which is why people outside of the US 'get it', but the actual practice seems as localized as eating a Vegemite sandwich.

dataflow 5y ago

Mostly off-topic, but what do you do when Android forces you to type your password again for "additional security" and you're in front of a bunch of people you can't practically hide your phone from? Do security-conscious folks disable it somehow (and if so, how)? It happens when you least expect it which makes it actually worse than just a plain password in that respect.

p410n3 5y ago
I turn off my phone when I go to sleep and turn it on in the morning. It requires me to enter the password then, while I'm still at home and never prompted me to enter it over the day again

bambax 5y ago

> And when you do unlock your biometric-enabled device, you can do so in front of people whom you wouldn't want to know your PIN. You can be on public transport, standing in a queue or even sitting down at your biometric-enabled PC with a friend and authenticate without disclosing an easily reusable secret. YES! Both Android and iOS insist we re-type our password at random times when using biometrics, and of course "random time" is always the worst possible time (in the subway, on a plane, etc.) I don't understand this. Why force me to type a password at the risk of divulging it? What's the point of this?

vbezhenar 5y ago
I think it's just timeout of few days. Point is that if your phone got stolen or taken away from you, attackers have a limited time to attempt a fingerprint attack, after which they must use more sophisticated pin bruteforce attack. Not sure if it adds much to security, but it's something.
juloo 5y ago
The actual reason is to make you practice your password so you don't forget. You might scratch your finger or the sensor might get dirty or break. Biometric in (current) phones is convenience, not security.

croes 5y ago

>So, what was required to obtain the print and how does it differ from obtaining a password? […] A knowledge of spy tradecraft, specialist equipment and perhaps most importantly, physical presence." Physical presence isn't needed, a photo is enough. https://www.dw.com/en/german-defense-minister-von-der-leyens-fingerprint-copied-by-chaos-computer-club/a-18154832 https://www.dw.com/en/german-defense-minister-von-der-leyens... And then try to argue it wasn't you who unlocked your phone and made the expensive purchase because someone stole your fingerprints.

IndySun 5y ago

Using biometrics is far riskier than passwords at short physical distances. Meaning, if you're in the room with your assailant (alive, sleeping, or dead) then your bio-password is in plain sight. In fact, only your head and/or fingers need be present.

rocqua 5y ago
The threat model for the vast majority of people does no include "the people in the room with me" with those same people being willing and able to defeat biometrics. The vast majority of people need to worry about ransomware operators and phishers. Biometrics are great for defending against those.
- IndySun 5y ago
  The article ventured into Mossad territory, so I pointed out the absurdity of such a scenario. Distance or not, biometrics are part of a totalitarian future, and as such are to be avoided. The conversation about passwords will be moribund before you know it.

jillesvangurp 5y ago

Use a password manager and sufficiently high entropy passwords and you are fine for now. You can't brute force them and because you can't remember them, you won't be typing them manually or do any of the other things that make passwords a problem. Bio-metrics are convenient though. I use them with my password manager. For things where it matters, use multi factor authentication. Long term, multi will have to be more than 2. The more factors, the harder it is to break through. For example, I use a separate tool to store my 2FA secrets than my password manager (which can do this). That's almost (not quite) an extra factor. You might call it 2.5FA

ptx 5y ago

> I've lost count of the number of times I've heard someone say, "don't use biometrics because you can't change your fingerprints". That's an absurd statement... because you can. [...] Thing is though, [...] it really provides no benefit whatsoever to those who've had their biometric secrets revealed. Why call the statement "absurd" only to essentially agree with it by the end of the paragraph?

troyvit 5y ago

Man I'm not not worried so much about malicious state or corporate actors getting my biometrics. I'm worried about the incompetent ones (which is all of them). Those are the guys who collect biometric data, store it, and then lose it. Like my social once my face is out there I can't get it back. I know that nobody is going to make a copy of my beautiful face to get access to my iphone, but more about the future when biometrics are used to let us into -- for instance -- a cloud provider's platform[0]. At that point there's no physical device to bypass it's just a question of sending the right bits to a server. Then my biometrics are defeated and I won't be able to reset them. (edit: wrong link) [0] https://www.youtube.com/watch?v=YJg02ivYzSs https://www.youtube.com/watch?v=YJg02ivYzSs

seanw444 5y ago

This is a bit of a strawman, I'd say. I've never been concerned about someone utilizing MI-6 resources to construct a fake duplicate of my prints. I'm worried about someone using my hand while I'm unconscious, or by physically forcing me to do so.

JohnFen 5y ago

Someone stealing your fingerprints may be more difficult than stealing your password, but you can change your password. The essay mentions this as an absurd argument, but then completely fails to explain why it's an absurd argument. He does make a strong case for the use of biometric authentication with the group of people who aren't willing or able to spend any energy on security, but he didn't make the case for why people who are so willing and able should use it.