4 ms·

When the biometrics on the client client send the credential for the server for authentication, it's going to be serialized somehow. This is the part I'm worri

When the biometrics on the client client send the credential for the server for authentication, it's going to be serialized somehow. This is the part I'm worried about. I'm not so worried about someone lifting my print off a wine glass. Somehow a print (or iris or face or whatever) is encoded into bits and bytes. And that's going to be handled by every service I want to authenticate with? I don't trust them. Passwords leak all the time from leaky databases. Why wouldn't my fingerprints? The only difference is... I can't change my prints.

fragmede 5y ago
Which is a really big deal! I don't buy into Apple's flashy marketing crap, but TouchID got a few things right. Things that are easy to get wrong. Specifically, if an attacker steals my phone, getting my fingerprint out of the touchID chip is (supposed to be) nigh impossible, but no matter how possible that is/isn't, the point is that an attacker can't snoop the wires between the touchID chip and the phone's CPU, and then replay that conversation. There's a ton of ways to implement it wrongly. That the iPhone did it well isn't a reason that it would be okay to YOLO post picture of your fingerprints on Twitter.
munchbunny 5y ago
They don't necessarily serialize and send your biometrics over the internet. FIDO biometric implementations, for example, use it to unlock an on-device private key, which is then used to sign a challenge for the server to authenticate. No secrets, biometrics included, leave the device.
- recursive 5y ago
  So how would I be able to use a new device to authenticate using an existing account. How would I be able to do that if the original device was cast into the fires of Mount Doom? IMO biometric auth will never completely displace passwords unless it can beat the user experience of a password manager. But, as it may be obvious, I really don't understand how the biometric stuff works.
  - PeterisP 5y ago
    The simple answer is that generally you don't, you first authenticate in some other way and then add biometrics (stored on the device) as an alternate means of authentication. It displaces other methods as the day-to-day commonly used authentication, but not completely.

fragmede 5y ago

Which is a really big deal! I don't buy into Apple's flashy marketing crap, but TouchID got a few things right. Things that are easy to get wrong. Specifically, if an attacker steals my phone, getting my fingerprint out of the touchID chip is (supposed to be) nigh impossible, but no matter how possible that is/isn't, the point is that an attacker can't snoop the wires between the touchID chip and the phone's CPU, and then replay that conversation. There's a ton of ways to implement it wrongly. That the iPhone did it well isn't a reason that it would be okay to YOLO post picture of your fingerprints on Twitter.

munchbunny 5y ago

They don't necessarily serialize and send your biometrics over the internet. FIDO biometric implementations, for example, use it to unlock an on-device private key, which is then used to sign a challenge for the server to authenticate. No secrets, biometrics included, leave the device.

recursive 5y ago
So how would I be able to use a new device to authenticate using an existing account. How would I be able to do that if the original device was cast into the fires of Mount Doom? IMO biometric auth will never completely displace passwords unless it can beat the user experience of a password manager. But, as it may be obvious, I really don't understand how the biometric stuff works.
- PeterisP 5y ago
  The simple answer is that generally you don't, you first authenticate in some other way and then add biometrics (stored on the device) as an alternate means of authentication. It displaces other methods as the day-to-day commonly used authentication, but not completely.