4 ms·

The difference between biometric and password is extremely simple. A password requires your action to provide. A biometric can be taken from you without much fo

The difference between biometric and password is extremely simple. A password requires your action to provide. A biometric can be taken from you without much force. I may need to torture you or hold you in a cell to get a password, but I can just put the phone to your finger or hold it to your face to get a biometric. (Who can forget Demolition Man?) So the dynamic with the threat actor is very different. [https://www.universalhub.com/2021/facing-facts-police-say-thieves-downtown-using https://www.universalhub.com/2021/facing-facts-police-say-th...] Did I skip over this difference being discussed in the article?

nimbius 5y ago
Don't forget: biometrics are NOT protected by the 5th amendment.
- dcow 5y ago
  Do you need a warrant to obtain biometrics from somebody?
  - bbarnett 5y ago
    2065. They just grow your finger and an eye in a lab, and use those to unlock your device.
    - juloo 5y ago
      2020. They just make a virtual 3D model of you from all the data they collected and stream it directly to the device. 2022. They can now engrave fingertips on paper.
  - VenTatsu 5y ago
    That is complicated, but also not related to the 5th amendment. Warrants are a part of 4th amendment rights. The 4th amendment is intended to ensure (among other things) that the government can't search some locations for evidence without first proving they have a good cause for that search. The 5th amendment is intended to ensure (among other things) that the government can't use force or threats to make you admit to a crime, regardless of if you committed or didn't commit that crime. The distinction is that a court could grant the right to force someone to put their thumb on a phone, or look at a phone's camera, but they (in some but not all cases) cannot force you to type in your passcode. The argument is that your fingerprint or face is not "testimony" but a fact of who you are, but your passcode is a testimony, a declaration that you have some specific knowledge. A phone unlocking is equivalent to it saying "Yes that is my owner/user", and that is not that person testifying, it is the device testifying against that person. Similarly it would be as if someone kept a picture of them committing a crime that was found with a valid warrant, they could not claim that having taken the picture it is their own testimony and can't be used against them. Taking the picture is a past event and requires no compelling of testimony to be used as evidence. Getting biometrics without a warrant is a contentious issue. There are situations where a warrant is not needed, and these have also been abused to gather biometrics in situations that should have required a warrant but it was denied.
CharlesW 5y ago
> A password requires your action to provide. A biometric can be taken from you without much force. What about voice- or movement-based biometrics? (These are just the first counter-examples that came to mind.)
- snypher 5y ago
  Ah, 'my voice is my'! https://youtu.be/-zVgWpVXb64 https://youtu.be/-zVgWpVXb64
- quantified 5y ago
  I got my kid to hate Cortana by doing a weird voice that nonetheless was treated as theirs. “Hey Cortana” is still a joke in our house. Maybe. But to your point, those require doing, which is the difference. Regular use in mixed environments (airport terminal, office, waiting for the train, etc.) is TBD. As long as I have a password backup for the days I’m in bed sick.
jiveturkey 5y ago
> A password requires your action to provide. But it's easy to trick the user. Very easy. And because passwords tend to be difficult to use, users tend to pick easy ones, such that you don't need to trick the user at all. With bio, the user may opt to have the protection whereas with password they either may not, or it may be trivially bypassed. Bio systems can be engineered to be anti-phishing, anti-MITM, etc. Incredibly hard to do that with passwords. By claiming that the user has to do something to use a password ignores the vast, vast set of vulnerabilities involved. One is not really better than the other per se. It's very use case dependent and you optimize for a specific outcome based on the risks at hand. You won't perfectly get every possibility nailed.
shultays 5y ago
And you can't change your biometrics, at least not as easily. So it can be used as an identifier as well and also can be used to match you in between databases.

nimbius 5y ago

Don't forget: biometrics are NOT protected by the 5th amendment.

dcow 5y ago
Do you need a warrant to obtain biometrics from somebody?
- bbarnett 5y ago
  2065. They just grow your finger and an eye in a lab, and use those to unlock your device.
  - juloo 5y ago
    2020. They just make a virtual 3D model of you from all the data they collected and stream it directly to the device. 2022. They can now engrave fingertips on paper.
- VenTatsu 5y ago
  That is complicated, but also not related to the 5th amendment. Warrants are a part of 4th amendment rights. The 4th amendment is intended to ensure (among other things) that the government can't search some locations for evidence without first proving they have a good cause for that search. The 5th amendment is intended to ensure (among other things) that the government can't use force or threats to make you admit to a crime, regardless of if you committed or didn't commit that crime. The distinction is that a court could grant the right to force someone to put their thumb on a phone, or look at a phone's camera, but they (in some but not all cases) cannot force you to type in your passcode. The argument is that your fingerprint or face is not "testimony" but a fact of who you are, but your passcode is a testimony, a declaration that you have some specific knowledge. A phone unlocking is equivalent to it saying "Yes that is my owner/user", and that is not that person testifying, it is the device testifying against that person. Similarly it would be as if someone kept a picture of them committing a crime that was found with a valid warrant, they could not claim that having taken the picture it is their own testimony and can't be used against them. Taking the picture is a past event and requires no compelling of testimony to be used as evidence. Getting biometrics without a warrant is a contentious issue. There are situations where a warrant is not needed, and these have also been abused to gather biometrics in situations that should have required a warrant but it was denied.

CharlesW 5y ago

> A password requires your action to provide. A biometric can be taken from you without much force. What about voice- or movement-based biometrics? (These are just the first counter-examples that came to mind.)

snypher 5y ago
Ah, 'my voice is my'! https://youtu.be/-zVgWpVXb64 https://youtu.be/-zVgWpVXb64
quantified 5y ago
I got my kid to hate Cortana by doing a weird voice that nonetheless was treated as theirs. “Hey Cortana” is still a joke in our house. Maybe. But to your point, those require doing, which is the difference. Regular use in mixed environments (airport terminal, office, waiting for the train, etc.) is TBD. As long as I have a password backup for the days I’m in bed sick.

jiveturkey 5y ago

> A password requires your action to provide. But it's easy to trick the user. Very easy. And because passwords tend to be difficult to use, users tend to pick easy ones, such that you don't need to trick the user at all. With bio, the user may opt to have the protection whereas with password they either may not, or it may be trivially bypassed. Bio systems can be engineered to be anti-phishing, anti-MITM, etc. Incredibly hard to do that with passwords. By claiming that the user has to do something to use a password ignores the vast, vast set of vulnerabilities involved. One is not really better than the other per se. It's very use case dependent and you optimize for a specific outcome based on the risks at hand. You won't perfectly get every possibility nailed.

shultays 5y ago

And you can't change your biometrics, at least not as easily. So it can be used as an identifier as well and also can be used to match you in between databases.