32 ms·

This article doesn’t do a great job of explaining what the supposed password-less future is. Based on Microsoft’s article[1] it seems like it will fully be reli

by lom 5y ago

This article doesn’t do a great job of explaining what the supposed password-less future is. Based on Microsoft’s article[1] it seems like it will fully be reliant on your mobile phone and the authenticator app that you will have to install on it. What happens when someone gets access to your phone? What happens when you lose it? Does the app on the phone have the same protections under the law as passwords[2]. Is this just 2fa without any passwords at all involved? Just a few questions and doubts I could come up with in a small timespan. [1] http://microsoft.com/security/blog/2021/09/15/the-passwordless-future-is-here-for-your-microsoft-account/ http://microsoft.com/security/blog/2021/09/15/the-passwordle... [2] https://time.com/3558936/fingerprint-password-fifth-amendment/ https://time.com/3558936/fingerprint-password-fifth-amendmen...

megaman821 5y ago
The app can be configured to require a PIN/fingerprint to authenticate you. The 2 factors become control of the phone and your fingerprint.
- brendoelfrendo 5y ago
  Fingerprint is fine, maybe, sort of, for situations where your threat model doesn't involve someone compelling you to put your finger on the device. But PINs are just a step backward and I'm not sure why we should get on-board with replacing one form of knowledge auth with a weaker form of knowledge auth.
- llampx 5y ago
  If you have a fingerprint or can hack it, it basically will let you into the phone and into the auth app.
  - mattashii 5y ago
    Yep. But no-one ever leaves their fingerprints on their phone, so this is 100% safe. /s
  - marcodiego 5y ago
    I always thought fingerprint readers were weaker security than passwords. I mean, fingerprints can be legally obtained and it is much easier to put a hacked fingerprint reader (that always gives your real fingerprint to your device) than breaking strong encryption.
    - mattashii 5y ago
      A good fingerprint reader is cryptographically bound to the fingerprints stored on the device through e.g. a private key available only to the fingerprint chip. Replacing the fingerprint reader would therefore require the user to add their fingerprints to the system once again.
      - marcodiego 5y ago
        Is that how it is done these days? Also this will not prevent a physical identical fingerprint model attack: https://www.darkreading.com/endpoint/researchers-fool-biometric-scanners-with-3d-printed-fingerprints https://www.darkreading.com/endpoint/researchers-fool-biomet...
        lom 5y ago
        I’ve seen the EFF mention that the police is working technologies that will allow them do this amass. Also see the article OP (me) mentioned in link 2. Biometric passwords have less protection under the law in the US.
        mattashii 5y ago
        > Is that how it is done these days? Well, I don't know the exact specifics, but that's how I would implement security for biometrics input devices. Apart from that, I seem to recall that Apple does something with validating various sensors and rejecting "unknown" sensors (although that might be based on sensor make/model/SN and not necessarily cryptographic) > Also this will not prevent a physical identical fingerprint model attack Correct, but no fingerprint reader that is only a fingerprint reader will prevent such an attack: No lock is made to be unopenable by (a copy of) the key to that lock. If your fingerprint is the key, a good enough physical copy of the fingerprint will open the locked device.
  - marcodiego 5y ago
    Also, whatever is used as password must satisfy at least these 2 requirements: - It should be known only by you and - it should be easy to change in case it is compromised. Fingerprints fails both requirements. They may be good identifiers, but are terrible passwords.
    - Spivak 5y ago
      Why does this idea keep being perpetuated? Biometric auth is not "a picture of my fingerprint is the password." Imagine a human guard tasked with authenticating people with a database of fingerprints. Someone comes up says that they're John Jameson, the guard takes their hand and makes an impression with some ink and paper and then compares it to impression they have on file for Mr. Jameson. Could you hack this system by lifting John's prints? Nope! Why? Because the real trick to biometric auth isn't that your fingerprint is secret, it's that it's somewhere between difficult to impossible (depending on the metric) to produce a living breathing human with the same biometric readings as you. The strength of a biometric auth system is determined by how well it can determine that the reading it's taking is coming from a human. You don't ever have to rotate your fingerprint or your face because it doesn't need to be secret for these systems to work.
      - marcodiego 5y ago
        As I said: fingerprints are good identifiers, not good passwords.
Spooky23 5y ago
What happens if you don’t own a smartphone? You’re disenfranchised from society. My grandmother is 81, makes about $23k in pension and SS income. Why does she need to invest in a device the she cannot use?
- bpodgursky 5y ago
  Most 2FA services like Google also allow hardware keys like yubikeys. I don't see support for these disappearing anytime soon since they are a requirement for many certifications (like Fedramp).
  - ncphil 5y ago
    Google even lets you enroll more than one key, in case you lose your primary! AWS doesn't, but at least they accept Yubikey's budget U2F keys. Can't recall if MSFT does yet.
- earthscienceman 5y ago
  I'm a HN denizen, have a PhD, can code in a multitude of languages, etc etc etc. I don't own a smartphone and it gets less and less appealing every year. I will fight 'smart passports' tooth and nail to my grave. It's insanity to imagine that if I'm not tethered to a computer chip I'm not a valid member of society. And I say that as someone who loves computer chips. There are complaints on HN every day about the impacts of invasive technologies and then a thread like this comes by where the "solution" is to assume someones identity is their smartphone. Yikes. Last year I was denied access to a concert because they only gave tickets by a smartphone app and the woman looked at me like I was insane when I explained how that wasn't possible for me. I'm an otherwise normal member of society, a healthy and fit 32 year old male. But apparently I'm an unacceptable outsider if I don't want to carry an always on cell-phone modem directly integrated with one of the most powerful CPUs in history with access to my GPS location that was made in a sweat shop in China by a company with no direct stake in my personal well being. She literally said 'but you look normal' when I explained that I didn't have a smartphone.
  - 5y ago
skybrian 5y ago
Yes, you should always have a backup way of authenticating, not just your phone. One approach is to get a Yubikey, or maybe two.
jpalomaki 5y ago
Microsoft also supports hardware security keys.
SilasX 5y ago
Agreed. That’s why I’d still prefer 2FA rather than make it just this one factor. There are attackers that can guess your password. There are attackers that can rob you of your phone. But very few can do both, which requires a very targeted attack most people won’t experience. Shameless self-promo: my April Fool’s joke this year was that the next step after this is to authenticate you by behavior alone since they already track the dickens out of you :-p http://blog.tyrannyofthemouse.com/2021/04/leaked-google-initiative-no-more.html http://blog.tyrannyofthemouse.com/2021/04/leaked-google-init...

by lom 5y ago

megaman821 5y ago

The app can be configured to require a PIN/fingerprint to authenticate you. The 2 factors become control of the phone and your fingerprint.

brendoelfrendo 5y ago
Fingerprint is fine, maybe, sort of, for situations where your threat model doesn't involve someone compelling you to put your finger on the device. But PINs are just a step backward and I'm not sure why we should get on-board with replacing one form of knowledge auth with a weaker form of knowledge auth.
llampx 5y ago
If you have a fingerprint or can hack it, it basically will let you into the phone and into the auth app.
- mattashii 5y ago
  Yep. But no-one ever leaves their fingerprints on their phone, so this is 100% safe. /s
- marcodiego 5y ago
  I always thought fingerprint readers were weaker security than passwords. I mean, fingerprints can be legally obtained and it is much easier to put a hacked fingerprint reader (that always gives your real fingerprint to your device) than breaking strong encryption.
  - mattashii 5y ago
    A good fingerprint reader is cryptographically bound to the fingerprints stored on the device through e.g. a private key available only to the fingerprint chip. Replacing the fingerprint reader would therefore require the user to add their fingerprints to the system once again.
    - marcodiego 5y ago
      Is that how it is done these days? Also this will not prevent a physical identical fingerprint model attack: https://www.darkreading.com/endpoint/researchers-fool-biometric-scanners-with-3d-printed-fingerprints https://www.darkreading.com/endpoint/researchers-fool-biomet...
      - lom 5y ago
        I’ve seen the EFF mention that the police is working technologies that will allow them do this amass. Also see the article OP (me) mentioned in link 2. Biometric passwords have less protection under the law in the US.
      - mattashii 5y ago
        > Is that how it is done these days? Well, I don't know the exact specifics, but that's how I would implement security for biometrics input devices. Apart from that, I seem to recall that Apple does something with validating various sensors and rejecting "unknown" sensors (although that might be based on sensor make/model/SN and not necessarily cryptographic) > Also this will not prevent a physical identical fingerprint model attack Correct, but no fingerprint reader that is only a fingerprint reader will prevent such an attack: No lock is made to be unopenable by (a copy of) the key to that lock. If your fingerprint is the key, a good enough physical copy of the fingerprint will open the locked device.
- marcodiego 5y ago
  Also, whatever is used as password must satisfy at least these 2 requirements: - It should be known only by you and - it should be easy to change in case it is compromised. Fingerprints fails both requirements. They may be good identifiers, but are terrible passwords.
  - Spivak 5y ago
    Why does this idea keep being perpetuated? Biometric auth is not "a picture of my fingerprint is the password." Imagine a human guard tasked with authenticating people with a database of fingerprints. Someone comes up says that they're John Jameson, the guard takes their hand and makes an impression with some ink and paper and then compares it to impression they have on file for Mr. Jameson. Could you hack this system by lifting John's prints? Nope! Why? Because the real trick to biometric auth isn't that your fingerprint is secret, it's that it's somewhere between difficult to impossible (depending on the metric) to produce a living breathing human with the same biometric readings as you. The strength of a biometric auth system is determined by how well it can determine that the reading it's taking is coming from a human. You don't ever have to rotate your fingerprint or your face because it doesn't need to be secret for these systems to work.
    - marcodiego 5y ago
      As I said: fingerprints are good identifiers, not good passwords.

Spooky23 5y ago

What happens if you don’t own a smartphone? You’re disenfranchised from society. My grandmother is 81, makes about $23k in pension and SS income. Why does she need to invest in a device the she cannot use?

bpodgursky 5y ago
Most 2FA services like Google also allow hardware keys like yubikeys. I don't see support for these disappearing anytime soon since they are a requirement for many certifications (like Fedramp).
- ncphil 5y ago
  Google even lets you enroll more than one key, in case you lose your primary! AWS doesn't, but at least they accept Yubikey's budget U2F keys. Can't recall if MSFT does yet.
earthscienceman 5y ago
I'm a HN denizen, have a PhD, can code in a multitude of languages, etc etc etc. I don't own a smartphone and it gets less and less appealing every year. I will fight 'smart passports' tooth and nail to my grave. It's insanity to imagine that if I'm not tethered to a computer chip I'm not a valid member of society. And I say that as someone who loves computer chips. There are complaints on HN every day about the impacts of invasive technologies and then a thread like this comes by where the "solution" is to assume someones identity is their smartphone. Yikes. Last year I was denied access to a concert because they only gave tickets by a smartphone app and the woman looked at me like I was insane when I explained how that wasn't possible for me. I'm an otherwise normal member of society, a healthy and fit 32 year old male. But apparently I'm an unacceptable outsider if I don't want to carry an always on cell-phone modem directly integrated with one of the most powerful CPUs in history with access to my GPS location that was made in a sweat shop in China by a company with no direct stake in my personal well being. She literally said 'but you look normal' when I explained that I didn't have a smartphone.
- 5y ago

skybrian 5y ago

Yes, you should always have a backup way of authenticating, not just your phone. One approach is to get a Yubikey, or maybe two.

jpalomaki 5y ago

Microsoft also supports hardware security keys.

SilasX 5y ago

Agreed. That’s why I’d still prefer 2FA rather than make it just this one factor. There are attackers that can guess your password. There are attackers that can rob you of your phone. But very few can do both, which requires a very targeted attack most people won’t experience. Shameless self-promo: my April Fool’s joke this year was that the next step after this is to authenticate you by behavior alone since they already track the dickens out of you :-p http://blog.tyrannyofthemouse.com/2021/04/leaked-google-initiative-no-more.html http://blog.tyrannyofthemouse.com/2021/04/leaked-google-init...