5 ms·

Its pretty well known that fingerprints _by themselves_ are a pretty poor replacement for passwords. (a) They're public, in that it's pretty easy to get someone

Its pretty well known that fingerprints _by themselves_ are a pretty poor replacement for passwords. (a) They're public, in that it's pretty easy to get someone's fingerprint... just find something they touched recently. (b) If they're compromised its impossible to change them. I don't think this gets around either of those points, but I am curious if this somehow makes it much more difficult to either compromise the fingerprint hash (fingerprint fingerprint?) or makes the resultant hash less useful once compromised.

wnevets 5y ago
> Its pretty well known that fingerprints _by themselves_ are a pretty poor replacement for passwords. (a) They're public, in that it's pretty easy to get someone's fingerprint... just find something they touched recently. (b) If they're compromised its impossible to change them. I'm a bit more worried about Russian ransomware operators getting my passwords than my fingerprint.
- executive 5y ago
  even if they chop off your hand?
  - wnevets 5y ago
    If Russian ransomware operators want to even attempt to chop off my hand I would need to start making much more interesting life choices that I have been.
  - staticassertion 5y ago
    Time to add an embedded EKG as another factor :)
- bsza 5y ago
  If the police/border protection/etc ever took your fingerprints, don't worry, they'll get to them too. Maybe with even less effort than would be required for your password, depending on how diligently you protect your passwords.
- robbedpeter 5y ago
  Hope you never have a picture posted online with your fingers in view, then. Biometrics are terrible security tokens.
  - tmottabr 5y ago
    they might, but likely not with a resolution good enough to allow then to actually extract an useful fingerprint.. specially not after social media resize and convert the image a thousand times. also, fingerprint is not the only security, you still need physical access to the yubikey to use it, something a russian hacker also will have a hard time having..
  - wnevets 5y ago
    how does a Russian hacker having a picture of my fingerprint allow them to use my Yubikey to unlock my account?
  - tinus_hn 5y ago
    Similarly you could say iPhones with Touch ID are terrible because phones are full of fingerprints. Yet it turns out people who want to crack them attack the pincodes or the general security of the device, not the fingerprints.
g_p 5y ago
In essence, you require both the Yubikey in question, and the information supplied by the fingerprint reader to the Yubikey, in order to abuse this system. From the perspective of a U2F token, which uses a regular button, this is an increase in security for most users -- if their token is lost or stolen, or left in their device, someone cannot use their token by tapping the button. This doesn't address the inherent problem of irrevocability/unchangeability of biometrics, but it presents an interesting usability trade-off that could help non-technical users to keep their systems more secure. If you capture the wire signal between the fingerprint reader sensor and the module, it is likely that you could replay a valid authentication. If not, you could delve deeper into the sensor until eventually you are able to inject capacitive data from the sensing surface itself, and do this. In this case, by combining the use of a biometric with strong cryptographic authentication through the token, you require both to compromise the user -- no biometrics are shared with a server, it's all local. However if you lose either the token, or the ability to use that fingerprint (i.e. scratch or damage), you will lose access to the key the Yubikey has protected, absent some kind of backup password. For many users, that backup password will be the weak link, but a Yubikey should at least be able to rate limit attempts and erase its internal state if there are too many attempts.
- tialaramex 5y ago
  For the WebAuthn scenario there is no inherent backup, there's deliberately no way to export the keys. For a random web site, they're likely going to offer some way back in - albeit Google is content to make that quite hard if you choose their "Advanced Protection" scheme (and I think one of the free Git offerings just says too bad, you gave us no money, you're locked out but you lost nothing of value), but an employer might very reasonably issue employees a Security Key and say something like, look, if you lose it that sucks but go to Front Desk with your Line Manager, and they can issue you a new one, there is no bypass. As a user, it also makes sense (particularly if you know you're a real target, e.g. a political journalist, politician, activist) to just own more than one. > Yubikey should at least be able to rate limit attempts and erase its internal state if there are too many attempts. On the previous generation with a PIN as second factor, if you guess the PIN wrong repeatedly it locks you out.
jolmg 5y ago
I haven't used any of the other modes on my Yubikey 4 than the OpenPGP Smartcard. I would hope that other modes also support PINs/passwords, so the fingerprint is just an additional factor. If that's the case, it's not necessarily about replacing passwords with fingerprints.
2OEH8eoCRo0 5y ago
It's not only a fingerprint. The fingerprint tells the yubikey that it's you who is activating it.
staticassertion 5y ago
Without this model the attacker needs to steal the Yubikey. With this model the attacker needs to steal the Yubikey and pull a fingerprint. It remains to be seen if that's a meaningful difference, but it seems reasonable that in some situations it could make the attack much more costly. I could see myself using this when traveling.
pfundstein 5y ago
A fingerprint is not a password, it's a username.
jiveturkey 5y ago
> fingerprints _by themselves_ are a pretty poor replacement for passwords eh, that is not well known nor is it true. It is very much use case dependent. For example, a fingerprint is a great replacement for a password to unlock your phone, for most uses of such.

wnevets 5y ago

> Its pretty well known that fingerprints _by themselves_ are a pretty poor replacement for passwords. (a) They're public, in that it's pretty easy to get someone's fingerprint... just find something they touched recently. (b) If they're compromised its impossible to change them. I'm a bit more worried about Russian ransomware operators getting my passwords than my fingerprint.

executive 5y ago
even if they chop off your hand?
- wnevets 5y ago
  If Russian ransomware operators want to even attempt to chop off my hand I would need to start making much more interesting life choices that I have been.
- staticassertion 5y ago
  Time to add an embedded EKG as another factor :)
bsza 5y ago
If the police/border protection/etc ever took your fingerprints, don't worry, they'll get to them too. Maybe with even less effort than would be required for your password, depending on how diligently you protect your passwords.
robbedpeter 5y ago
Hope you never have a picture posted online with your fingers in view, then. Biometrics are terrible security tokens.
- tmottabr 5y ago
  they might, but likely not with a resolution good enough to allow then to actually extract an useful fingerprint.. specially not after social media resize and convert the image a thousand times. also, fingerprint is not the only security, you still need physical access to the yubikey to use it, something a russian hacker also will have a hard time having..
- wnevets 5y ago
  how does a Russian hacker having a picture of my fingerprint allow them to use my Yubikey to unlock my account?
- tinus_hn 5y ago
  Similarly you could say iPhones with Touch ID are terrible because phones are full of fingerprints. Yet it turns out people who want to crack them attack the pincodes or the general security of the device, not the fingerprints.

g_p 5y ago

In essence, you require both the Yubikey in question, and the information supplied by the fingerprint reader to the Yubikey, in order to abuse this system. From the perspective of a U2F token, which uses a regular button, this is an increase in security for most users -- if their token is lost or stolen, or left in their device, someone cannot use their token by tapping the button. This doesn't address the inherent problem of irrevocability/unchangeability of biometrics, but it presents an interesting usability trade-off that could help non-technical users to keep their systems more secure. If you capture the wire signal between the fingerprint reader sensor and the module, it is likely that you could replay a valid authentication. If not, you could delve deeper into the sensor until eventually you are able to inject capacitive data from the sensing surface itself, and do this. In this case, by combining the use of a biometric with strong cryptographic authentication through the token, you require both to compromise the user -- no biometrics are shared with a server, it's all local. However if you lose either the token, or the ability to use that fingerprint (i.e. scratch or damage), you will lose access to the key the Yubikey has protected, absent some kind of backup password. For many users, that backup password will be the weak link, but a Yubikey should at least be able to rate limit attempts and erase its internal state if there are too many attempts.

tialaramex 5y ago
For the WebAuthn scenario there is no inherent backup, there's deliberately no way to export the keys. For a random web site, they're likely going to offer some way back in - albeit Google is content to make that quite hard if you choose their "Advanced Protection" scheme (and I think one of the free Git offerings just says too bad, you gave us no money, you're locked out but you lost nothing of value), but an employer might very reasonably issue employees a Security Key and say something like, look, if you lose it that sucks but go to Front Desk with your Line Manager, and they can issue you a new one, there is no bypass. As a user, it also makes sense (particularly if you know you're a real target, e.g. a political journalist, politician, activist) to just own more than one. > Yubikey should at least be able to rate limit attempts and erase its internal state if there are too many attempts. On the previous generation with a PIN as second factor, if you guess the PIN wrong repeatedly it locks you out.

jolmg 5y ago

I haven't used any of the other modes on my Yubikey 4 than the OpenPGP Smartcard. I would hope that other modes also support PINs/passwords, so the fingerprint is just an additional factor. If that's the case, it's not necessarily about replacing passwords with fingerprints.

2OEH8eoCRo0 5y ago

It's not only a fingerprint. The fingerprint tells the yubikey that it's you who is activating it.

staticassertion 5y ago

Without this model the attacker needs to steal the Yubikey. With this model the attacker needs to steal the Yubikey and pull a fingerprint. It remains to be seen if that's a meaningful difference, but it seems reasonable that in some situations it could make the attack much more costly. I could see myself using this when traveling.

pfundstein 5y ago

A fingerprint is not a password, it's a username.

jiveturkey 5y ago

> fingerprints _by themselves_ are a pretty poor replacement for passwords eh, that is not well known nor is it true. It is very much use case dependent. For example, a fingerprint is a great replacement for a password to unlock your phone, for most uses of such.