6 ms·

That's why this is a dumb idea, merchants can just use the replay attack: https://www.wsj.com/articles/in-china-paying-with-your-face-is-hard-sell-11600597240#:

by EGreg 5y ago

That's why this is a dumb idea, merchants can just use the replay attack: https://www.wsj.com/articles/in-china-paying-with-your-face-is-hard-sell-11600597240#:~:text=A%20user%20needs%20to%20open,passcode%20sent%20to%20their%20phone https://www.wsj.com/articles/in-china-paying-with-your-face-.... The only place where you should be using your biometrics is to unlock devices you carry with you, like the iPhone.

js4ever 5y ago
Even for that it's not safe if anyone can bypass it with a $5 trick. It's definitely a thumb idea
- y4mi 5y ago
  You can unlock most home doors within seconds even without having the key Nonetheless, we still lock our doors and thieves often break in, even though picking the lock is both safer and less likely to arouse suspicion. Your argument makes sense, but we humans aren't really rational
  - fragmede 5y ago
    Breaking into my house doesn't get you my password for all of my accounts though, no matter how much of an invasion of my space it is.
  - Aengeuad 5y ago
    There's a good reason why criminals don't carry lockpicks around and that's because they're regulated, in much of the world mere possession of them outside of your residence is a criminal offence and even in places where you can carry them legally they not only show prior intent, their use in criminal activities carries a charge just like breaking and entering. I'd also argue that being stuck picking a stubborn lock for 2-3 minutes is significantly more suspicion arousing than the literal seconds it takes to break a window but that's neither here nor there. On the rationality of having locks when criminals can very easily break a window, the old saying that locks keep honest people out rings true. Locks do serve a purpose even if they do very little to slow criminals down. To bring the analogy full circle fingerprint readers always seemed like windows to me in how easy they are to bypass, luckily they're more of a luxury than a necessity. :-)
    - lstodd 5y ago
      Lockpicks for the common locks can be made on site in under 5 minutes and then after about half-minute the lock is broken, and picks are discarded. That is why they aren't carried around any more. And that is not taking into account that most locks can be defeated without lockpicks, a steel ruler will do. It's just sad when people that don't know a bit about the trade boast about "regulations" and how they are relevant. They are not.
    - ClumsyPilot 5y ago
      Lockpicks are not illegal or regulated in UK, you just have to learn how to use them
    - ranger_danger 5y ago
      Criminals don't carry lockpicks because a brick is easier.
- deleted 5y ago
  [deleted]
- DennisP 5y ago
  > definitely a thumb idea Four hours have gone by without comment on this and I feel the offense should be recognized.
  - imwillofficial 5y ago
    I thought it was intentional, won’t lie, I laughed.
    - jschwartzi 5y ago
      I can’t put my finger on why though.
dangerface 5y ago
until you fall asleep with your phone on you.
bitxbitxbitcoin 5y ago
I would argue that the devices you carry with you are exactly the ones you shouldn’t use biometrics for. Law enforcement can force you to use biometrics to unlock a phone. They have used dead bodies to unlock phones.[0] What they can’t do is make you remember a code/password which you have “forgotten.” [0] https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-cops-are-now-opening-iphones-with-dead-peoples-fingerprints/?sh=7648e44a393e https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-c...
- FridayoLeary 5y ago
  The vast majority people will never encounter a circumstance where that will be an issue. To withhold a (n optional) feature from the masses based on the hypothetical actions of an agency who can abuse your fingerprints but will stop short of torture doesn't really make sense.
  - reaperducer 5y ago
    HN, and the tech bubble at large, is all about "edge-cases." Too many Debbie Downers getting off on playing "what if" scenarios, while ignoring reality.
  - arminiusreturns 5y ago
    1. With police authoritarian levels where they are, I doubt saying "the vast majority" won't encounter similar tactics in the near future would be correct, or at least there is evidence enough to offer strong debate on the topic. 2. Nobody claimed to then want to withhold the feature "from the masses"... so this is a strawman. 3. "hypothetical actions of an agency"... I think it's pretty clear that these types of methods are not hypothetical, and are being used already 4. "will stop short of torture"... I also think it's clear that many LEO's, especially the closer to federal ones, have been found to torture already. I agree with gp, biometrics on phones are a bad idea all around, for a lot more reasons that have been said. I don't know why you are protesting this idea as you do.
- criddell 5y ago
  > What they can’t do is make you remember a code/password which you have “forgotten.” They might be able to with an FMRI machine.

by EGreg 5y ago

js4ever 5y ago

Even for that it's not safe if anyone can bypass it with a $5 trick. It's definitely a thumb idea

y4mi 5y ago
You can unlock most home doors within seconds even without having the key Nonetheless, we still lock our doors and thieves often break in, even though picking the lock is both safer and less likely to arouse suspicion. Your argument makes sense, but we humans aren't really rational
- fragmede 5y ago
  Breaking into my house doesn't get you my password for all of my accounts though, no matter how much of an invasion of my space it is.
- Aengeuad 5y ago
  There's a good reason why criminals don't carry lockpicks around and that's because they're regulated, in much of the world mere possession of them outside of your residence is a criminal offence and even in places where you can carry them legally they not only show prior intent, their use in criminal activities carries a charge just like breaking and entering. I'd also argue that being stuck picking a stubborn lock for 2-3 minutes is significantly more suspicion arousing than the literal seconds it takes to break a window but that's neither here nor there. On the rationality of having locks when criminals can very easily break a window, the old saying that locks keep honest people out rings true. Locks do serve a purpose even if they do very little to slow criminals down. To bring the analogy full circle fingerprint readers always seemed like windows to me in how easy they are to bypass, luckily they're more of a luxury than a necessity. :-)
  - lstodd 5y ago
    Lockpicks for the common locks can be made on site in under 5 minutes and then after about half-minute the lock is broken, and picks are discarded. That is why they aren't carried around any more. And that is not taking into account that most locks can be defeated without lockpicks, a steel ruler will do. It's just sad when people that don't know a bit about the trade boast about "regulations" and how they are relevant. They are not.
  - ClumsyPilot 5y ago
    Lockpicks are not illegal or regulated in UK, you just have to learn how to use them
  - ranger_danger 5y ago
    Criminals don't carry lockpicks because a brick is easier.
deleted 5y ago
[deleted]
DennisP 5y ago
> definitely a thumb idea Four hours have gone by without comment on this and I feel the offense should be recognized.
- imwillofficial 5y ago
  I thought it was intentional, won’t lie, I laughed.
  - jschwartzi 5y ago
    I can’t put my finger on why though.

dangerface 5y ago

until you fall asleep with your phone on you.

bitxbitxbitcoin 5y ago

I would argue that the devices you carry with you are exactly the ones you shouldn’t use biometrics for. Law enforcement can force you to use biometrics to unlock a phone. They have used dead bodies to unlock phones.[0] What they can’t do is make you remember a code/password which you have “forgotten.” [0] https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-cops-are-now-opening-iphones-with-dead-peoples-fingerprints/?sh=7648e44a393e https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-c...

FridayoLeary 5y ago
The vast majority people will never encounter a circumstance where that will be an issue. To withhold a (n optional) feature from the masses based on the hypothetical actions of an agency who can abuse your fingerprints but will stop short of torture doesn't really make sense.
- reaperducer 5y ago
  HN, and the tech bubble at large, is all about "edge-cases." Too many Debbie Downers getting off on playing "what if" scenarios, while ignoring reality.
- arminiusreturns 5y ago
  1. With police authoritarian levels where they are, I doubt saying "the vast majority" won't encounter similar tactics in the near future would be correct, or at least there is evidence enough to offer strong debate on the topic. 2. Nobody claimed to then want to withhold the feature "from the masses"... so this is a strawman. 3. "hypothetical actions of an agency"... I think it's pretty clear that these types of methods are not hypothetical, and are being used already 4. "will stop short of torture"... I also think it's clear that many LEO's, especially the closer to federal ones, have been found to torture already. I agree with gp, biometrics on phones are a bad idea all around, for a lot more reasons that have been said. I don't know why you are protesting this idea as you do.
criddell 5y ago
> What they can’t do is make you remember a code/password which you have “forgotten.” They might be able to with an FMRI machine.