5 ms·

I’m sure people way smarter than me have this figured out, from the Google post: > When you sign into a website or app on your phone, you will simply unlock yo

by TIPSIO 4y ago

I’m sure people way smarter than me have this figured out, from the Google post: > When you sign into a website or app on your phone, you will simply unlock your phone — your account won’t need a password anymore. > Instead, your phone will store a FIDO credential called a passkey which is used to unlock your online account. The passkey makes signing in far more secure, as it’s based on public key cryptography and is only shown to your online account when you unlock your phone So if I was a dumb kid, I could login to my parents bank accounts (or more / worst) if my mom gave me her 4 digit phone password for games earlier?

amelius 4y ago
No, because it should be evident by now that a phone is a personal computer, not to be shared with other people.
- josteink 4y ago
  I can tell you don’t have kids ;)
- wlesieutre 4y ago
  And personal computers have supported multiple people with separated data and settings since what, the 1980s?
- jeroenhd 4y ago
  For you perhaps. Phones are shared more often than you think. And no, they don't use multi-account features built into modern mobile operating systems.
davidkhess 4y ago
Normal usage would require a reauthentication - i.e. FaceId or TouchId - to produce the passkey.
- kogus 4y ago
  Currently on the iPhone, if your FaceID or TouchID fail repeatedly, you have the option to type in the passcode, which grants the same access. I'm not sure if the same is true on Android. I think the more general point is that "able to unlock the phone" is not / should not be the same as "I have verified that this is you" for sensitive applications and information.
  - michaelt 4y ago
    I just tested with two banks' apps. They both allow touch ID with fallback to a bank-account-specific PIN - not the phone passcode. Of course, if you've enrolled your kid's fingerprints they'd have access.
- TIPSIO 4y ago
  Ah cool, the Google post made it seem a bit more automatic and instant. > you will simply unlock your phone Then I guess that really is no different from opening an app.
jeroenhd 4y ago
If that kid can get their parent's finger on the fingerprint scanner, sure. The authentication part of the process is moved to the device's security system, so that's fingerprints, passcodes, and facial recognition.
- criddell 4y ago
  I don’t think fingerprint scanners on consumer devices are always great. My daughter has one on her laptop and last week I tried my finger and it worked.
  - jeroenhd 4y ago
    Honestly, biometrics are terrible for authorization. They're more of a username than a password and we shouldn't use them like passwords. The same is truth for facial recognition algorithms, no matter how advanced. They're so damn convenient, though. I trust the fingerprint scanner on my phone and my laptop, but there are definitely bad scanners out there.
    - criddell 4y ago
      Why do you trust your laptop scanner? Have you let other people try to unlock with their fingerprint? FWIW, my daughter's laptop is a Dell.
      - dlivingston 4y ago
        Apple's bioauth is very good and I trust both the fingerprint and face authentication. YMMV with other manufacturers and devices.
      - jeroenhd 4y ago
        I've tried unlocking my laptop's scanner with my other hand and I've asked other people to put their finger on it to see if it does some kind of weird matching based on finger type. No problems so far. It even works across both Windows and Linux if I use the right Windows reboot incantations. Since there is nothing genetic about fingerprints, I'd personally consider your daughter's laptop to be defective if you're able to unlock it. A critical part of the laptop's security mechanisms is clearly broken and should be looked at. I can't find many other stories about Dell specifically so this may be a specific unit or product line that's broken. You may even have something to gain by reporting it; I don't know if Dell or their manufacturers do bug bounties, but this definitely sounds like something that should be accepted in such a program. Even if they don't, writing a short blog about it with the brand, model, and model of the fingerprint reader might get the press rolling, forcing Dell to take action. This is simply unacceptable.
deleted 4y ago
[deleted]

by TIPSIO 4y ago

amelius 4y ago

No, because it should be evident by now that a phone is a personal computer, not to be shared with other people.

josteink 4y ago
I can tell you don’t have kids ;)
wlesieutre 4y ago
And personal computers have supported multiple people with separated data and settings since what, the 1980s?
jeroenhd 4y ago
For you perhaps. Phones are shared more often than you think. And no, they don't use multi-account features built into modern mobile operating systems.

davidkhess 4y ago

Normal usage would require a reauthentication - i.e. FaceId or TouchId - to produce the passkey.

kogus 4y ago
Currently on the iPhone, if your FaceID or TouchID fail repeatedly, you have the option to type in the passcode, which grants the same access. I'm not sure if the same is true on Android. I think the more general point is that "able to unlock the phone" is not / should not be the same as "I have verified that this is you" for sensitive applications and information.
- michaelt 4y ago
  I just tested with two banks' apps. They both allow touch ID with fallback to a bank-account-specific PIN - not the phone passcode. Of course, if you've enrolled your kid's fingerprints they'd have access.
TIPSIO 4y ago
Ah cool, the Google post made it seem a bit more automatic and instant. > you will simply unlock your phone Then I guess that really is no different from opening an app.

jeroenhd 4y ago

If that kid can get their parent's finger on the fingerprint scanner, sure. The authentication part of the process is moved to the device's security system, so that's fingerprints, passcodes, and facial recognition.

criddell 4y ago
I don’t think fingerprint scanners on consumer devices are always great. My daughter has one on her laptop and last week I tried my finger and it worked.
- jeroenhd 4y ago
  Honestly, biometrics are terrible for authorization. They're more of a username than a password and we shouldn't use them like passwords. The same is truth for facial recognition algorithms, no matter how advanced. They're so damn convenient, though. I trust the fingerprint scanner on my phone and my laptop, but there are definitely bad scanners out there.
  - criddell 4y ago
    Why do you trust your laptop scanner? Have you let other people try to unlock with their fingerprint? FWIW, my daughter's laptop is a Dell.
    - dlivingston 4y ago
      Apple's bioauth is very good and I trust both the fingerprint and face authentication. YMMV with other manufacturers and devices.
    - jeroenhd 4y ago
      I've tried unlocking my laptop's scanner with my other hand and I've asked other people to put their finger on it to see if it does some kind of weird matching based on finger type. No problems so far. It even works across both Windows and Linux if I use the right Windows reboot incantations. Since there is nothing genetic about fingerprints, I'd personally consider your daughter's laptop to be defective if you're able to unlock it. A critical part of the laptop's security mechanisms is clearly broken and should be looked at. I can't find many other stories about Dell specifically so this may be a specific unit or product line that's broken. You may even have something to gain by reporting it; I don't know if Dell or their manufacturers do bug bounties, but this definitely sounds like something that should be accepted in such a program. Even if they don't, writing a short blog about it with the brand, model, and model of the fingerprint reader might get the press rolling, forcing Dell to take action. This is simply unacceptable.

deleted 4y ago

[deleted]