5 ms·

The expectation is that you also have “something you are” as provided by your devices biometric authentication. The standard allows for service to demand that

The expectation is that you also have “something you are” as provided by your devices biometric authentication. The standard allows for service to demand that the authentication device performs an additional factor authentication. Which is usually either a PIN or biometrics, and your device attests to doing this during authentication. So then you have two complete factors “something you have” (your phone) and “something you are” (biometrics) or “something you know” (unlock PIN for device).

sph 4y ago
But I'm responding to GP that said biometrics are a username, not a secret, which I agree. I'm not sure something you are counts as a security factor.
- avianlyric 4y ago
  > But I'm responding to GP that said biometrics are a username, not a secret, which I agree. If you were sending an actual copy of your biometric data to the remote authentication service, then maybe you could make that argument. But that never happens, no FIDO biometric device sends a biometric fingerprint that could be reproduced by a different device. The device authenticates you with biometrics, then uses that data to unlock a private key, which is then used to answer a challenge-response request from the authenticating service. If you don’t the device, then it’s pretty much impossible for you to correctly answer that challenge-response, despite being in possession of the biometric features that device would use to authenticate you. So you can’t use your biometrics as a username. Because the device measuring the biometric data pushes that data through a mono-directional, randomly generated (at device manufacture), hash function, that exists within that device only. Take your biometrics else where (I.e same device type/model but different physical object), and you’ll get a different output even with identical inputs. Which would be a pretty useless username. > I'm not sure something you are counts as a security factor. You should take that up with NIST then: https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/m...
- Spivak 4y ago
  Something you is a an authentication factor that doesn’t need to be secret to be secure. That’s the whole point. You can have a high-res 3d model of my finger but you can’t create a human with my fingerprint. In the same way that the security of something you know is a scale based on “how difficult is your password to guess” or “how hard is it to crack the hash” the security of something you are is a scale based on “how difficult is it for someone to create a fake that tricks this specific machine into thinking it’s reading metrics from a live human.” The security lives in the system reading the metrics not your body which is why you don’t have to rotate your face every 90 days. A cheap fingerprint reader is the 4 digit pin of something you are. Retina scans that take temperature, look for blood flow and eye movement are the correct horse battery staple.

sph 4y ago

But I'm responding to GP that said biometrics are a username, not a secret, which I agree. I'm not sure something you are counts as a security factor.

avianlyric 4y ago
> But I'm responding to GP that said biometrics are a username, not a secret, which I agree. If you were sending an actual copy of your biometric data to the remote authentication service, then maybe you could make that argument. But that never happens, no FIDO biometric device sends a biometric fingerprint that could be reproduced by a different device. The device authenticates you with biometrics, then uses that data to unlock a private key, which is then used to answer a challenge-response request from the authenticating service. If you don’t the device, then it’s pretty much impossible for you to correctly answer that challenge-response, despite being in possession of the biometric features that device would use to authenticate you. So you can’t use your biometrics as a username. Because the device measuring the biometric data pushes that data through a mono-directional, randomly generated (at device manufacture), hash function, that exists within that device only. Take your biometrics else where (I.e same device type/model but different physical object), and you’ll get a different output even with identical inputs. Which would be a pretty useless username. > I'm not sure something you are counts as a security factor. You should take that up with NIST then: https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/m...
Spivak 4y ago
Something you is a an authentication factor that doesn’t need to be secret to be secure. That’s the whole point. You can have a high-res 3d model of my finger but you can’t create a human with my fingerprint. In the same way that the security of something you know is a scale based on “how difficult is your password to guess” or “how hard is it to crack the hash” the security of something you are is a scale based on “how difficult is it for someone to create a fake that tricks this specific machine into thinking it’s reading metrics from a live human.” The security lives in the system reading the metrics not your body which is why you don’t have to rotate your face every 90 days. A cheap fingerprint reader is the 4 digit pin of something you are. Retina scans that take temperature, look for blood flow and eye movement are the correct horse battery staple.