6 ms·

Biometrics have to be the biggest meme in security maybe behind anti-virus software.

by usrn 4y ago

grapescheesee 4y ago
Wait, you dont run multiple anti virus software?
jchw 4y ago
Fingerprint authentication for unlocking personal devices seems alright to me. It works well on my laptop, as an alternative to typing the password, and makes it easier to stomach my rather aggressive auto-locking settings. (And with fprint on Linux, you get quite a bit of control over exactly what and how fingerprint based auth works, using PAM.) Facial recognition, on the other hand, is annoying as hell. Apple Face ID is seemingly one of the better systems, but I’ve used Windows Hello as well as Face ID and I can honestly say I hate both of them. They’re both solutions to problems I really do not believe anyone had. Like a lot of other “magic” security primitives such as passive proximity keys, facial authentication systems fail to validate intent. Fingerprint sensors are also a lot worse than passwords in this regard, but facial recognition authentication is absolutely ridiculous. I can accidentally unlock Windows Hello from halfway across the room. If my cat is about to walk on my laptop, I would like to lock the screen, but if Windows Hello is enabled, tough shit, as the moment keys are pressed it will try to find your face and unlock. At least Face ID tries very hard to ensure you’re looking at the device; if Windows Hello is trying to ensure that, it is not doing a good job. There’s hardly anything I can do to prevent the laptop from accidentally unlocking. Fingerprint authentication is still not ideal, so I think it should be limited to things that don’t need as much physical security. I think that it’s fair to say sudo prompts and screen unlocking are decent candidates. Even in the case where you have very advanced adversaries, at a certain point I wager the weakest link is going to be something else, and you are going to want to try to keep them physically separated from the machines if you want to stand a chance. Then again, I’m not a security person. That said, I think anti-virus is still a bigger meme.
- mistrial9 4y ago
  not disagreeing but, a part that is missing is the consent of the user to be in such an arrangement to use a computer. Next is the chain of custody for data linked to you personally and legally. Both the consent or lack-thereof, and the use and abuse of that persistant, highly-transmissible security data bundle. in short, if it were only in a formal environment for the right reasons, then sure, locks are useful; not that? problems
- KennyBlanken 4y ago
  Having used fingerprint unlock on an iPhone for a while, it's kind of a pain in the ass sometimes. * it doesn't work if your finger is even slightly wet, so using it while in the kitchen is annoying (like when trying to consult a recipe.) Even if you wipe your hands on a towel or your pants, it still might not work * it doesn't work if you're wearing latex/nitrile gloves, like when cleaning, or doing car work, etc. * it doesn't work if you're wearing gloves, which is a borderline necessity 3-4 months out of the year if you're planning on being outside for more than 5-10 minutes, or if you plan on using your hands for anything while outside. 6+ months out of the year if you're on a bike.
  - jchw 4y ago
    > * it doesn't work if your finger is even slightly wet, so using it while in the kitchen is annoying (like when trying to consult a recipe.) Even if you wipe your hands on a towel or your pants, it still might not work To be fair, this one genuinely varies per fingerprint sensor. Some of them work under surprisingly bad conditions. > * it doesn't work if you're wearing latex/nitrile gloves, like when cleaning, or doing car work, etc. True. > * it doesn't work if you're wearing gloves, which is a borderline necessity 3-4 months out of the year if you're planning on being outside for more than 5-10 minutes, or if you plan on using your hands for anything while outside. 6+ months out of the year if you're on a bike. This is really the same thing as the last one, but it depends on where you live. Also, gloves tend to not be great on touchscreens anyways. My issue with Face ID in particular is that it does not immediately show a PIN unlock, which means when it isn't working quite right you might fumble for a little bit trying to figure out how to get it to stop trying. Also, while it is again totally possible to accidentally unlock with fingerprint if you are not careful, it is hard to _not_ unlock with facial recognition on accident. (Not to mention, compounding on the problem, the fact that a whole lot of us are wearing face masks in public places right now, and therefore unable to easily unlock our phones with Face ID. Not having a convenient unlock option in public is quite a problem; PIN works, but for example, for payments I'd argue it really isn't ideal, and in public everyone can easily see your PIN when you type it.) Because of those issues, to me, fingerprint authentication feels like it's mostly a UX positive over PIN alone, whereas facial recognition + PIN is actually worse than just PIN because I legitimately can't avoid a lot of the awkwardness. I mean, anyone can get used to it and deal with it, but I absolutely felt a lot better with Touch ID than Face ID, and I doubt I'm alone on that one.

Biometrics have to be the biggest meme in security maybe behind anti-virus software.

by usrn 4y ago

Biometrics have to be the biggest meme in security maybe behind anti-virus software.

grapescheesee 4y ago

Wait, you dont run multiple anti virus software?

jchw 4y ago

Fingerprint authentication for unlocking personal devices seems alright to me. It works well on my laptop, as an alternative to typing the password, and makes it easier to stomach my rather aggressive auto-locking settings. (And with fprint on Linux, you get quite a bit of control over exactly what and how fingerprint based auth works, using PAM.) Facial recognition, on the other hand, is annoying as hell. Apple Face ID is seemingly one of the better systems, but I’ve used Windows Hello as well as Face ID and I can honestly say I hate both of them. They’re both solutions to problems I really do not believe anyone had. Like a lot of other “magic” security primitives such as passive proximity keys, facial authentication systems fail to validate intent. Fingerprint sensors are also a lot worse than passwords in this regard, but facial recognition authentication is absolutely ridiculous. I can accidentally unlock Windows Hello from halfway across the room. If my cat is about to walk on my laptop, I would like to lock the screen, but if Windows Hello is enabled, tough shit, as the moment keys are pressed it will try to find your face and unlock. At least Face ID tries very hard to ensure you’re looking at the device; if Windows Hello is trying to ensure that, it is not doing a good job. There’s hardly anything I can do to prevent the laptop from accidentally unlocking. Fingerprint authentication is still not ideal, so I think it should be limited to things that don’t need as much physical security. I think that it’s fair to say sudo prompts and screen unlocking are decent candidates. Even in the case where you have very advanced adversaries, at a certain point I wager the weakest link is going to be something else, and you are going to want to try to keep them physically separated from the machines if you want to stand a chance. Then again, I’m not a security person. That said, I think anti-virus is still a bigger meme.

mistrial9 4y ago
not disagreeing but, a part that is missing is the consent of the user to be in such an arrangement to use a computer. Next is the chain of custody for data linked to you personally and legally. Both the consent or lack-thereof, and the use and abuse of that persistant, highly-transmissible security data bundle. in short, if it were only in a formal environment for the right reasons, then sure, locks are useful; not that? problems
KennyBlanken 4y ago
Having used fingerprint unlock on an iPhone for a while, it's kind of a pain in the ass sometimes. * it doesn't work if your finger is even slightly wet, so using it while in the kitchen is annoying (like when trying to consult a recipe.) Even if you wipe your hands on a towel or your pants, it still might not work * it doesn't work if you're wearing latex/nitrile gloves, like when cleaning, or doing car work, etc. * it doesn't work if you're wearing gloves, which is a borderline necessity 3-4 months out of the year if you're planning on being outside for more than 5-10 minutes, or if you plan on using your hands for anything while outside. 6+ months out of the year if you're on a bike.
- jchw 4y ago
  > * it doesn't work if your finger is even slightly wet, so using it while in the kitchen is annoying (like when trying to consult a recipe.) Even if you wipe your hands on a towel or your pants, it still might not work To be fair, this one genuinely varies per fingerprint sensor. Some of them work under surprisingly bad conditions. > * it doesn't work if you're wearing latex/nitrile gloves, like when cleaning, or doing car work, etc. True. > * it doesn't work if you're wearing gloves, which is a borderline necessity 3-4 months out of the year if you're planning on being outside for more than 5-10 minutes, or if you plan on using your hands for anything while outside. 6+ months out of the year if you're on a bike. This is really the same thing as the last one, but it depends on where you live. Also, gloves tend to not be great on touchscreens anyways. My issue with Face ID in particular is that it does not immediately show a PIN unlock, which means when it isn't working quite right you might fumble for a little bit trying to figure out how to get it to stop trying. Also, while it is again totally possible to accidentally unlock with fingerprint if you are not careful, it is hard to _not_ unlock with facial recognition on accident. (Not to mention, compounding on the problem, the fact that a whole lot of us are wearing face masks in public places right now, and therefore unable to easily unlock our phones with Face ID. Not having a convenient unlock option in public is quite a problem; PIN works, but for example, for payments I'd argue it really isn't ideal, and in public everyone can easily see your PIN when you type it.) Because of those issues, to me, fingerprint authentication feels like it's mostly a UX positive over PIN alone, whereas facial recognition + PIN is actually worse than just PIN because I legitimately can't avoid a lot of the awkwardness. I mean, anyone can get used to it and deal with it, but I absolutely felt a lot better with Touch ID than Face ID, and I doubt I'm alone on that one.