8 ms·

Around 2014, I read a security researcher's article stating that biometrics should be used as an identifier at best, but never as a password. “You can change a

• brainphreeze 4y ago
  I'd tend to agree to be honest. Consider this: a group of thieves jump you and pin you down, they want to perform a banking transaction on your phone. They grab your hand, extend your finger and press it against the phones sensor. They're in. On some mobile banking apps, they can perform the same. The use of a password only known to you cannot be physically taken from you as your mind controls that authentication mechanism.
  • coding_unit_1 4y ago
    A $5 wrench will retrieve a password https://xkcd.com/538/ https://xkcd.com/538/ :)
  • michelb 4y ago
    So they beat you until you give the password.
  • Sebb767 4y ago
    They can also threaten to cut off your finger, in which case you'd probably want to enter the password anyway. Also, your password can easily be found by looking over your shoulder or by you unlocking your device in front of a camera - which is quite likely, given how often you unlock your phone. You can also collect and fake a fingerprint, but it's a lot more effort. On the other hand, in a few countries police can force you to use biometric authentication, but not to release your passwords. In the end, you really need to think about your threat scenario and act accordingly.
  • TacticalCoder 4y ago
    That's why systems correctly designed have not one but two passwords (or PINs), which look identical. You enter either and everything seems to work. But one of the two means "I'm under duress". If people home-jack me at night, my 24/7 alarm system/monitoring company calls me in the following 45 seconds at most and asks me for my password. If I say "monkey" it means everything is fine, if I say "beetle" it means I'm under duress. When I give either password, the company answers: "OK, sleep well, all is good". But in the later case they call the police and tell them a home-jacking is ongoing. (obviously my two words aren't "monkey" and "beetle", this is just an example). (as a bonus my alarm system has an anti-jamming system and communicates using several channels) Banking apps should be the same: they should have one PIN to do regular business and another one where everything looks legit, but you'd only be making fake wire transfer or only allowed tiny withdrawals, showing a small balance. Some companies (for example my alarm system) and websites (very few but I've seen some) and some HSM (for example cryptocurrencies hardware wallets can decode using two keys, one of them showing a smaller balance than the real one) have seen the light and have such a feature. I do believe we're still in the stone age when it comes to security. Most people like to post that disastrous XKCD and think the bad guys have forever won thanks to their $5 wrench. I'd hazard a guess: people thinking with that victim mentality aren't the ones coming up with better security systems.
    • brewmarche 4y ago
      This would also work with 2 fingerprints
    • davidgould 4y ago
      > they call the police and tell them a home-jacking is ongoing Who show up three hours later and shoot your dog.
  • Aaargh20318 4y ago
    Consider this: you are working on your laptop in a public place, like on the train. or in a coffee shop. You log in to your company website. Anyone looking over your shoulder can see you type your password, as well as the webpage you're logging in to. And it's not just people standing behind you, it can also be the security camera in that coffee shop. It can be someone looking through your office window with a telescope from the next building over. Same goes for your phone. There are ample opportunities to see someone type in their PIN code to unlock their phone, especially if you use it for payments which are generally done in public places. No need for violence, no need to draw attention to yourself, just watch them enter their PIN and then pickpocket the phone afterwards. It all depends on the exact threat scenario, but biometric authentication can be preferable to passwords when used in public places.
    • FabHK 4y ago
      When Ed Snowden accesses his laptop in the documentary Citizenfour, he puts a blanket over his head and himself including the laptop, then types in the password (presumably... we will never know :), and only then emerges from the blanket. I thought that was an excellent simple security measure! Maybe a bit weird if you start doing that in trains and coffee shops though.
• sexy_panda 4y ago
  I think that someone with enough motivation can easily use your fingerprint against you.
  • cguess 4y ago
    And that applies to only the smallest of percentage of people, and those it does would be receiving specialized trainings.
• coding_unit_1 4y ago
  Biometrics are not being used as a password directly. They are typically used as an identifier to unlock the secrets store on the device and then retrieve an access token (which has previously been obtained via username/password authorisation). The biometric information never leaves the device.
• dijit 4y ago
  They continue to be correct, the major difference when it comes to phones is that you're constantly typing a number in plain view of everyone around you. So you're making a tradeoff and with phones it works out slightly better if you unlock with biometrics most of the time; but you should know the five clicks method for disabling the biometric unlock temporarily.
• dewey 4y ago
  Don't use biometrics as a password if your threat model includes: Person cloning your finger print from a glass you left at a bar, manufacturing a fake fingerprint from it and getting physical access to your device to unlock it. Otherwise for most people it's probably better than easy to guess passwords or not using a password at all. Especially if it's annoying to type every time (iPhone passkey). Many people didn't use a passkey before, since there's TouchID or FaceID everyone uses something and it's better against a random thief than nothing at all.
  • Gigachad 4y ago
    Never forget the $10 wrench method.
    • TowerTall 4y ago
      Obligatory xkcd https://xkcd.com/538/ https://xkcd.com/538/
      • throwaway744678 4y ago
        Oh, man! The wrench actually costs only $5.
    • 01acheru 4y ago
      The $10 wrench always works: biometrics, passwords, encryption keys, physical keys, PINs, etc.
      • lillecarl 4y ago
        But if you have wrench in your threat model you're either in a really bad situation or you're rich enough to have personal security making the wrench method a lot more complex.
        • ohgodplsno 4y ago
          It's either Mossad or Not-Mossad. >My point is that security people need to get their priorities straight. The “threat model” section of a security paper resembles the script for a telenovela that was written by a paranoid schizophrenic: there are elaborate narratives and grand conspiracy theories, and there are heroes and villains with fantastic (yet oddly constrained) powers that necessitate a grinding battle of emotional and technical attrition. In the real world, threat models are much simpler (see Figure 1). Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https:// https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. In summary, https:// https:// and two dollars will get you a bus ticket to nowhere. Also, SANTA CLAUS ISN’T REAL. When it rains, it pours. https://www.schneier.com/blog/archives/2015/08/mickens_on_secu.html https://www.schneier.com/blog/archives/2015/08/mickens_on_se...
• jw1224 4y ago
  > “You can change a password, but you cannot change your fingerprint” I’ve never understood this argument. I could just as easily say “someone else can use your password, but they cannot use your fingerprint”.
  • yallneedtogetit 4y ago
    What's being missed here is that courts have ruled that police (read: government) can compel people to provide biometrics to unlock their devices, but passwords can be forgotten.
• spijdar 4y ago
  I think this depends a lot on your threat model. (specifically referring to phones/mobile devices) If you're at all concerned about being targeted, this is a very valid concern. On the other hand, I think using fingerprints/biometrics is "good enough" to prevent non-targeted attacks (theft, lost device) from retrieving sensitive info, and is far better than no password or a short numeric PIN. Obviously, using a rotating alpha-numeric-symbol password is more secure, but unless you only very sporadically use your mobile device, is pretty inconvenient. (of course, it'd probably be best to use MFA here and have a PIN code along with biometrics, but I'm not aware of any consumer devices like that)
• obert 4y ago
  I could agree, on the other hand though it would become very hard hiding your true identity if you were using a thumbprint to identify yourself, not to mention the ability to have multiple unlinked accounts, or signing in with someone else’s account (eg your children or your partner’s) on the same service.
• mrtksn 4y ago
  > a security researcher's article stating that biometrics should be used as an identifier at best, but never as a password Blanket statements like that are never true. It's usually about threat modelling, i.e. build your defences according to who might want to access your stuff and what are their capabilities. Why? Because you will have to target a balance between convenience and security. If you don't use biometrics you might end up to have "QWERT1234" as a password to compensate for the loss of convenience. Even if you have a strong password and you are ready to give up some convenience, you also risk false sense of security. Your password might be strong but there are many ways to extract passwords. As a result you might want to switch to certificates - which are convenient and secure to use but now you are responsible for it's upkeep or you might loss access to the systems when you loose your certificate. Also, you might think that certs are super secure but just yesterday it was revealed that there's a way to extract certificates from Intel and AMD machines through an attack called hertzbleed. Hmm, maybe you need something even more secure. How about air gap? If your device doesn't have a network connection, you must be %100 protected, right? Wrong, there are multiple demonstrations about extracting information through sound, magnetic forces and light. %100 security is impossible, better choose the right kind for you.
  • dhzhzjsbevs 4y ago
    > Blanket statements like that are never true. Except in cases where they are, like this one. Just cause you want convenience doesn't change the fact your fingerprints aren't good passwords.
    • mrtksn 4y ago
      fingerprint are not passwords at all, they are fingerprints. Checking for a fingerprint match essentially means that the administrator of the device is present and authorises the action, assuming that their fingerprints are not copied by an attacker and they are not physically forced to comply with an attacker. Checking for a password match essentially means that the administrator of the device might or might not be present but authorises the action, assuming that the password was not obtained through a post-it, coercion, phishing, guessing or any other password extraction method and they are not physically forced to comply with an attacker.
• nurumaik 4y ago
  A person sitting next to you in cafeteria can remember your password by looking at your keyboard but can't remember your fingerprint this way
  • theandrewbailey 4y ago
    A person sitting next to you can wait until you leave, dust every surface you touched, and copy your fingerprints. I hope you can change your fingerprints.
  • alpaca128 4y ago
    I'd wish them good luck guessing my custom keyboard layout.
• gommm 4y ago
  I see touch ID for sudo as the equivalent of 2FA. I am on my computer, I'm logged in in the account that has admin permissions but we want to confirm that it's me and not someone else that is logged in to my account, so touchid for sudo acts as a 2fa.
  • leksak 4y ago
    That's a fine 2FA unless your threat model involves physical coercion. The nice thing about passwords is that giving it is, with the exception of some drugs maybe, voluntary. You don't really have the same agency if someone forcibly makes your finger touch the device. And I think fingerprints work even on a dead body. And can be lifted from inanimate surfaces like a glas at a bar.
    • prvit 4y ago
      This feels ignorant of the fact that all the interesting information on your computer will be accessible without sudo. touchid is actually better than a password here, as it prevents malware from using sudo without physical confirmation from you.
    • jonfw 4y ago
      What do you expect you will do if somebody capable of killing you wants your password? I can't imagine a circumstance where I would not voluntarily give somebody a password if they were in a position to physically force me to provide biometrics
• nijave 4y ago
  The threat model of sudo is a little different. You already have authenticated access and sudo is requesting elevated access. Even a static button on the computer would provide benefit since it alerts the user a program is attempting to obtain elevated privileges. For comparison, Windows default configuration is a yes/no dialog (UAC). If an attacker had unelevated access they probably stand a pretty good chance of getting elevated access on a workstation (replacing files, putting a shim in front of sudo, stealing SSH keys, access tokens, cookies, etc) anyway (if the regular user has those privileges)
• samatman 4y ago
  Short answer is all that advice is obsolete. Biometrics as used by secure enclaves have tradeoffs which are unrelated to the (again, obsolete) practice of storing biometrics as authentication per se. The secure enclave holds biometrics, these are used to generate ordinary key pairs which are revokable. If you have a device like this, try it! Register a finger, then un-register the finger: congrats, you've changed your fingerprint.
• lathiat 4y ago
  Every time you type a password or pin code into your phone in a public place it’s trivial for someone to see what it is over your shoulder. It’s doable for keyboards to though not quite as easy. They can’t see it if you use your fingerprint or FaceID. That’s actually a security improvement for some threat models. Just a thought :)
• franga2000 4y ago
  Being able to change a credential only matters of it's a clonable credential like a key or a password. Assuming whatever device you're using is able to distinguish between the real thing and a copy, it doesn't matter if your fingerprint/face/iris... is "compromised" so there's no need to change it. That is, however, an assumption that has been made many times in the past and proven untrue.
• permo-w 4y ago
  for me this is not the reason you should be careful using fingerprints for security. I don't use touch ID because I'm concerned that if I'm ever arrested, the police could a) force me to unlock it, b) unlock it while I sleep. The same goes for people I sleep in the same room as. I think it's silly to have a security measure that can be passed while you're not even conscious
  • kube-system 4y ago
    If you're worried about being compelled to enter your Touch ID, just mess up entering your fingerprint five times or turn off the device, and the device will no longer accept Touch ID.
    • permo-w 4y ago
      I'd rather just use a code
• zitterbewegung 4y ago
  I really hope the move to FIDO happens soon in all browsers (aka passkeys). When you reboot a Mac you have to type in the password to login still. The easiest way to authenticate to a Mac is actually your Apple Watch.
• btm1971 4y ago
  When fingerprint readers were first starting to appear in Thinkpads, I enabled it so I could log in. I was demo'ing it to a co-worker who said "what's to keep someone from cutting your finger off to log in". I responded "if we've reached the point that they are willing to cut off my finger, I'm going to give them my password".
• kube-system 4y ago
  Touch ID isn't really biometric authentication. It is hardware token authentication, and that hardware token is unlocked via biometrics. The end application then authenticates with the hardware token. It works similarly to a Yubikey Bio Series token. It is actually an additional layer of protection over what you'd have with most physical hardware tokens, which can be used by anyone who possesses them. While you can't change your fingerprint, you can change which token is registered with the end application, so that concern is mitigated.
• Spooky23 4y ago
  Typically, biometrics are used as an unlock locally.
• Melatonic 4y ago
  My phone (android) doesnt let me use the fingerprint forever - every once in awhile I have to enter the passcode. And on bootup of course I have to enter the passcode. So while my passcode is quite long (and secure) the fingerprint adds a ton of convenience. I think this is a good compromise - at worst if I were to lose the device and someone were to cut off my finger at best it would only work for a few days. But that scenario seems quite rare.
• quitit 4y ago
  There is certainly merit to this line of thinking, however that is the scenario where the password is literally the hash of the fingerprint or facial read - this is a use case that's closer to a login name rather than a password. To use touchid/faceid as an example: - it requires that the password was recently entered - it's not the password, but a means of accessing a temporary token - that token is easily purged from memory by triggering SOS or failing touchid/faceid repeatedly - a range of conditions will also automatically purge the token, such as usage that doesn't match the user's behaviour, unusual movement such as scuffles, certain combinations of location/time/movement, and of course not being used for several hours (this also seems to vary based on certain conditions.) In this sense a biometric read can provide a useful level of security for most scenarios and definitely better than entering a 4-digit pin repeatedly, and infinitely better than gestural passwords which are comically easy to guess. For secure applications it's not useful, nor is a 4 or 6 digit pin, but such implementations also engage a range of security enhancements such as internet/voip via an encrypted VPN, locked down device profiles, limited access to networks and so-on. Sometimes the discussion about biometric data use in authentication tends to over-borrow from this level of security need.
• Angostura 4y ago
  One advantage of TouchID/FaceID for me is that I can use a long, strong passphrase on my phone - one much longer than I otherwise would if I had to use it to unlock every time. The passphrase is still required for highlky sensitive stuff like keychain access and turning off Find My
• Tagbert 4y ago
  I'm not sure whether this applies to sudo, but for device access, a biometric like a fingerprint is neither an identifier nor a password. It is closer to a session key. In any finger print system I have used, you must login with a username and password, then you have a session of access. The finger print can extend that session for some hours or days. Eventually the session rules require you to login again. Without having a recent session, your fingerprint does not provide access. Yes, like any session-based access, it is a compromise between convenience and security. For frequent usage like phone access, I feel like it is a reasonable compromise.
• netheril96 4y ago
  Password on iPhone has its own problem: it can be easily leaked when you type in front of any cameras.