6 ms·
Don't use biometrics as a password if your threat model includes: Person cloning your finger print from a glass you left at a bar, manufacturing a fake fingerpr
by dewey 4y ago
Don't use biometrics as a password if your threat model includes: Person cloning your finger print from a glass you left at a bar, manufacturing a fake fingerprint from it and getting physical access to your device to unlock it.
Otherwise for most people it's probably better than easy to guess passwords or not using a password at all. Especially if it's annoying to type every time (iPhone passkey). Many people didn't use a passkey before, since there's TouchID or FaceID everyone uses something and it's better against a random thief than nothing at all.
- Gigachad 4y agoNever forget the $10 wrench method.
- TowerTall 4y agoObligatory xkcd https://xkcd.com/538/ https://xkcd.com/538/
- throwaway744678 4y agoOh, man! The wrench actually costs only $5.
- 01acheru 4y agoThe $10 wrench always works: biometrics, passwords, encryption keys, physical keys, PINs, etc.
- lillecarl 4y agoBut if you have wrench in your threat model you're either in a really bad situation or you're rich enough to have personal security making the wrench method a lot more complex.
- ohgodplsno 4y agoIt's either Mossad or Not-Mossad. >My point is that security people need to get their priorities straight. The “threat model” section of a security paper resembles the script for a telenovela that was written by a paranoid schizophrenic: there are elaborate narratives and grand conspiracy theories, and there are heroes and villains with fantastic (yet oddly constrained) powers that necessitate a grinding battle of emotional and technical attrition. In the real world, threat models are much simpler (see Figure 1). Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https:// https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. In summary, https:// https:// and two dollars will get you a bus ticket to nowhere. Also, SANTA CLAUS ISN’T REAL. When it rains, it pours. https://www.schneier.com/blog/archives/2015/08/mickens_on_secu.html https://www.schneier.com/blog/archives/2015/08/mickens_on_se...
- GSGBen 4y agoThe full article is a good read too. Such a great writing style.
- FabHK 4y agoMan, inflation is everywhere these days...
- mordae 4y agoA glass? I mean... Wouldn't there be a bunch of my fingerprints on the phone itself? And if my bag gets stolen along with the laptop and possibly the phone, wouldn't there be fingerprints on pencils, water bottle and the phone charger? https://hackaday.com/2015/11/10/your-unhashable-fingerprints-secure-nothing/ https://hackaday.com/2015/11/10/your-unhashable-fingerprints...
- dewey 4y agoWhere the finger print comes from isn't really the point. The point is that a random opportunistic thief that finds a phone and wants to go spelunking is most likely not dedicated, capable or willing to go through that and your data stays safe.
- GeckoEidechse 4y agoBringing us back to the discussion about threat models :P
- yallneedtogetit 4y agoPolice can compel people to provide biometrics to unlock their devices, but passwords can be forgotten.
- Gigachad 4y agoThis isn’t true in most of the world and is even questionably true in the US
- phpisthebest 4y agoIt will remain questionable in the US until it reaches the Supreme Court. IMO is clearly a violation of the 5th amendment, but the Bill of Rights in the US has been soo watered down at this point they may not even be considered rights any more....
- NoGravitas 4y ago4th amendment, I think. Regardless, given the current composition of the Court, I wouldn't hold your breath for the situation to improve.
- phpisthebest 4y agoOne could make that case, but 4th allows for searches with a warrant I would say 5th because divulging the contents of ones mind is testimony which one should not be compelled to do, the 5th profits you from being a witness against yourself, reveling a password is being a witness against yourself
- chipsa 4y agoFifth: the password is testimony. It's searching their things, but the warrant issued by the court means that it's likely a reasonable search (ergo, not a violation of the 4th).
- dewey 4y agoThat doesn't always work out that well for the person "forgetting" the password though: https://en.wikipedia.org/wiki/Key_disclosure_law https://en.wikipedia.org/wiki/Key_disclosure_law
- atoav 4y agoMay favourite attack of that kind has been the one where a CCC-hacker stole the German defense ministers finger print... using a DSLR camera and a tele lense at a press conference: https://www.theregister.com/2014/12/29/german_minister_fingered_as_hackers_steal_her_thumbprint_from_a_photo/ https://www.theregister.com/2014/12/29/german_minister_finge...
- dewey 4y agoThat’s exactly what I had in mind when writing that. That was a good one!
- satysin 4y agoSorry but I have to nitpick here. Nobody was ever able to verify the fingerprint was the same as the German defence ministers. What the attacker was able to do was take a high resolution photo of the defence ministers thumb and then produce a "fingerprint" that they could use to register as a "fingerprint" on their own phone and then unlock that phone with the "fingerprint". It could be nothing like the defence ministers actual fingerprint but just look enough like any real fingerprint to register with a fingerprint scanner on a phone.
- colechristensen 4y agoIf it was a good photograph Tia would be pretty easy to verify visually. It would also be trivial to replicate on towels to see if your methods actually were adequate to authenticate on your own device.
- atoav 4y agoThanks for the nitpick, you are right, but given the state of photogrammetry today I wouldn't be surprised if just a few pictures would be enough to give you an accurate representation.
- hnaccount_rng 4y agoBut that wouldn’t work with TouchID sensors right? They also check for “living tissue”. And at that point the attack becomes _very_ expensive to perform
- harha 4y agoAdding to that: just because someone has your fingerprint, they won’t have full access since you can’t reset to a new iPhone and get the backup with just the fingerprint. It’s the combination of fingerprint + the previously authenticated device