7 ms·

> a security researcher's article stating that biometrics should be used as an identifier at best, but never as a password Blanket statements like that are ne

by mrtksn 4y ago

> a security researcher's article stating that biometrics should be used as an identifier at best, but never as a password Blanket statements like that are never true. It's usually about threat modelling, i.e. build your defences according to who might want to access your stuff and what are their capabilities. Why? Because you will have to target a balance between convenience and security. If you don't use biometrics you might end up to have "QWERT1234" as a password to compensate for the loss of convenience. Even if you have a strong password and you are ready to give up some convenience, you also risk false sense of security. Your password might be strong but there are many ways to extract passwords. As a result you might want to switch to certificates - which are convenient and secure to use but now you are responsible for it's upkeep or you might loss access to the systems when you loose your certificate. Also, you might think that certs are super secure but just yesterday it was revealed that there's a way to extract certificates from Intel and AMD machines through an attack called hertzbleed. Hmm, maybe you need something even more secure. How about air gap? If your device doesn't have a network connection, you must be %100 protected, right? Wrong, there are multiple demonstrations about extracting information through sound, magnetic forces and light. %100 security is impossible, better choose the right kind for you.

dhzhzjsbevs 4y ago
> Blanket statements like that are never true. Except in cases where they are, like this one. Just cause you want convenience doesn't change the fact your fingerprints aren't good passwords.
- mrtksn 4y ago
  fingerprint are not passwords at all, they are fingerprints. Checking for a fingerprint match essentially means that the administrator of the device is present and authorises the action, assuming that their fingerprints are not copied by an attacker and they are not physically forced to comply with an attacker. Checking for a password match essentially means that the administrator of the device might or might not be present but authorises the action, assuming that the password was not obtained through a post-it, coercion, phishing, guessing or any other password extraction method and they are not physically forced to comply with an attacker.
  - hulitu 4y ago
    > Checking for a fingerprint match essentially means that the administrator of the device is present and authorises the action No it means only that the fingerprints are present. Your finger can be cut or you might be forced to unlock the device.
    - pilsetnieks 4y ago
      Touch ID specifically requires a live finger. Other fingerprint readers might not. You can also be forced to reveal or enter the password.
      - AndrewThrowaway 4y ago
        > Touch ID specifically requires a live finger. I remember reading about one school which implemented "live finger" readers. How did kids hack it? Polymer clay and a gummy bear. Put your finger on clay and wait for it to dry. You will have your permanent mirrored fingerprint. When required fingerprint press gummy bear against clay and then against the reader. As gummy bear holds charge, can even be cut thin etc. there is little chance to detect that it is not a real skin.
        JoachimS 4y ago
        You are missing the "requires a live finger" part. The biometric system (sensor + algorithm) used by Apple, as well as other competitive biometric vendors, detect blood flow, pulse in the finger. This is done as a mitigation against fake fingers as well as the (always presented) gory "cut off the finger" attack scenario. A gummy bear may be lifelike, but normally lacks a beating heart and circulatory system.
        airstrike 4y ago
        > A gummy bear may be lifelike, but normally lacks a beating heart and circulatory system. “Normally”?
- Bilal_io 4y ago
  > Except in cases where they are, like this one. Mark Twain once said "All generalizations are false, including this one."
- personjerry 4y ago
  I think this is a product manager versus engineer conversation where you're talking over each other. You're technically right that fingerprints aren't "good passwords", in fact they are not even passwords at all. But for most people, most of the time, they cover most of the same use cases at a better convenience price point. For general use (i.e. unless you work in security or journalism) that's what matters.
- babypuncher 4y ago
  Biometrics may not be easy to change, but they are a lot harder to copy than passwords. How many people are likely to be targeted by an organization with the resources to covertly steal and duplicate peoples fingerprints? For the vast majority of users, the threat model looks like "I don't want that creep who just stole my purse to be able to log in to my iPhone", not "I am guarding state secrets and a potential target of Kremlin agents". Passwords get stolen and used all the time, but I have yet to hear stories of everyday thieves breaking into iPhones with stolen fingerprints.
hackernewds 4y ago
> there are multiple demonstrations about extracting information through sound, magnetic forces and light. fascinated by this. where could one learn more?
- dave881 4y ago
  US Military/Intel TEMPEST program covers protection against some of these. The Wikipedia article's references includes links to relevant research. https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename)
Wowfunhappy 4y ago
> Hmm, maybe you need something even more secure. How about air gap? If your device doesn't have a network connection, you must be %100 protected, right? Wrong, there are multiple demonstrations about extracting information through sound, magnetic forces and light. Eh, they're all pretty bogus though, with ridiculously contrived scenarios I mostly can't imagine happening in the real world. USB sticks and the like pose a more realistic danger to air gapped machines, but they're also easy to avoid if you're conscientious. Air gaps are really, really good and we should be using them more.
- mrtksn 4y ago
  For most people a fingerprint scanner is just enough, an awful lot of people don't have any password or biometrics and even they just do fine. It's all about the threat, there's no right answer about how much security is enough security without assessing the threat factor.
  - Wowfunhappy 4y ago
    I'm not arguing that point. But I think focusing on these frankly-stupid "look we can transfer data using light" papers severely undersells the effectiveness of air gaps, for people who do need them. It should be obvious to anyone who has used a QR code that it's possible to transfer data over other channels, but it's pretty obvious it's happening.

by mrtksn 4y ago

dhzhzjsbevs 4y ago

> Blanket statements like that are never true. Except in cases where they are, like this one. Just cause you want convenience doesn't change the fact your fingerprints aren't good passwords.

mrtksn 4y ago
fingerprint are not passwords at all, they are fingerprints. Checking for a fingerprint match essentially means that the administrator of the device is present and authorises the action, assuming that their fingerprints are not copied by an attacker and they are not physically forced to comply with an attacker. Checking for a password match essentially means that the administrator of the device might or might not be present but authorises the action, assuming that the password was not obtained through a post-it, coercion, phishing, guessing or any other password extraction method and they are not physically forced to comply with an attacker.
- hulitu 4y ago
  > Checking for a fingerprint match essentially means that the administrator of the device is present and authorises the action No it means only that the fingerprints are present. Your finger can be cut or you might be forced to unlock the device.
  - pilsetnieks 4y ago
    Touch ID specifically requires a live finger. Other fingerprint readers might not. You can also be forced to reveal or enter the password.
    - AndrewThrowaway 4y ago
      > Touch ID specifically requires a live finger. I remember reading about one school which implemented "live finger" readers. How did kids hack it? Polymer clay and a gummy bear. Put your finger on clay and wait for it to dry. You will have your permanent mirrored fingerprint. When required fingerprint press gummy bear against clay and then against the reader. As gummy bear holds charge, can even be cut thin etc. there is little chance to detect that it is not a real skin.
      - JoachimS 4y ago
        You are missing the "requires a live finger" part. The biometric system (sensor + algorithm) used by Apple, as well as other competitive biometric vendors, detect blood flow, pulse in the finger. This is done as a mitigation against fake fingers as well as the (always presented) gory "cut off the finger" attack scenario. A gummy bear may be lifelike, but normally lacks a beating heart and circulatory system.
        airstrike 4y ago
        > A gummy bear may be lifelike, but normally lacks a beating heart and circulatory system. “Normally”?
Bilal_io 4y ago
> Except in cases where they are, like this one. Mark Twain once said "All generalizations are false, including this one."
personjerry 4y ago
I think this is a product manager versus engineer conversation where you're talking over each other. You're technically right that fingerprints aren't "good passwords", in fact they are not even passwords at all. But for most people, most of the time, they cover most of the same use cases at a better convenience price point. For general use (i.e. unless you work in security or journalism) that's what matters.
babypuncher 4y ago
Biometrics may not be easy to change, but they are a lot harder to copy than passwords. How many people are likely to be targeted by an organization with the resources to covertly steal and duplicate peoples fingerprints? For the vast majority of users, the threat model looks like "I don't want that creep who just stole my purse to be able to log in to my iPhone", not "I am guarding state secrets and a potential target of Kremlin agents". Passwords get stolen and used all the time, but I have yet to hear stories of everyday thieves breaking into iPhones with stolen fingerprints.

hackernewds 4y ago

> there are multiple demonstrations about extracting information through sound, magnetic forces and light. fascinated by this. where could one learn more?

dave881 4y ago
US Military/Intel TEMPEST program covers protection against some of these. The Wikipedia article's references includes links to relevant research. https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename)

Wowfunhappy 4y ago

> Hmm, maybe you need something even more secure. How about air gap? If your device doesn't have a network connection, you must be %100 protected, right? Wrong, there are multiple demonstrations about extracting information through sound, magnetic forces and light. Eh, they're all pretty bogus though, with ridiculously contrived scenarios I mostly can't imagine happening in the real world. USB sticks and the like pose a more realistic danger to air gapped machines, but they're also easy to avoid if you're conscientious. Air gaps are really, really good and we should be using them more.

mrtksn 4y ago
For most people a fingerprint scanner is just enough, an awful lot of people don't have any password or biometrics and even they just do fine. It's all about the threat, there's no right answer about how much security is enough security without assessing the threat factor.
- Wowfunhappy 4y ago
  I'm not arguing that point. But I think focusing on these frankly-stupid "look we can transfer data using light" papers severely undersells the effectiveness of air gaps, for people who do need them. It should be obvious to anyone who has used a QR code that it's possible to transfer data over other channels, but it's pretty obvious it's happening.