3 ms·
That's a fine 2FA unless your threat model involves physical coercion. The nice thing about passwords is that giving it is, with the exception of some drugs may
by leksak 4y ago
That's a fine 2FA unless your threat model involves physical coercion. The nice thing about passwords is that giving it is, with the exception of some drugs maybe, voluntary. You don't really have the same agency if someone forcibly makes your finger touch the device. And I think fingerprints work even on a dead body. And can be lifted from inanimate surfaces like a glas at a bar.
- prvit 4y agoThis feels ignorant of the fact that all the interesting information on your computer will be accessible without sudo. touchid is actually better than a password here, as it prevents malware from using sudo without physical confirmation from you.
- jonfw 4y agoWhat do you expect you will do if somebody capable of killing you wants your password? I can't imagine a circumstance where I would not voluntarily give somebody a password if they were in a position to physically force me to provide biometrics