4 ms·

The tinkering hacker in me is full of joy, but: "Prompting for a username and password is so 2005. Today, you can just prompt for a fingerprint." True, you ca

The tinkering hacker in me is full of joy, but: "Prompting for a username and password is so 2005. Today, you can just prompt for a fingerprint." True, you can... but should you? I would never ever give away biometric data unless forced to (e.g. passport)

skyeto 4y ago
The idea is that you aren't giving away any kind of biometric data, just using your fingerprint/face-unlock/etc to "unlock" the key used for signing the request locally. It could also be implemented in a way where it's behind a password instead of biometrics. Yubikey and the likes already use this method.
- jjgreen 4y ago
  Make your fingers valuable to violent and ruthless miscreants, good move!
  - gruez 4y ago
    As opposed to violent and ruthless miscreants beating the password out of you?
    - deleted 4y ago
      [deleted]
    - OtomotO 4y ago
      No need for a beating if I can just tell them... they can take the password with them. Or they can take the fingers with them.
    - jjgreen 4y ago
      Ouch! OK OK, my password is "please-dont-take-my-fingers"
searchableguy 4y ago
WebAuthN operates on a key pair generated using your biometrics in the background and then that is used for authentication. Your actual biometric data isn't sent to the website.
- OtomotO 4y ago
  Ah, yes, thanks for clarification. So I would just sync the keys locally or via some browser-extension and then on each device be responsible to provide the "secret" (e.g. my face or fingerprint) in a readily way to unlock said key, yes?
  - searchableguy 4y ago
    Yes, depending on the platform. See apple passkey page: https://support.apple.com/en-in/HT213305 https://support.apple.com/en-in/HT213305
teddyh 4y ago
Are you forced to get a passport?
- capableweb 4y ago
  I'm guessing parent, like many here on HN, tend to travel internationally at least once in their lifetime. And then a passport is "forced" upon you, if you'd like to transport yourself across international borders (unless Schengen or similar areas).
  - teddyh 4y ago
    In that case it’s simply a question of what you value most, your biometric privacy or the ability to have an international travel permit. It’s a choice; neither option is forced on anyone.
    - dane-pgp 4y ago
      But no one chose to be presented with that choice. Ideally we would be able to have both biometric privacy and international travel. Well, to be fair, a lot of people probably do support the idea that their own country checks the documents of people who enter and exit through their borders, and are maybe glad that the country they are visiting is similarly careful, but in principle, someone might want to emigrate to Antarctica, and never return to their country of birth, and for them it would be an unnecessary burden to have to apply for a passport.
    - OtomotO 4y ago
      I wasn't forced at gunpoint, true. I made the deliberate decision to travel and see different cultures. But to be frank, I was more or less forced, because I was traveling with my parents ;-)
- Am4TIfIsER0ppos 4y ago
  They are required for ID card here
EE84M3i 4y ago
passwords.google.com has used this api (or one similar) for years as an additional layer when getting a password in plaintext.

skyeto 4y ago

The idea is that you aren't giving away any kind of biometric data, just using your fingerprint/face-unlock/etc to "unlock" the key used for signing the request locally. It could also be implemented in a way where it's behind a password instead of biometrics. Yubikey and the likes already use this method.

jjgreen 4y ago
Make your fingers valuable to violent and ruthless miscreants, good move!
- gruez 4y ago
  As opposed to violent and ruthless miscreants beating the password out of you?
  - deleted 4y ago
    [deleted]
  - OtomotO 4y ago
    No need for a beating if I can just tell them... they can take the password with them. Or they can take the fingers with them.
  - jjgreen 4y ago
    Ouch! OK OK, my password is "please-dont-take-my-fingers"

searchableguy 4y ago

WebAuthN operates on a key pair generated using your biometrics in the background and then that is used for authentication. Your actual biometric data isn't sent to the website.

OtomotO 4y ago
Ah, yes, thanks for clarification. So I would just sync the keys locally or via some browser-extension and then on each device be responsible to provide the "secret" (e.g. my face or fingerprint) in a readily way to unlock said key, yes?
- searchableguy 4y ago
  Yes, depending on the platform. See apple passkey page: https://support.apple.com/en-in/HT213305 https://support.apple.com/en-in/HT213305

teddyh 4y ago

Are you forced to get a passport?

capableweb 4y ago
I'm guessing parent, like many here on HN, tend to travel internationally at least once in their lifetime. And then a passport is "forced" upon you, if you'd like to transport yourself across international borders (unless Schengen or similar areas).
- teddyh 4y ago
  In that case it’s simply a question of what you value most, your biometric privacy or the ability to have an international travel permit. It’s a choice; neither option is forced on anyone.
  - dane-pgp 4y ago
    But no one chose to be presented with that choice. Ideally we would be able to have both biometric privacy and international travel. Well, to be fair, a lot of people probably do support the idea that their own country checks the documents of people who enter and exit through their borders, and are maybe glad that the country they are visiting is similarly careful, but in principle, someone might want to emigrate to Antarctica, and never return to their country of birth, and for them it would be an unnecessary burden to have to apply for a passport.
  - OtomotO 4y ago
    I wasn't forced at gunpoint, true. I made the deliberate decision to travel and see different cultures. But to be frank, I was more or less forced, because I was traveling with my parents ;-)
Am4TIfIsER0ppos 4y ago
They are required for ID card here

EE84M3i 4y ago

passwords.google.com has used this api (or one similar) for years as an additional layer when getting a password in plaintext.