5 ms·

The technology is interesting, probably fun to play with. The surrounding text seems to gloss over some complexity inherent in using it for authentication. > "

The technology is interesting, probably fun to play with. The surrounding text seems to gloss over some complexity inherent in using it for authentication. > "Hard to steal" Depends on the situation and attack surface. I would not want to use it to unlock my car or access my bank account. The Chaos Computer Club demonstrated that in 2008 by publishing the fingerprint of a German minister[0]. Fooling fingerprint scanners is entirely possible [1]. It _may_ suit your application, do not blindly believe this article though. > without adding any friction That's not my experience with Apple devices. Sometimes it works and only adds about three seconds. Other times you wipe and re-position your fingers a second or even third time. [0] https://www.heise.de/security/meldung/CCC-publiziert-die-Fingerabdruecke-von-Wolfgang-Schaeuble-Update-193732.html https://www.heise.de/security/meldung/CCC-publiziert-die-Fin... [1] https://arstechnica.com/gadgets/2013/09/chaos-computer-club-hackers-trick-apples-touchid-security-feature/ https://arstechnica.com/gadgets/2013/09/chaos-computer-club-...

fastball 4y ago
Although I certainly agree that biometric has shortcomings as an auth mechanism, not sure I agree it matters for a car, where you can just break a window to get access.
- thunfischbrot 4y ago
  Good point. I was thinking about "unlock and start" the car, didn't write that though. And even in that case it might not be much worse than the keyless options nowadays.
helsinkiandrew 4y ago
I would guess that most hardware/browsers that support the biometric API today (on iPhone/mac laptop anyway) the fingerprint/authentication is done on and tied to the device. So to logon to a website with it you would need access to someones unlocked phone or laptop - 99% of the time that would probably give you access to their email which would enable you todo a password reset anyway.
sneak 4y ago
The article is using "biometric authentication" to refer to WebAuthn-based authentication (which on lots of modern OSes can use biometrics to authenticate access to the keys used for WebAuthn). It is indeed hard to steal WebAuthn keys out of modern secure mobile devices. It's not talking about stealing biometric data.
- thunfischbrot 4y ago
  That's actually a good point. Though to me this is also an inaccuracy in the article which would better be clarified.

fastball 4y ago

Although I certainly agree that biometric has shortcomings as an auth mechanism, not sure I agree it matters for a car, where you can just break a window to get access.

thunfischbrot 4y ago
Good point. I was thinking about "unlock and start" the car, didn't write that though. And even in that case it might not be much worse than the keyless options nowadays.

helsinkiandrew 4y ago

I would guess that most hardware/browsers that support the biometric API today (on iPhone/mac laptop anyway) the fingerprint/authentication is done on and tied to the device. So to logon to a website with it you would need access to someones unlocked phone or laptop - 99% of the time that would probably give you access to their email which would enable you todo a password reset anyway.

sneak 4y ago

The article is using "biometric authentication" to refer to WebAuthn-based authentication (which on lots of modern OSes can use biometrics to authenticate access to the keys used for WebAuthn). It is indeed hard to steal WebAuthn keys out of modern secure mobile devices. It's not talking about stealing biometric data.

thunfischbrot 4y ago
That's actually a good point. Though to me this is also an inaccuracy in the article which would better be clarified.