4 ms·
Biometric data is the equivalent of a username not a credential to be used for auth. It uniquely identifies but does not authenticate a person. You can go passw
by _8j50 4y ago
Biometric data is the equivalent of a username not a credential to be used for auth. It uniquely identifies but does not authenticate a person. You can go passwordless with a FIDO key or push notification confirmation apps for auth and use biometrics instead of usernames (don't see the advantage).
Curious, what happens if people lose their arm or eye? How do you recover the account? Let me guess, email? Lol. So all this and you're still a phish away from pwnage!
- doliveira 4y agoI feel like we're way better off just sending an email every time a user logs into a new device. We already have to assume the email is secure anyway... Having to have tons of Yubikeys adds so much friction.
- _8j50 4y agoDeath to email! Stop using email entirely unless users opt-in. Give users the option of FIDO or passwordless auth apps with a reset code or oauth federation with a third party.
- doliveira 4y agoI was listening to a security podcast in which the host was quite proud of having lots of Yubikeys around. No way this scales to the general population.
- _8j50 4y agoFor companies, I think it should be part of the employee badge's cost. Just another peripheral. I think it can indeed scale, people use USB drives a lot, think of it as another peripheral similar to mouse or keyboard. It is especially more attractive as a single factor auth when you go passwordless. It is a similar security model as physical keys and the cost is only ~1x more.
- helsinkiandrew 4y agoI think I've only seen it on the ebay site - there its just a way of bypassing entering a password whey you're using your laptop/phone which do the fingerprint auth. Assume if you lose your arm you'd enter password with the other hand.
- Spivak 4y agoDoesn’t FaceID stand an example of this not being the case? I can log into pretty much all of my apps and make purchases with my face. Never once worried about my face being stolen or lost. Until that Mission Impossible tech exists I’m not worried that someone is gonna be able to impersonate me. Biometric auth isn’t “I send a picture of my face over the network and that auths me” but a device a prioiri trusted by the service or the user takes a reading and releases a key. Nobody says that “your hardware configuration is just a username” when taking about TPM security but when it’s wetware suddenly it’s a huge issue.
- generalizations 4y agoAn article on here from last week indicated that tech has existed for decades.
- _8j50 4y agoYou think it is difficult to 3d print your face from a photograph? You can't revoke wetware, doesn't matter what you do on the device. You can take a picture of someone's palm from a mile away and ise their fingerprint to auth as them! https://amp.theguardian.com/technology/2014/dec/30/hacker-fakes-german-ministers-fingerprints-using-photos-of-her-hands https://amp.theguardian.com/technology/2014/dec/30/hacker-fa... 7 years ago too.
- Spivak 4y agoYou don’t revoke the finger, you revoke the machine that wasn’t able to detect the fake.
- _8j50 4y agoThat's just it, you can get as many iphones as you want The threat actor will always be able to fool it once they have your biometric data. Even a human can't tell apart by using a photo if the 3d print is good enough. There will always be a way to mimick wetware.
- gruez 4y ago>Curious, what happens if people lose their arm or eye? How do you recover the account? Let me guess, email? Lol. On iOS you can enroll additional fingers to touchid if you know the passcode. >So all this and you're still a phish away from pwnage! Not possible with 2uf.
- fmajid 4y agoFIDO should only be used as a second factor. U2F keys can and will be lost or stolen. Speaking of which, anyone using U2F keys needs to record which keys were enrolled for which site, and sites should allow multiple keys as well as giving nicknames to them.
- _8j50 4y agoFIDO can and does get used as the only factor auth when people/orgs go passwordless. There are various ways of recovering and having temporary access when losing a key
- fmajid 4y agoI'm less concerned about loss of access than with what happens if your key is stolen and can be used to log in because no password is required. Just pressing a button is not strong enough. Now, Apple/Google/Microsoft implementing Passkeys with proper device authentication is perfectly fine. Perhaps I should have specified "FIDO U2F" rather than just "FIDO".