3 ms·

> What "biometric-facilitated transactions" are these? Aside from fingerprint unlock on phones, I'm struggling to come up with cases where fingerprints are used

by ehnto 4y ago

> What "biometric-facilitated transactions" are these? Aside from fingerprint unlock on phones, I'm struggling to come up with cases where fingerprints are used to secure sensitive information. Phones have become people's defacto computing device, that they link to all kinds of personal, private, and governmental accounts. Medicare, councils, state accounts, bank details, taxes, private chats, private images and videos, work accounts, work documents, work chats, group memberships, on and on. Think of any sensitive information possible, someone is storing it on their phone. Most people have their phone as the center of their information technology worlds. If access to that isn't concerning then there isn't much else that could change your mind I don't think.

2devnull 4y ago
> Most people have their phone as the center of their information technology worlds. Those people are foolish. Putting all your eggs in one basket and then whining about the consequences is a sign of bad character. Besides that it’s pretty irrelevant to the topic at hand, which is whether fingerprint readers are an acceptable means of securing digital transactions. In fact you seem to be suggesting they are, by proxy.
- ehnto 4y ago
  Any one of those accounts is sensitive, even if you just had one it should be protected. But also, in matters of policy we don't really care about someone's character, we care about how it impacts everyone. Since everyone has a phone now, that means technologically illiterate people are using them for whatever their authority figures tell them to. They trust those entities, and perhaps they shouldn't, but that is the reality. Any policy that doesn't cater for the reality is bad policy. Smoking is a historical example, at one point doctors, movie stars and media all told you smoking was good for you. Now, decades later, health policy has to take into account that people smoke. Maybe one day down the line there will be regulation on companies as to how they influence people to use their devices, but for now we accept that people put sensitive info on their phones.
gruez 4y ago
My claim isn't that your phone doesn't contain sensitive information, or that a stolen fingerprint image can be used to unlock your phone, it's that the attack is very unlikely to be carried out, scales poorly (you need physical access to the phone), and there are a dozen other ways of obtaining the same result (ie. lifting the fingerprint off the phone or a nearby object). It's not as simple as hacking into the HR system's fingerprint database and you get all the employees' dickpicks at your fingertips.
- ehnto 4y ago
  It would work the other way around I think, steal someone's phone then look it up on the database. But you're right, it's not the vector I would be most worried about either.

by ehnto 4y ago

2devnull 4y ago

> Most people have their phone as the center of their information technology worlds. Those people are foolish. Putting all your eggs in one basket and then whining about the consequences is a sign of bad character. Besides that it’s pretty irrelevant to the topic at hand, which is whether fingerprint readers are an acceptable means of securing digital transactions. In fact you seem to be suggesting they are, by proxy.

ehnto 4y ago
Any one of those accounts is sensitive, even if you just had one it should be protected. But also, in matters of policy we don't really care about someone's character, we care about how it impacts everyone. Since everyone has a phone now, that means technologically illiterate people are using them for whatever their authority figures tell them to. They trust those entities, and perhaps they shouldn't, but that is the reality. Any policy that doesn't cater for the reality is bad policy. Smoking is a historical example, at one point doctors, movie stars and media all told you smoking was good for you. Now, decades later, health policy has to take into account that people smoke. Maybe one day down the line there will be regulation on companies as to how they influence people to use their devices, but for now we accept that people put sensitive info on their phones.

gruez 4y ago

My claim isn't that your phone doesn't contain sensitive information, or that a stolen fingerprint image can be used to unlock your phone, it's that the attack is very unlikely to be carried out, scales poorly (you need physical access to the phone), and there are a dozen other ways of obtaining the same result (ie. lifting the fingerprint off the phone or a nearby object). It's not as simple as hacking into the HR system's fingerprint database and you get all the employees' dickpicks at your fingertips.

ehnto 4y ago
It would work the other way around I think, steal someone's phone then look it up on the database. But you're right, it's not the vector I would be most worried about either.