4 ms·

Just give me password auth back. I work in a lab that requires fingerprint login (TrustKey FIDO keys) with no fallback. Every 6-8 weeks I need to have my keys

by nly 4y ago

Just give me password auth back. I work in a lab that requires fingerprint login (TrustKey FIDO keys) with no fallback. Every 6-8 weeks I need to have my keys reset with new prints, which is a process that involves meeting a member of the security team in a room for 20 minutes so my key and the backup key (kept in a safe by the firm) can both be reset. Everyday, without fail, I sit there like a chimp taking on average 2 minutes to unlock my workstation. This happens maybe 5 times per day.

rwmj 4y ago
How does that work for people with poor/unreadable fingerprints? We're 3% of the general population apparently.
- brazzy 4y ago
  A sane setup would provide an alternative to unlock the passkey, with a PIN. Yes, you're back to entering a password, but you don't have most of the weaknesses and pitfalls of password-based logins in distributed systems (phishing,credential stuffing,keyloggers probably a few others).
  - deleted 4y ago
    [deleted]
pinkcan 4y ago
It's a ceremony, it's ego stroking.
freeone3000 4y ago
Do they expect your fingerprints to have changed?
- swiftcoder 4y ago
  Unfortunately, fingerprints do change. Cut your thumb slicing tomatoes? Have fun logging in for the next few days. Took up a fun new hobby, like, say, blacksmithing, or ceramic sculpture? Say permanent goodbye to your fingerprints ever scanning correctly again...
  - MereInterest 4y ago
    Any time I use shellac as a wood finish, I get a layer of shellac on top of all my fingers. There’s no way the fingerprint scanning would work after that.
    - 007asdflkjsfd 4y ago
      happily for you, you have the problem AND the solution! next time, (besides using gloves for once) drop a blob of shellac on a shallow container with flexible sides (silicone or any flimsy bottle cap). After a few hours, take off gloves and thumbprint for several minutes with very light pressure on the blob of shellac. after another few hours, tie some nylon ties to the side of the container and tighten every now and then so that the end result is a convex plane with your finger prints. you want it slight convex but still mostly plane. Done. now wait for that to dry. apply some harder finishing synthetic laqueur to preserve it longer. just keep that in your pocket and you will be able to unlock most phones. note that some phones (correctly) do not mirror your prints, thought most do for some reason... for those you will have to first cast you prints and then cast the reusable token. which make getting a convex token in the end easier tho... but for the dozen of devices i've tested, they all mirror just fine. ... and that's reason #1239090 why using biometrics as passwords are a really stupid idea. it's only good for convenience shortcuts, so fine on phones, bad on anything else.
      - brookst 4y ago
        https://www.livescience.com/62393-dead-fingerprint-unlock-phone.html https://www.livescience.com/62393-dead-fingerprint-unlock-ph...
        doodlesdev 4y ago
        I believe this does not apply to ultrasound-based fingerprint sensors like the ones we have below the screen on Samsung's [0]. Not sure how other manufacturers are doing their fingerprint scanning nowadays. [0]: https://www.cnet.com/tech/mobile/galaxy-s10-has-ultrasonic-fingerprint-scanner-heres-why-you-should-care-explainer/ https://www.cnet.com/tech/mobile/galaxy-s10-has-ultrasonic-f...
- thecopy 4y ago
  As a climber: Yes. My MacBook TouchID stops working on days i climb.
CatWChainsaw 4y ago
None of these newer solutions do anything but convince me that passwords are the democracy of authentication - the least bad of several bad options. But hey, things are going to become so secure that nobody can get into anything anymore, so I guess that's a win. :)
ad404b8a372f2b9 4y ago
Oh how I wish we could get password auth back everywhere. We're working towards 6FA, they have to know your backup email address, your phone number, your location, your device, your security question. At some point security is a trade-off with convenience, I have a randomly generated >20 characters password that I use only for gmail but right now I'm in the hospital and they won't accept it because I'm not on my usual device and I didn't activate 2FA ... because it's exactly the kind of problem I wanted to avoid. I know users reuse passwords, I don't, let me use my god damn password. And my password vault is on my google drive ... someone come euthanize me please.
stavros 4y ago
This has nothing to do with the standard and everything to do with your lab, though.

by nly 4y ago

rwmj 4y ago

How does that work for people with poor/unreadable fingerprints? We're 3% of the general population apparently.

brazzy 4y ago
A sane setup would provide an alternative to unlock the passkey, with a PIN. Yes, you're back to entering a password, but you don't have most of the weaknesses and pitfalls of password-based logins in distributed systems (phishing,credential stuffing,keyloggers probably a few others).
- deleted 4y ago
  [deleted]

pinkcan 4y ago

It's a ceremony, it's ego stroking.

freeone3000 4y ago

Do they expect your fingerprints to have changed?

swiftcoder 4y ago
Unfortunately, fingerprints do change. Cut your thumb slicing tomatoes? Have fun logging in for the next few days. Took up a fun new hobby, like, say, blacksmithing, or ceramic sculpture? Say permanent goodbye to your fingerprints ever scanning correctly again...
- MereInterest 4y ago
  Any time I use shellac as a wood finish, I get a layer of shellac on top of all my fingers. There’s no way the fingerprint scanning would work after that.
  - 007asdflkjsfd 4y ago
    happily for you, you have the problem AND the solution! next time, (besides using gloves for once) drop a blob of shellac on a shallow container with flexible sides (silicone or any flimsy bottle cap). After a few hours, take off gloves and thumbprint for several minutes with very light pressure on the blob of shellac. after another few hours, tie some nylon ties to the side of the container and tighten every now and then so that the end result is a convex plane with your finger prints. you want it slight convex but still mostly plane. Done. now wait for that to dry. apply some harder finishing synthetic laqueur to preserve it longer. just keep that in your pocket and you will be able to unlock most phones. note that some phones (correctly) do not mirror your prints, thought most do for some reason... for those you will have to first cast you prints and then cast the reusable token. which make getting a convex token in the end easier tho... but for the dozen of devices i've tested, they all mirror just fine. ... and that's reason #1239090 why using biometrics as passwords are a really stupid idea. it's only good for convenience shortcuts, so fine on phones, bad on anything else.
    - brookst 4y ago
      https://www.livescience.com/62393-dead-fingerprint-unlock-phone.html https://www.livescience.com/62393-dead-fingerprint-unlock-ph...
      - doodlesdev 4y ago
        I believe this does not apply to ultrasound-based fingerprint sensors like the ones we have below the screen on Samsung's [0]. Not sure how other manufacturers are doing their fingerprint scanning nowadays. [0]: https://www.cnet.com/tech/mobile/galaxy-s10-has-ultrasonic-fingerprint-scanner-heres-why-you-should-care-explainer/ https://www.cnet.com/tech/mobile/galaxy-s10-has-ultrasonic-f...
thecopy 4y ago
As a climber: Yes. My MacBook TouchID stops working on days i climb.

CatWChainsaw 4y ago

None of these newer solutions do anything but convince me that passwords are the democracy of authentication - the least bad of several bad options. But hey, things are going to become so secure that nobody can get into anything anymore, so I guess that's a win. :)

ad404b8a372f2b9 4y ago

Oh how I wish we could get password auth back everywhere. We're working towards 6FA, they have to know your backup email address, your phone number, your location, your device, your security question. At some point security is a trade-off with convenience, I have a randomly generated >20 characters password that I use only for gmail but right now I'm in the hospital and they won't accept it because I'm not on my usual device and I didn't activate 2FA ... because it's exactly the kind of problem I wanted to avoid. I know users reuse passwords, I don't, let me use my god damn password. And my password vault is on my google drive ... someone come euthanize me please.

stavros 4y ago

This has nothing to do with the standard and everything to do with your lab, though.