12 ms·

>with a fingerprint, a face scan or a screen lock PIN I agree - not secure. And just a daily reminder that biometrics are usernames, they are not passwords. Y

>with a fingerprint, a face scan or a screen lock PIN I agree - not secure. And just a daily reminder that biometrics are usernames, they are not passwords. You can change a password, a lock, a key, you cannot change biometrics, and thus they should not be used for guarding sensitive info. The only use-case for biometrics is deanonymization, sold to you under the auspices of security, primarily used for corporate surveillance.

wepple 3y ago
> The only use-case for biometrics is deanonymization, sold to you under the auspices of security, primarily used for corporate surveillance. Please provide evidence that biometric data has ever been extracted from a major platform (IE Apple/enclave). Absence of evidence != evidence of absence, I know, but you’re selling it as the only use case so surely you have proof.
- johndough 3y ago
  > Please provide evidence that biometric data has ever been extracted from a major platform Why extract it from a platform when it can be extracted easily from the person? Imagine your password was written on every surface you touched (fingerprint) or is prominently displayed on your social media accounts (face).
  - fireflash38 3y ago
    And then extrapolate to how those biometric factors could be changed outside of your control -- car accident requires facial reconstruction. Or a fire burns your fingerprints.
    - jeroenhd 3y ago
      I cut myself on a cheese slicer once and had to use PIN for unlocking my phone for a week or two while the cut healed. Annoying, but that's what the fallback PIN was for I guess.
      - dwaite 3y ago
        Actually, the PIN isn't a fallback - the biometric is just a more convenient option once the PIN is "cached". The biometric doesn't exist until you enter your PIN on restart, which is what unlocks the filesystem (including the biometric profile). You'll also see that you can change your biometric with just your PIN, but you cannot use your biometric to change your PIN.
  - startupsfail 3y ago
    I don’t understand how this could work actually. From a couple of photos on the social media you can likely recover the 3d geometry of the face. From that, if the signing algorithm is known, you should be able to replicate these passkeys. If the algorithm is not known, it’s only a matter of time it’d be leaked or reverse engineered. And then suddenly there’d be a massive, difficult to fix security breach. Just like the breaches that we have now, with voice based authentication. Can someone explain, how this can be mitigated?
    - wepple 3y ago
      That’s not my understanding of how it works. Your face geometry is used to allow access to a secure processor (trustzone/Secure Enclave/etc) which then signs the web token. Which is why the phone is the “something you have” piece of the puzzle here.
      - deleted 3y ago
        [deleted]
    - Scion9066 3y ago
      The biometrics like your face or fingerprints aren't used directly with the site you're trying to log into and would never leave your device. It's just used to unlock your phone/tablet/computer/whatever's stored secrets to sign a message verifying it's you. If you don't trust the biometric systems on your device or are worried about someone stealing them and trying to fool your device's hardware, you can always just not use them and just use a passcode/password to protect your device instead.
      - startupsfail 3y ago
        The problem is not that biometrics are leaking from my device. The problem is that faces are already on the social media. And that the biometrics of the face can be reconstructed extremely easily and at scale. But if this is used only to unlock the trust zone/secrets, I guess that works. It seem to be extremely dependent on the device not getting locked up accidentally, lost or damaged. If a damage would lock you out from all of the accounts, this seems rather drastic.
  - wepple 3y ago
    How does my use of faceID on my iPhone promote de-anonymization if it doesn’t leave my phone? Everything you’ve described can be done whether or not I use biometric to sign into a device, or even own a device?
oli-g 3y ago
> biometrics are usernames, they are not passwords While I see where you're coming from, they really aren't just usernames. It's not like I can log into your e-mail account by typing VoodooJuJu and pressing Enter.
- JohnFen 3y ago
  But most biometrics (at least faces and fingerprints) make terrible passwords. They can be copied and they're very hard to change if you need to.
somedudetbh 3y ago
> And just a daily reminder that biometrics are usernames, they are not passwords. I think you should stop giving out this daily reminder. This meme has outlived its usefulness. Using face id to unlock a local key store to enable my device to sign a signed challenge from a site I want to log into with the private key stored on my device is not a 'username' in any meaningful sense. The problem is, the metaphor about passwords and usernames is not a good, structure-preserving simplification of the actual problem of authentication. The biometric data and/or pin code are not being used to prove that you are you to Gmail, it's being used to unlock the set of private keys you have on your device. This doesn't fit into the metaphor at all. If my non-technical parents said they were migrating all their accounts to passkeys, I would be very pleased. I wouldn't be worried about their inability to change their biometrics and that causing a problem following some sort of breach in the future. I am highly worried about their extreme susceptibility to phishing, especially in their inability to distinguish phishing sites from real sites, or real account maintence contacts via email and SMS from phishing contacts, their reuse of very simple passwords that are probably circulating in combolists already, and their general inability to retain username/password pairs. I have a lot of sympathy for them when I try to talk them through something like logging in to an Apple device with their apple id, when their appleid username is their email, which ends with @gmail.com. "But...why would i log in to apple with my gmail?" nevermind how confused they are about 'log in with google', 'log in with facebook', etc. Moving to a model where their devices store webauthn credentials and guard them with a pin or faceid-style biometric shortcut is a _massive_ improvement in practical resistance to account takeover for my parents, and I don't think continuing to say 'biometrics are usernames in authn' is accurate or helpful.
- latchkey 3y ago
  > If my non-technical parents said they were migrating all their accounts to passkeys, I would be very pleased. I wouldn't be worried about their inability to change their biometrics My 76 yr old dad can't do it. His phone is some shitty android trash that when he's setting up his biometrics, he shakes a bit, and it never stores the finger data correctly. I have to hold his finger and his phone at the same time to even scan it. Then, unlocking is also super unreliable because of the shaking. He refuses to get a better phone cause this one "works well enough."
pcthrowaway 3y ago
Biometrics are shitty usernames too. They might change, it's just outside of your control. My apple touchID never works because I rock climb and I guess that abrades the skin too much
- nilsbunger 3y ago
  i rowed on a crew team for many years. The pads of my fingers were all worn down. I was rejected three times for "bad fingerprints" when applying for US citizenship.
  - JohnFen 3y ago
    It's not as rare as people think for fingerprints to be messed up either permanently or temporarily. Which amazes me, actually, because I'll be willing to be pretty near 100% of adults have, at least once in their lives, burned or otherwise injured their fingers in a way that alters their prints. Relying on fingerprints to gain access to things on a regular basis never seemed like a great idea to me.
akira2501 3y ago
> you cannot change biometrics Bodies are not invulnerable to damage. You can absolutely change your "biometrics", you just probably wouldn't _want_ to.

wepple 3y ago

> The only use-case for biometrics is deanonymization, sold to you under the auspices of security, primarily used for corporate surveillance. Please provide evidence that biometric data has ever been extracted from a major platform (IE Apple/enclave). Absence of evidence != evidence of absence, I know, but you’re selling it as the only use case so surely you have proof.

johndough 3y ago
> Please provide evidence that biometric data has ever been extracted from a major platform Why extract it from a platform when it can be extracted easily from the person? Imagine your password was written on every surface you touched (fingerprint) or is prominently displayed on your social media accounts (face).
- fireflash38 3y ago
  And then extrapolate to how those biometric factors could be changed outside of your control -- car accident requires facial reconstruction. Or a fire burns your fingerprints.
  - jeroenhd 3y ago
    I cut myself on a cheese slicer once and had to use PIN for unlocking my phone for a week or two while the cut healed. Annoying, but that's what the fallback PIN was for I guess.
    - dwaite 3y ago
      Actually, the PIN isn't a fallback - the biometric is just a more convenient option once the PIN is "cached". The biometric doesn't exist until you enter your PIN on restart, which is what unlocks the filesystem (including the biometric profile). You'll also see that you can change your biometric with just your PIN, but you cannot use your biometric to change your PIN.
- startupsfail 3y ago
  I don’t understand how this could work actually. From a couple of photos on the social media you can likely recover the 3d geometry of the face. From that, if the signing algorithm is known, you should be able to replicate these passkeys. If the algorithm is not known, it’s only a matter of time it’d be leaked or reverse engineered. And then suddenly there’d be a massive, difficult to fix security breach. Just like the breaches that we have now, with voice based authentication. Can someone explain, how this can be mitigated?
  - wepple 3y ago
    That’s not my understanding of how it works. Your face geometry is used to allow access to a secure processor (trustzone/Secure Enclave/etc) which then signs the web token. Which is why the phone is the “something you have” piece of the puzzle here.
    - deleted 3y ago
      [deleted]
  - Scion9066 3y ago
    The biometrics like your face or fingerprints aren't used directly with the site you're trying to log into and would never leave your device. It's just used to unlock your phone/tablet/computer/whatever's stored secrets to sign a message verifying it's you. If you don't trust the biometric systems on your device or are worried about someone stealing them and trying to fool your device's hardware, you can always just not use them and just use a passcode/password to protect your device instead.
    - startupsfail 3y ago
      The problem is not that biometrics are leaking from my device. The problem is that faces are already on the social media. And that the biometrics of the face can be reconstructed extremely easily and at scale. But if this is used only to unlock the trust zone/secrets, I guess that works. It seem to be extremely dependent on the device not getting locked up accidentally, lost or damaged. If a damage would lock you out from all of the accounts, this seems rather drastic.
- wepple 3y ago
  How does my use of faceID on my iPhone promote de-anonymization if it doesn’t leave my phone? Everything you’ve described can be done whether or not I use biometric to sign into a device, or even own a device?

oli-g 3y ago

> biometrics are usernames, they are not passwords While I see where you're coming from, they really aren't just usernames. It's not like I can log into your e-mail account by typing VoodooJuJu and pressing Enter.

JohnFen 3y ago
But most biometrics (at least faces and fingerprints) make terrible passwords. They can be copied and they're very hard to change if you need to.

somedudetbh 3y ago

> And just a daily reminder that biometrics are usernames, they are not passwords. I think you should stop giving out this daily reminder. This meme has outlived its usefulness. Using face id to unlock a local key store to enable my device to sign a signed challenge from a site I want to log into with the private key stored on my device is not a 'username' in any meaningful sense. The problem is, the metaphor about passwords and usernames is not a good, structure-preserving simplification of the actual problem of authentication. The biometric data and/or pin code are not being used to prove that you are you to Gmail, it's being used to unlock the set of private keys you have on your device. This doesn't fit into the metaphor at all. If my non-technical parents said they were migrating all their accounts to passkeys, I would be very pleased. I wouldn't be worried about their inability to change their biometrics and that causing a problem following some sort of breach in the future. I am highly worried about their extreme susceptibility to phishing, especially in their inability to distinguish phishing sites from real sites, or real account maintence contacts via email and SMS from phishing contacts, their reuse of very simple passwords that are probably circulating in combolists already, and their general inability to retain username/password pairs. I have a lot of sympathy for them when I try to talk them through something like logging in to an Apple device with their apple id, when their appleid username is their email, which ends with @gmail.com. "But...why would i log in to apple with my gmail?" nevermind how confused they are about 'log in with google', 'log in with facebook', etc. Moving to a model where their devices store webauthn credentials and guard them with a pin or faceid-style biometric shortcut is a _massive_ improvement in practical resistance to account takeover for my parents, and I don't think continuing to say 'biometrics are usernames in authn' is accurate or helpful.

latchkey 3y ago
> If my non-technical parents said they were migrating all their accounts to passkeys, I would be very pleased. I wouldn't be worried about their inability to change their biometrics My 76 yr old dad can't do it. His phone is some shitty android trash that when he's setting up his biometrics, he shakes a bit, and it never stores the finger data correctly. I have to hold his finger and his phone at the same time to even scan it. Then, unlocking is also super unreliable because of the shaking. He refuses to get a better phone cause this one "works well enough."

pcthrowaway 3y ago

Biometrics are shitty usernames too. They might change, it's just outside of your control. My apple touchID never works because I rock climb and I guess that abrades the skin too much

nilsbunger 3y ago
i rowed on a crew team for many years. The pads of my fingers were all worn down. I was rejected three times for "bad fingerprints" when applying for US citizenship.
- JohnFen 3y ago
  It's not as rare as people think for fingerprints to be messed up either permanently or temporarily. Which amazes me, actually, because I'll be willing to be pretty near 100% of adults have, at least once in their lives, burned or otherwise injured their fingers in a way that alters their prints. Relying on fingerprints to gain access to things on a regular basis never seemed like a great idea to me.

akira2501 3y ago

> you cannot change biometrics Bodies are not invulnerable to damage. You can absolutely change your "biometrics", you just probably wouldn't _want_ to.