3 ms·
> The only use-case for biometrics is deanonymization, sold to you under the auspices of security, primarily used for corporate surveillance. Please provide ev
by wepple 3y ago
> The only use-case for biometrics is deanonymization, sold to you under the auspices of security, primarily used for corporate surveillance.
Please provide evidence that biometric data has ever been extracted from a major platform (IE Apple/enclave). Absence of evidence != evidence of absence, I know, but you’re selling it as the only use case so surely you have proof.
- johndough 3y ago> Please provide evidence that biometric data has ever been extracted from a major platform Why extract it from a platform when it can be extracted easily from the person? Imagine your password was written on every surface you touched (fingerprint) or is prominently displayed on your social media accounts (face).
- fireflash38 3y agoAnd then extrapolate to how those biometric factors could be changed outside of your control -- car accident requires facial reconstruction. Or a fire burns your fingerprints.
- jeroenhd 3y agoI cut myself on a cheese slicer once and had to use PIN for unlocking my phone for a week or two while the cut healed. Annoying, but that's what the fallback PIN was for I guess.
- dwaite 3y agoActually, the PIN isn't a fallback - the biometric is just a more convenient option once the PIN is "cached". The biometric doesn't exist until you enter your PIN on restart, which is what unlocks the filesystem (including the biometric profile). You'll also see that you can change your biometric with just your PIN, but you cannot use your biometric to change your PIN.
- startupsfail 3y agoI don’t understand how this could work actually. From a couple of photos on the social media you can likely recover the 3d geometry of the face. From that, if the signing algorithm is known, you should be able to replicate these passkeys. If the algorithm is not known, it’s only a matter of time it’d be leaked or reverse engineered. And then suddenly there’d be a massive, difficult to fix security breach. Just like the breaches that we have now, with voice based authentication. Can someone explain, how this can be mitigated?
- wepple 3y agoThat’s not my understanding of how it works. Your face geometry is used to allow access to a secure processor (trustzone/Secure Enclave/etc) which then signs the web token. Which is why the phone is the “something you have” piece of the puzzle here.
- deleted 3y ago[deleted]
- Scion9066 3y agoThe biometrics like your face or fingerprints aren't used directly with the site you're trying to log into and would never leave your device. It's just used to unlock your phone/tablet/computer/whatever's stored secrets to sign a message verifying it's you. If you don't trust the biometric systems on your device or are worried about someone stealing them and trying to fool your device's hardware, you can always just not use them and just use a passcode/password to protect your device instead.
- startupsfail 3y agoThe problem is not that biometrics are leaking from my device. The problem is that faces are already on the social media. And that the biometrics of the face can be reconstructed extremely easily and at scale. But if this is used only to unlock the trust zone/secrets, I guess that works. It seem to be extremely dependent on the device not getting locked up accidentally, lost or damaged. If a damage would lock you out from all of the accounts, this seems rather drastic.
- wepple 3y agoHow does my use of faceID on my iPhone promote de-anonymization if it doesn’t leave my phone? Everything you’ve described can be done whether or not I use biometric to sign into a device, or even own a device?