6 ms·

One possibility for using biometric data is enabling passwordless sign-ins. No, in both android and ios biometric data is never given to the app for touchid/fa

One possibility for using biometric data is enabling passwordless sign-ins. No, in both android and ios biometric data is never given to the app for touchid/faceid. It just notifies the app if the authentication passed/failed. So they would never need biometric data to enable biometric authentication.

hef19898 3y ago
Well, Twitter doesn't need it, but they clearly want it! I do see synergies so in case Tesla goes 100% key-less...
- polski-g 3y ago
  Is it going to end up like this? https://www.youtube.com/watch?v=wjnLYuezGm0 https://www.youtube.com/watch?v=wjnLYuezGm0 https://www.youtube.com/watch?v=-6STtU4vEA4 https://www.youtube.com/watch?v=-6STtU4vEA4
  - pilsetnieks 3y ago
    End up? If you listen to the podcast, you'll know that the episode was inspired by actual already happened real life events. In fact the real story was even more infuriating. https://jalopnik.com/dennis-from-always-sunny-got-his-tesla-stuck-in-a-parki-1849682811 https://jalopnik.com/dennis-from-always-sunny-got-his-tesla-...
    - hef19898 3y ago
      Needing the cloud to connect your keys, keyless entry or not, to ypur car (which idealy is an embedded system anyway than works fine without any server connection) is just stupid...
40yearoldman 3y ago
I really dislike how you jumped some conclusions on implementation. Nobody has any clue how they will gather this data or even if it is for android or iOS. It could be part of the X phone. X could use the camera and implement their own face unlock for X. X could use voice.
- callalex 3y ago
  Can I see the announcement for this phone? Or is that also coming “early next year”?
  - 40yearoldman 3y ago
    Nobody said there was a X phone. I was just giving alternatives to the probably wrong assumption that Android and apples biometrics are the only ways password less login could be implemented.
- notyourwork 3y ago
  X phone? Twitter becomes X and now makes phones? What world am I living in?
  - TX81Z 3y ago
    A world in which Blue Checks have replaced MAGA hats.
  - Arrath 3y ago
    Edging ever and ever closer to E(vil) Corp.
  - numpad0 3y ago
    They do have abilities to build and ship a Microsoft Kin though.
    - meepmorp 3y ago
      Oh wow, the Kin. That's a deep cut.
  - rsynnott 3y ago
    This is your mind on Musk. (Though, I think there actually _was_ a short-lived Twitter-branded phone, back in the day... Anyone remember this? Am I totally imagining it?)
andsoitis 3y ago
> No, in both android and ios biometric data is never given to the app for touchid/faceid. …Controlled by Apple and Google.
- traceroute66 3y ago
  > …Controlled by Apple and Google. FFS ! Pure FUD and you know it. I don't know about Google, but with Apple, the data necessary to validate the fingerprint is stored on the device's secure enclave[1]. Its not readable by apps on the device, let alone Apple ! (I imagine Google devices are the same, I just said "don't know" because I don't have the first-hand knowldege). [1] https://support.apple.com/en-us/HT204587 https://support.apple.com/en-us/HT204587
  - Nullabillity 3y ago
    [flagged]
    - umanghere 3y ago
      I don’t mean to sound argumentative, but that’s a knee jerk response. It’s possible to reverse engineer the OS code to verify that the biometrics indeed end up on the SEP’s encrypted storage, and several people have done this in the past. Here’s an excellent presentation on the SEP, found by just a simple Google search. [0] [0]: https://www.blackhat.com/docs/us-16/materials/us-16-Mandt-Demystifying-The-Secure-Enclave-Processor.pdf https://www.blackhat.com/docs/us-16/materials/us-16-Mandt-De...
      - croes 3y ago
        But couldn't Apple release an update at any time that would allow access to the data?
        HPsquared 3y ago
        In that case, biometric data is probably the least of your worries.
xg15 3y ago
Exactly. Wasn't the whole point of passkeys that all the user-facing authentication happens on the device and all the server gets to see is a signature?
chubot 3y ago
Also, Twitter already did this bait and switch. https://www.cnet.com/news/social-media/twitter-to-pay-150-million-fine-over-using-phone-numbers-for-targeted-ads/ https://www.cnet.com/news/social-media/twitter-to-pay-150-mi... Twitter to Pay $150 Million Fine Over Using Phone Numbers for Targeted Ads FTC says personal data collected by Twitter for security purposes was also used for targeted advertising. Fool me once, ...
- orzig 3y ago
  To be fair, the odds that the people behind that are still at the company are <<50% I think that the better base rate would be stories from Tesla, etc. Of which I imagine there are many (I don't have time to keep up with specifics)
  - mikestew 3y ago
    To be fair, the odds that the people behind that are still at the company are <<50% IOW, if any lessons were learned, the folks that learned those lessons have a >50% chance utilizing what they learned at another company. So, yeah, expect the bait-and-switch.
lfmunoz4 3y ago
Does this mean apple have your biometric data or is it kept on phone?
- Arcanum-XIII 3y ago
  Only on the phone, non accessible.
- lvillani 3y ago
  It is only kept on the device. Sources: - https://www.apple.com/business-docs/FaceID_Security_Guide.pdf https://www.apple.com/business-docs/FaceID_Security_Guide.pd... - https://support.apple.com/en-us/HT204587 https://support.apple.com/en-us/HT204587 - https://support.apple.com/guide/security/welcome/web https://support.apple.com/guide/security/welcome/web

hef19898 3y ago

Well, Twitter doesn't need it, but they clearly want it! I do see synergies so in case Tesla goes 100% key-less...

polski-g 3y ago
Is it going to end up like this? https://www.youtube.com/watch?v=wjnLYuezGm0 https://www.youtube.com/watch?v=wjnLYuezGm0 https://www.youtube.com/watch?v=-6STtU4vEA4 https://www.youtube.com/watch?v=-6STtU4vEA4
- pilsetnieks 3y ago
  End up? If you listen to the podcast, you'll know that the episode was inspired by actual already happened real life events. In fact the real story was even more infuriating. https://jalopnik.com/dennis-from-always-sunny-got-his-tesla-stuck-in-a-parki-1849682811 https://jalopnik.com/dennis-from-always-sunny-got-his-tesla-...
  - hef19898 3y ago
    Needing the cloud to connect your keys, keyless entry or not, to ypur car (which idealy is an embedded system anyway than works fine without any server connection) is just stupid...

40yearoldman 3y ago

I really dislike how you jumped some conclusions on implementation. Nobody has any clue how they will gather this data or even if it is for android or iOS. It could be part of the X phone. X could use the camera and implement their own face unlock for X. X could use voice.

callalex 3y ago
Can I see the announcement for this phone? Or is that also coming “early next year”?
- 40yearoldman 3y ago
  Nobody said there was a X phone. I was just giving alternatives to the probably wrong assumption that Android and apples biometrics are the only ways password less login could be implemented.
notyourwork 3y ago
X phone? Twitter becomes X and now makes phones? What world am I living in?
- TX81Z 3y ago
  A world in which Blue Checks have replaced MAGA hats.
- Arrath 3y ago
  Edging ever and ever closer to E(vil) Corp.
- numpad0 3y ago
  They do have abilities to build and ship a Microsoft Kin though.
  - meepmorp 3y ago
    Oh wow, the Kin. That's a deep cut.
- rsynnott 3y ago
  This is your mind on Musk. (Though, I think there actually _was_ a short-lived Twitter-branded phone, back in the day... Anyone remember this? Am I totally imagining it?)

andsoitis 3y ago

> No, in both android and ios biometric data is never given to the app for touchid/faceid. …Controlled by Apple and Google.

traceroute66 3y ago
> …Controlled by Apple and Google. FFS ! Pure FUD and you know it. I don't know about Google, but with Apple, the data necessary to validate the fingerprint is stored on the device's secure enclave[1]. Its not readable by apps on the device, let alone Apple ! (I imagine Google devices are the same, I just said "don't know" because I don't have the first-hand knowldege). [1] https://support.apple.com/en-us/HT204587 https://support.apple.com/en-us/HT204587
- Nullabillity 3y ago
  [flagged]
  - umanghere 3y ago
    I don’t mean to sound argumentative, but that’s a knee jerk response. It’s possible to reverse engineer the OS code to verify that the biometrics indeed end up on the SEP’s encrypted storage, and several people have done this in the past. Here’s an excellent presentation on the SEP, found by just a simple Google search. [0] [0]: https://www.blackhat.com/docs/us-16/materials/us-16-Mandt-Demystifying-The-Secure-Enclave-Processor.pdf https://www.blackhat.com/docs/us-16/materials/us-16-Mandt-De...
    - croes 3y ago
      But couldn't Apple release an update at any time that would allow access to the data?
      - HPsquared 3y ago
        In that case, biometric data is probably the least of your worries.

xg15 3y ago

Exactly. Wasn't the whole point of passkeys that all the user-facing authentication happens on the device and all the server gets to see is a signature?

chubot 3y ago

Also, Twitter already did this bait and switch. https://www.cnet.com/news/social-media/twitter-to-pay-150-million-fine-over-using-phone-numbers-for-targeted-ads/ https://www.cnet.com/news/social-media/twitter-to-pay-150-mi... Twitter to Pay $150 Million Fine Over Using Phone Numbers for Targeted Ads FTC says personal data collected by Twitter for security purposes was also used for targeted advertising. Fool me once, ...

orzig 3y ago
To be fair, the odds that the people behind that are still at the company are <<50% I think that the better base rate would be stories from Tesla, etc. Of which I imagine there are many (I don't have time to keep up with specifics)
- mikestew 3y ago
  To be fair, the odds that the people behind that are still at the company are <<50% IOW, if any lessons were learned, the folks that learned those lessons have a >50% chance utilizing what they learned at another company. So, yeah, expect the bait-and-switch.

lfmunoz4 3y ago

Does this mean apple have your biometric data or is it kept on phone?

Arcanum-XIII 3y ago
Only on the phone, non accessible.
lvillani 3y ago
It is only kept on the device. Sources: - https://www.apple.com/business-docs/FaceID_Security_Guide.pdf https://www.apple.com/business-docs/FaceID_Security_Guide.pd... - https://support.apple.com/en-us/HT204587 https://support.apple.com/en-us/HT204587 - https://support.apple.com/guide/security/welcome/web https://support.apple.com/guide/security/welcome/web