4 ms·

> biometrics Biometrics are a convenience feature, not a security feature. Fingerprints are trivial to lift and replicate. Face unlocks can be fooled by pict

> biometrics Biometrics are a convenience feature, not a security feature. Fingerprints are trivial to lift and replicate. Face unlocks can be fooled by pictures, or in some cases, get false positives from people that just look enough like you (which is common in some Asian countries). Even if it requires you to blink, new AI tools will easily generate a video of you looking around and blinking. But the worst part about it all, is that biometrics are a password you can't change without surgery. I really REALLY wish "biometrics" would stop coming up as a solution to security.

firejake308 3y ago
Agree with the insights in your comment about biometrics != security, but I'd like to take a moment to nitpick a slight inaccuracy-- Asian faces don't actually look similar to each other, but they do look similar to a person/model that has been trained mostly on white faces. If the facial recognition model had been trained predominantly on Asian faces, then white faces would look similar to each other instead. Reminder that the outputs of AI don't reflect some deeper truth about reality, just an extrapolation of the training data. Garbage in, garbage out.
- justincredible 3y ago
  [dead]
- Affric 3y ago
  > don’t actually look similar to each other I think this should be “more similar than other groups” rather than simply “similar”. Even then I think it’s possible that some groups have more loci with higher diversity for facial features. That’s not even getting to epigenetic and environmental elements. I think the deeper truth is in your final paragraph: facial similarity is in the eye of the beholder.
kube-system 3y ago
Low security is security too. Biometrics can useful when used for appropriate applications. They're very useful in applications where authentication would be otherwise be omitted or undermined due to usability concerns. They can also be used in conjunction with other authentication methods to complement the flaws of other authentication methods, like passphrase or token, which can be shared more easily. Like with many things pertaining to security, there are no universal solutions without first defining the problem. Say for instance, you have an access control system where you want to solve the issue of credentials being intentionally shared. Biometrics are a great solution for this; tokens and passphrases are not. You need different tools for different problems.
jazzyjackson 3y ago
biometrics are used in combination with a specific device. same as a PIN (you can't withdraw money from an ATM with just a PIN, you need the chipped card + your PIN) i can't go up to just any computer and log into my bank with my face you would have to possess my phone and then deepfake me i am comfortable with this security posture because the convenience of face id allows me to use long random passwords with frequent rollover which I never have to type if i lose my phone I can remotely disable it this is all much less of a crime to me than any service that allows password reset over SMS which is a much more well trodden vulnerability.
rootusrootus 3y ago
> Face unlocks can be fooled by pictures Isn't that only Android (and maybe only older models)? Doesn't iOS use a LIDAR sensor instead of the camera?
- alternatex 3y ago
  Correct. Depending on the phone, on Android the face unlock will not work with a 2D image. Perhaps only on cheaper phones. On Windows for example you can't even have face unlock without a sensor that will provide 3D details so most laptops don't support Windows Hello.

firejake308 3y ago

Agree with the insights in your comment about biometrics != security, but I'd like to take a moment to nitpick a slight inaccuracy-- Asian faces don't actually look similar to each other, but they do look similar to a person/model that has been trained mostly on white faces. If the facial recognition model had been trained predominantly on Asian faces, then white faces would look similar to each other instead. Reminder that the outputs of AI don't reflect some deeper truth about reality, just an extrapolation of the training data. Garbage in, garbage out.

justincredible 3y ago
[dead]
Affric 3y ago
> don’t actually look similar to each other I think this should be “more similar than other groups” rather than simply “similar”. Even then I think it’s possible that some groups have more loci with higher diversity for facial features. That’s not even getting to epigenetic and environmental elements. I think the deeper truth is in your final paragraph: facial similarity is in the eye of the beholder.

kube-system 3y ago

Low security is security too. Biometrics can useful when used for appropriate applications. They're very useful in applications where authentication would be otherwise be omitted or undermined due to usability concerns. They can also be used in conjunction with other authentication methods to complement the flaws of other authentication methods, like passphrase or token, which can be shared more easily. Like with many things pertaining to security, there are no universal solutions without first defining the problem. Say for instance, you have an access control system where you want to solve the issue of credentials being intentionally shared. Biometrics are a great solution for this; tokens and passphrases are not. You need different tools for different problems.

jazzyjackson 3y ago

biometrics are used in combination with a specific device. same as a PIN (you can't withdraw money from an ATM with just a PIN, you need the chipped card + your PIN) i can't go up to just any computer and log into my bank with my face you would have to possess my phone and then deepfake me i am comfortable with this security posture because the convenience of face id allows me to use long random passwords with frequent rollover which I never have to type if i lose my phone I can remotely disable it this is all much less of a crime to me than any service that allows password reset over SMS which is a much more well trodden vulnerability.

rootusrootus 3y ago

> Face unlocks can be fooled by pictures Isn't that only Android (and maybe only older models)? Doesn't iOS use a LIDAR sensor instead of the camera?

alternatex 3y ago
Correct. Depending on the phone, on Android the face unlock will not work with a 2D image. Perhaps only on cheaper phones. On Windows for example you can't even have face unlock without a sensor that will provide 3D details so most laptops don't support Windows Hello.