4 ms·
Two factors are needed: something you have (your device) + something you are (your biometric). If you're concerned about losing your phone (I am), then you can
by ngrilly 3y ago
Two factors are needed: something you have (your device) + something you are (your biometric). If you're concerned about losing your phone (I am), then you can backup your passkeys to the cloud and/or sync them with other devices (with end-to-end encryption of course, so that the backup/sync service has zero knowledge of your passkeys).
- namaria 3y agoAgreed in principle but I'd rather use something I know than let some corporation manage my biometric data.
- ngrilly 3y agoYour biometric data are only used locally to unlock the secure enclave on your devices. Your biometric data never leave your device and are never shared with "some corporation".
- namaria 3y agoYou think that there's data on a networked device that is absolutely safe? I very much doubt that. Besides, if I need a device from "some corporation" to manage my biometric data, I already depend on "some corporation" for my proving who I am online. I'd much rather stick to using a secret only I know and that I can manage with offline databases managed by open source software.
- ngrilly 3y agoDo you use keep your secrets in an offline database that is on a non-networked/air-gapped device?
- deleted 3y ago[deleted]
- namaria 3y agoThat's whataboutism. I'm not claiming my methods are unassailable. I'm disputing the notion that anyone can claim that about their methods. The key difference is, I know the weaknesses on my approach and I mitigate for them. I'm not reaching for whishful thinking. Anyone claiming security by "I don't see an attack vector" should be doubted.
- ngrilly 3y agoAgreed. But then what is the point you were trying to make when asking "You think that there's data on a networked device that is absolutely safe?"?
- namaria 3y agoQuestioning your claim of > Your biometric data never leave your device and are never shared with "some corporation". Like I said, I never claimed my ways are 100% safe. I am questioning the claim that biometrics on phones is 100% safe. You realize you just whatabouted again?
- ngrilly 3y agoYou're moving the goalpost. That conversation started when you explained that you'd rather use something you know than let some corporation manage you biometric data. But it's simply not true that some corporation is managing your biometric. That's why I replied that those systems are designed so that the biometric data don't leave the device. They are only needed locally. Yes, I shouldn't have used the word "never" because the system is probably not perfect and may be hacked. But this is true as well of using an offline password manager that you unlock using something you know (key loggers, etc.). To conclude, I agree that biometrics on phones are probably not 100% safe, like most things in life, and computing.
- nonrandomstring 3y ago> Two factors are needed If two factors are needed. They are not always. Many (indeed most) security situations do not require two factors given the risk tradeoffs. Useful for your bank. Not so much for pizza.
- ngrilly 3y agoThe context was to unlock your passkeys stored on your local device.