9 ms·
It’s actually worse than that - AI powered phishing sites will also copy your device profile and mouse, gesture and keyboard signature and use this to get past
by darefalcon 2y ago
It’s actually worse than that - AI powered phishing sites will also copy your device profile and mouse, gesture and keyboard signature and use this to get past common anti-fraud techniques like device fingerprinting and behavioural biometrics.
- advael 2y agoI mean, the mere existence of said biometrics imply that they're inferrable and thus bad security, like basically all biometrics
- sroussey 2y agoAnd yet, used extensively
- advael 2y agoI mean SSNs are the worst possible authentication mechanism and yet we still have to freak out every time they're leaked. Security practices are so utterly backwards everywhere that it's quite apparent no one powerful is incentivised to care even a little bit
- jimmaswell 2y agowhat's the practical alternative?
- immibis 2y agoScanning your digital ID card would be a start, but oHnO that's cOmmUniSM!
- bryanrasmussen 2y agopickpocket's paradise!
- vincnetas 2y agoBut it's not so scalable as online connected DB.
- reginald78 2y agoWouldn't this just result in my digitalid getting lost in the next equifax breech?
- immibis 2y agoDid your credit card get lost in the last one?
- reginald78 2y agoHow would I know one way or the other if it had? I don't have the same number anymore.
- advael 2y agoNot pretending a GUID constitutes a security measure in the first place? It's just not the right tool for the job in any sense
- mnau 2y agoDigital id card for every citizen? My id card can prove identity or sign a document and could for ~10 years. Estonia had it for over 20 years. Just give it to everyone. Today, it can likely be embedded in a cell phone instead of separate physical card.
- Kiro 2y agoWhat do you mean? I don't know of any country except the US where SSN is used for authentication. In my country SSN is public information.
- TechDebtDevin 2y agoWhen I call my bank they verify with my voice. There are further verification for meaningful actions but its still kind of crazy to be using "My Voice is my Password" this day in age.
- AlotOfReading 2y agoBetter than my bank, which tries to ask questions about my life from some lookup service that has incorrect information.
- reginald78 2y agoEspecially since "My Voice is my Passport" was defeated in that movie with a tape recorder and technology at the time. It was never a good idea and even the movie didn't seem to think so. Yet my bank just turned this on for me as well in 2024. Now I have to figure out how to disable it...and will it really be disabled?
- bryanrasmussen 2y agobasically everything that retains the same structure between two occurrences can be inferred. Only randomness cannot be inferred. But true randomness is not useful for determining if you are who you say you are.
- advael 2y agoEven a password can be changed if there's a compromise. Biometrics are bad because they can be imitated, but not changed. A breach is permanent
- bryanrasmussen 2y agogood point, but that was left out of the earlier statement about inference. I suppose I should have inferred it however.
- advael 2y agoYea, my bad I guess. I tend to think people mostly get that biometrics are, well, mostly immutable and that not being able to switch them up in response to a suspected breach is a huge inherent weakness. So the only defense I really get of them from anyone is that the effort for the user is minimized while the effort for the attacker is still fairly high. The problem with that is why I mention inferrability: The existence of a computer system that can authenticate via a biometric implies the existence of one that can capture and spoof it, and we don't have any reason to believe this involves, say, more of a cost disparity than cracking a password, let alone anything approaching a strong one-way function. If your face is your key, do you start hiding your face on the street so no one can steal it? Same thing for behaviorals
- chefandy 2y agoI think this is one of those "the only thing that's worse is everything else" situations. Surely there are solutions, but I doubt there are solutions banks and payment processors would be interested in paying for, and at least the US government isn't particularly interested in compelling banks to do anything expensive.
- coffeebeqn 2y agoWhat does AI have to do with capturing inputs ?
- orbital-decay 2y agoNot just capturing, but training on captured inputs to replicate the fingerprint.