3 ms·

I’m amazed how we have widely available biometrics in the consumer space (anything Apple with TouchID or FaceID) but not in the realm of business where security

I’m amazed how we have widely available biometrics in the consumer space (anything Apple with TouchID or FaceID) but not in the realm of business where security is far more critical. A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago. Feels like this is a solved problem but Microsoft having a monopoly over business computing and software and there being no agreed upon standards for biometrics hardware is holding us back.

scarfaceneo 2y ago
You still need to create a password. And since nearly always the biometric option doesn’t replace the password, it’s a moot point.
- pembrook 2y ago
  But that’s my point. Why use passwords at all. If we’re okay using our face to auth into all mobile apps (business, personal or otherwise) and also to auth into the country every time we fly into it, why not just move towards making it standard.
  - rustcleaner 2y ago
    >If we’re okay using our face to auth I'm not! If this sort of thing becomes standard, I will become digitally amish.
  - n_plus_1_acc 2y ago
    Until you get into an accident and your face is covered in bandages or something and the computer wont let you in.
wmf 2y ago
Windows Hello exists. https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/how-it-works https://learn.microsoft.com/en-us/windows/security/identity-...
thaumasiotes 2y ago
> A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago. Some people prefer that their passwords not be public information.
- Izkata 2y ago
  In the US, passwords are protected by the 5th Amendment. Face and fingerprint are not. Police can make you unlock with those methods with no repercussions.
  - pembrook 2y ago
    Seems like we should update that.
rustcleaner 2y ago
Can we not just make a password prompt which is two 8 digit TOTP codes concatenated together (each having different shared secrets)? Why must we use biometrics, SMS, and proprietary lock-in solutions? Also, the recent Salt Typhoon revelations need to be screaming at you: Chinese intel (and probably others) can likely access SMS codes without hijacking the number, and that it's probably not far out of reach from criminal gangs considering foreign policy jockeying lately. Phone verification is dead. Also, everyone should be adopting something like SimpleX (plus Orbot/Tor) and get away from unencrypted normie networks. If before it was just to reduce metadata footprint because data sells, now it's because you could be vulnerable to international criminal organizations which have access just as intimate as Salt Typhoon to US public comms infrastructure. F***! Odds CISA gets funding cut under new admin? I could use a new job...
hulitu 2y ago
> A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago. Why ? I don't want my picture stored on MS' servers every day.

scarfaceneo 2y ago

You still need to create a password. And since nearly always the biometric option doesn’t replace the password, it’s a moot point.

pembrook 2y ago
But that’s my point. Why use passwords at all. If we’re okay using our face to auth into all mobile apps (business, personal or otherwise) and also to auth into the country every time we fly into it, why not just move towards making it standard.
- rustcleaner 2y ago
  >If we’re okay using our face to auth I'm not! If this sort of thing becomes standard, I will become digitally amish.
- n_plus_1_acc 2y ago
  Until you get into an accident and your face is covered in bandages or something and the computer wont let you in.

wmf 2y ago

Windows Hello exists. https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/how-it-works https://learn.microsoft.com/en-us/windows/security/identity-...

thaumasiotes 2y ago

> A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago. Some people prefer that their passwords not be public information.

Izkata 2y ago
In the US, passwords are protected by the 5th Amendment. Face and fingerprint are not. Police can make you unlock with those methods with no repercussions.
- pembrook 2y ago
  Seems like we should update that.

rustcleaner 2y ago

Can we not just make a password prompt which is two 8 digit TOTP codes concatenated together (each having different shared secrets)? Why must we use biometrics, SMS, and proprietary lock-in solutions? Also, the recent Salt Typhoon revelations need to be screaming at you: Chinese intel (and probably others) can likely access SMS codes without hijacking the number, and that it's probably not far out of reach from criminal gangs considering foreign policy jockeying lately. Phone verification is dead. Also, everyone should be adopting something like SimpleX (plus Orbot/Tor) and get away from unencrypted normie networks. If before it was just to reduce metadata footprint because data sells, now it's because you could be vulnerable to international criminal organizations which have access just as intimate as Salt Typhoon to US public comms infrastructure. F***! Odds CISA gets funding cut under new admin? I could use a new job...

hulitu 2y ago

> A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago. Why ? I don't want my picture stored on MS' servers every day.