4 ms·

I'd like my phone to ask for some pin or my fingerprint when I want to login something. No username, password or anything. Like bluetooth pairing, I'd pair my p

by eknkc 13y ago

I'd like my phone to ask for some pin or my fingerprint when I want to login something. No username, password or anything. Like bluetooth pairing, I'd pair my phone with services that I register and they could trigger my phone to ask my confirmation.

willvarfar 13y ago
This is at the top of HN right now: https://news.ycombinator.com/item?id=6722292 https://news.ycombinator.com/item?id=6722292 And here's a -fun- / alarming story of someone I know, which I wrote up on my blog: http://williamedwardscoder.tumblr.com/post/24949768311/i-know-someone-whose-2-factor-phone-authentication-was http://williamedwardscoder.tumblr.com/post/24949768311/i-kno... I'm not dismissing what you say, I'm saying that alternatives don't look much better right now.
bigiain 13y ago
That sounds just like TOTP. I use Google Authenticator on iOS and Android. It's just a standards-compliant (RFC 6238) TOTP app, not anything Google specific. I've got six logins using it - gmail, Dropbox, Amazon (AWS), Github, Digital Ocean, and an internal service. One thing that is a bit badly done - and I understand why - is making it easy to have "redundant duplicates". When setting up a new TOTP three factor auth account, I need to get my iPhone, iPad, and Android phone all together and manually type in the seeds (or QR code them) to all three to ensure I'm not completely screwed if I lose the only device with the magic tokens… I'd love to have more of my important stuff secured with TFA/TOTP.
cottonseed 13y ago
What's the difference between a pin and a password? I think the solution is public key cryptography. See my other reply. However, I don't want my private keys stored on a computer or phone, since they can be stolen. I want to store they keys on a frob (USB key, wireless doodad, whatever) that signs messages with private keys but can't be accessed directly. This frob would be protected with a password or PIN of some kind. The frob should display the requested confirmation (Log into Hacker News as cottonseed? Yes/No) and require direct confirmation. This is, for example, the architecture people using for bitcoin hardware wallets, where the potential cost of failed security is very high.
brymaster 13y ago
No, fingerprints are only suitable as a unique ID and not a password. You leave your fingerprint everywhere you touch and that cannot be changed. http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...

by eknkc 13y ago

willvarfar 13y ago

This is at the top of HN right now: https://news.ycombinator.com/item?id=6722292 https://news.ycombinator.com/item?id=6722292 And here's a -fun- / alarming story of someone I know, which I wrote up on my blog: http://williamedwardscoder.tumblr.com/post/24949768311/i-know-someone-whose-2-factor-phone-authentication-was http://williamedwardscoder.tumblr.com/post/24949768311/i-kno... I'm not dismissing what you say, I'm saying that alternatives don't look much better right now.

bigiain 13y ago

That sounds just like TOTP. I use Google Authenticator on iOS and Android. It's just a standards-compliant (RFC 6238) TOTP app, not anything Google specific. I've got six logins using it - gmail, Dropbox, Amazon (AWS), Github, Digital Ocean, and an internal service. One thing that is a bit badly done - and I understand why - is making it easy to have "redundant duplicates". When setting up a new TOTP three factor auth account, I need to get my iPhone, iPad, and Android phone all together and manually type in the seeds (or QR code them) to all three to ensure I'm not completely screwed if I lose the only device with the magic tokens… I'd love to have more of my important stuff secured with TFA/TOTP.

cottonseed 13y ago

What's the difference between a pin and a password? I think the solution is public key cryptography. See my other reply. However, I don't want my private keys stored on a computer or phone, since they can be stolen. I want to store they keys on a frob (USB key, wireless doodad, whatever) that signs messages with private keys but can't be accessed directly. This frob would be protected with a password or PIN of some kind. The frob should display the requested confirmation (Log into Hacker News as cottonseed? Yes/No) and require direct confirmation. This is, for example, the architecture people using for bitcoin hardware wallets, where the potential cost of failed security is very high.

brymaster 13y ago

No, fingerprints are only suitable as a unique ID and not a password. You leave your fingerprint everywhere you touch and that cannot be changed. http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...