4 ms·
His argument proves too much. If he thinks fingerprints are too insecure to be allowed, then he must think the same of low-entropy passwords. Yet I don't see hi
by ggreer 12y ago
His argument proves too much. If he thinks fingerprints are too insecure to be allowed, then he must think the same of low-entropy passwords. Yet I don't see him advocating that Ubuntu force users to choose high-entropy passwords and rotate them regularly. If he's fine letting users choose a low level of security by picking simple passwords, why not also let them choose to auth with fingerprints?
Also, I think he misconstrues the purpose of Touch ID. It's not meant to completely replace passwords.
There are three categories of authentication methods:
1. Something you know (password, combination, challenge responses).
2. Something you have (crypto token, phone, key).
3. Something you are (fingerprint, face, DNA, etc).
Methods can be combined for added security. All three have advantages and disadvantages. Passwords are typically chosen by users, making them weak. Good crypto tokens are hard to copy, but loss or theft can mean getting locked-out. Biometrics are convenient, but can't be revoked. Also, some activities can make them hard to read.[1]
Apple uses all three authentication methods in the iPhone. Touch ID is for basic access. The passcode is for admin-level functionality like erasing or restoring the device. Lastly, physical access to the phone is required to decrypt important data such as Apple Pay's Device Access Numbers. This gives typical, non-technical users a sane combination of security and convenience. If thieves and scammers start copying fingerprints, Apple will change their auth mechanisms.
1. I love Touch ID, but it takes a while to work again after I rock climb or lift weights.
- gldalmaso 12y agoNot disagreeing with you, just going on a tangent and extrapolating the point from the article, the third method group, "something you are" might jump into the "something you have" if it can be extracted or copied from you which might be the case of fingerprints. You are the original source of fingerprint, but you leave copies of it everywhere, so then there are several sources to mimick from and they work just as well on these technologies.
- richmarr 12y ago> Yet I don't see him advocating that Ubuntu force users... He doesn't have to for his point to be valid.
- ggreer 12y agoHe won't allow fingerprint reader support in eCryptfs, yet he has put no effort into adding password complexity rules to eCryptfs.
- sumdeos 12y agoI think part this is the fact that a lower complexity password can always be changed if compromised. If your fingerprint is compromised, you can't just generate a new one.
- higherpurpose 12y agoThere is indeed a high-risk way of doing fingerprint scanning - the way Estonia intends to do it for people who want to become its e-citizens. They want to collect everyone's fingerprints and store them in a centralized database. Good luck with that not being stolen. NSA will probably break into it the same same week it goes online. Having the fingerprints hashes stored in a secure enclave on everyone's devices seems like a much more secure way to deal with fingerprints. The first method is completely unacceptable. The latter is more reasonable.
- marcosdumay 12y agoThe NSA certainly already has the fingerprint of everybody they care about, and probably has of everybody else too. Governments collect fingerprints on several occasions, as do several buildings' security, some mass transit administration, banks, workplaces, and lots of other entities. Also, you live them everywhere anyway.
- diminish 12y ago> 3. Something you are (fingerprint, face, DNA, etc). Add there your mom's maiden name, your parent's names and you get the point; in an authentication system "something you are" must be better used more as user names rather than passwords because users can't change them. Once they're public irrecoverable attacks may happen. There are 3 categories of authentication inputs. (1) Something users can not change (2) Something users can change (3) Something the service owners or system admins can change including time synchronized codes. You better use 1 as usernames, 2 & 3 as passwords.
- _red 12y agoFingerprints can be changed as easily as a username. Simply never use the "raw" fingerprint output of the device, instead XOR it with some key (like either something from factors 2 or 3, or simply a static key).
- Retric 12y agoThat's not changing the fingerprint that's using another password.
- deleted 12y ago[deleted]
- lostcolony 12y agoI'm sure he -does- think low entropy passwords are bad. However, once compromised, those can be changed. That's the point. (Plus, passwords aren't routinely collected and shared by governmental agencies. Just throwing that out there). As you say, with Apple's TouchID, you are actively choosing a less secure method to access your device, for convenience. But...that's also pretty close to what the author said. "Biometrics can be use used as a lightweight, convenient mechanism to establish identity, but they cannot authenticate a person or a thing alone." His point is that for things like system access to a Linux box, or to unencrypt data (eCryptfs, the software he helps maintain), biometrics is far too insecure.
- knorthfield 12y agoI think convenience is important in this comparison because that generates a context in which TouchID is actually more secure, because it's more likely to be used than remembering and typing a passcode/phrase. Apple have shown the usage stats. There is also the inconvenience for attackers of reproducing a fingerprint through an elaborate process, which again makes TouchID more secure (in my opinion) in practice than a password/phrase. While theoretically less secure, I would say TouchID in practice is more secure for average users. But in the case where there is the motivation I would agree with you.
- lostcolony 12y agoRight, and I don't think the author necessarily disagrees with the idea of including TouchID in Apple products as an alternative to 'completely unlocked'. As the author indicates, "This isn't a knock on Apple, as Thinkpad have embedded fingerprint readers for nearly a decade. My intention is to help stop and think about the place of biometrics in security." The danger is viewing biometrics as a secure alternative to passwords; it's not. But comparatively few people are technically inclined enough to realize that; with Apple embracing it for convenience, we run the risk of people not understanding the security implications; the author saw evidence of that when asked to implement biometrics for file encryption, which is a terrible idea.
- 12y ago
- LanceH 12y agoWhy must high entropy passwords be rotated regularly anyway? Shouldn't they only need rotating after a certain number of incorrect logins? Shouldn't that number be decently high?
- ordinary 12y agoRegularly changing your password reduces the impact of an undetected security breach by shortening the maximum amount of time a leaked password remains useful.
- drivingmenuts 12y agoForcing people to regularly change their password means passwords get written down on a Post-it Note on the bottom of the keyboard. Because people are just people, not superhuman remembering machines.