3 ms·

I'm sure he -does- think low entropy passwords are bad. However, once compromised, those can be changed. That's the point. (Plus, passwords aren't routinely col

I'm sure he -does- think low entropy passwords are bad. However, once compromised, those can be changed. That's the point. (Plus, passwords aren't routinely collected and shared by governmental agencies. Just throwing that out there). As you say, with Apple's TouchID, you are actively choosing a less secure method to access your device, for convenience. But...that's also pretty close to what the author said. "Biometrics can be use used as a lightweight, convenient mechanism to establish identity, but they cannot authenticate a person or a thing alone." His point is that for things like system access to a Linux box, or to unencrypt data (eCryptfs, the software he helps maintain), biometrics is far too insecure.

knorthfield 12y ago
I think convenience is important in this comparison because that generates a context in which TouchID is actually more secure, because it's more likely to be used than remembering and typing a passcode/phrase. Apple have shown the usage stats. There is also the inconvenience for attackers of reproducing a fingerprint through an elaborate process, which again makes TouchID more secure (in my opinion) in practice than a password/phrase. While theoretically less secure, I would say TouchID in practice is more secure for average users. But in the case where there is the motivation I would agree with you.
- lostcolony 12y ago
  Right, and I don't think the author necessarily disagrees with the idea of including TouchID in Apple products as an alternative to 'completely unlocked'. As the author indicates, "This isn't a knock on Apple, as Thinkpad have embedded fingerprint readers for nearly a decade. My intention is to help stop and think about the place of biometrics in security." The danger is viewing biometrics as a secure alternative to passwords; it's not. But comparatively few people are technically inclined enough to realize that; with Apple embracing it for convenience, we run the risk of people not understanding the security implications; the author saw evidence of that when asked to implement biometrics for file encryption, which is a terrible idea.
  - JoeAltmaier 12y ago
    I think I remember the issues: good passwords are arbitrary, hard to guess, can be changed at any time, are used for one purpose only. Biometrics (fingerprints) are none of these things.
avn2109 12y ago
>> "Plus, passwords aren't routinely collected and shared by governmental agencies" Y U no read Greenwald? Not sure if trolling.
- taejo 12y ago
  It took me a moment to work this out too, but they meant that the police don't ask for your passwords when they arrest you for an unrelated charge; the DMV doesn't ask you for them when you get a drivers license (do US DMVs do that?) etc.
  - lostcolony 12y ago
    US DMVs do not require fingerprints, no. However, they do require images to be taken of you, that are entered into a database ( http://www.washingtonpost.com/business/technology/state-photo-id-databases-become-troves-for-police/2013/06/16/6f014bd4-ced5-11e2-8845-d970ccb04497_story.html http://www.washingtonpost.com/business/technology/state-phot... ). So when discussing 'biometrics' as a whole, government agencies routinely collect and share it. Plus, let's not forget the data sharing arrangements that were highlighted by Greenwald; the US collects fingerprints from anyone entering the country ( http://en.wikipedia.org/wiki/Office_of_Biometric_Identity_Management http://en.wikipedia.org/wiki/Office_of_Biometric_Identity_Ma... ), and I'm sure they're happy to share that information with other countries, who may be prevented legally from collecting that info from their own citizens. And vice versa. So traveled overseas? It's not unreasonable to assume your home country now has access to that piece of biometric data. Certainly, the country you traveled to does. And of course, if you are arrested, your fingerprints are entered into a DB as well (though you can fight to have them removed if you are never found guilty of anything; good luck with that). In general, our biometric data is collected routinely, and so makes a really bad choice for a password. I never see the equivalent of this for passwords - http://thefreethoughtproject.com/st-louis-police-fingerprint-children-side-road-ferguson/ http://thefreethoughtproject.com/st-louis-police-fingerprint...

knorthfield 12y ago

I think convenience is important in this comparison because that generates a context in which TouchID is actually more secure, because it's more likely to be used than remembering and typing a passcode/phrase. Apple have shown the usage stats. There is also the inconvenience for attackers of reproducing a fingerprint through an elaborate process, which again makes TouchID more secure (in my opinion) in practice than a password/phrase. While theoretically less secure, I would say TouchID in practice is more secure for average users. But in the case where there is the motivation I would agree with you.

lostcolony 12y ago
Right, and I don't think the author necessarily disagrees with the idea of including TouchID in Apple products as an alternative to 'completely unlocked'. As the author indicates, "This isn't a knock on Apple, as Thinkpad have embedded fingerprint readers for nearly a decade. My intention is to help stop and think about the place of biometrics in security." The danger is viewing biometrics as a secure alternative to passwords; it's not. But comparatively few people are technically inclined enough to realize that; with Apple embracing it for convenience, we run the risk of people not understanding the security implications; the author saw evidence of that when asked to implement biometrics for file encryption, which is a terrible idea.
- JoeAltmaier 12y ago
  I think I remember the issues: good passwords are arbitrary, hard to guess, can be changed at any time, are used for one purpose only. Biometrics (fingerprints) are none of these things.

avn2109 12y ago

>> "Plus, passwords aren't routinely collected and shared by governmental agencies" Y U no read Greenwald? Not sure if trolling.

taejo 12y ago
It took me a moment to work this out too, but they meant that the police don't ask for your passwords when they arrest you for an unrelated charge; the DMV doesn't ask you for them when you get a drivers license (do US DMVs do that?) etc.
- lostcolony 12y ago
  US DMVs do not require fingerprints, no. However, they do require images to be taken of you, that are entered into a database ( http://www.washingtonpost.com/business/technology/state-photo-id-databases-become-troves-for-police/2013/06/16/6f014bd4-ced5-11e2-8845-d970ccb04497_story.html http://www.washingtonpost.com/business/technology/state-phot... ). So when discussing 'biometrics' as a whole, government agencies routinely collect and share it. Plus, let's not forget the data sharing arrangements that were highlighted by Greenwald; the US collects fingerprints from anyone entering the country ( http://en.wikipedia.org/wiki/Office_of_Biometric_Identity_Management http://en.wikipedia.org/wiki/Office_of_Biometric_Identity_Ma... ), and I'm sure they're happy to share that information with other countries, who may be prevented legally from collecting that info from their own citizens. And vice versa. So traveled overseas? It's not unreasonable to assume your home country now has access to that piece of biometric data. Certainly, the country you traveled to does. And of course, if you are arrested, your fingerprints are entered into a DB as well (though you can fight to have them removed if you are never found guilty of anything; good luck with that). In general, our biometric data is collected routinely, and so makes a really bad choice for a password. I never see the equivalent of this for passwords - http://thefreethoughtproject.com/st-louis-police-fingerprint-children-side-road-ferguson/ http://thefreethoughtproject.com/st-louis-police-fingerprint...