4 ms·

Fingerprints are usernames, not passwords http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fi

by DevX101 12y ago

Fingerprints are usernames, not passwords http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...

colinbartlett 12y ago
I am really tired of this argument. Biometric information is a means to verify identification. A username and a password is also a means to verify identification. A fingerprint is no more a username than a password is a username. In the case of a username/password it's the combination that's required to verify the identity.
- jude- 12y ago
  Fingerprints identify individuals, but they should not be relied upon for authentication (which is what the article was getting at). Unlike a password or private key, you can't change your fingerprints when they get compromised.
- tlrobinson 12y ago
  So a fingerprint is like a username and password you go around writing on everything you touch. Got it.
- kerkeslager 12y ago
  > Biometric information is a means to verify identification. A username and a password is also a means to verify identification. A fingerprint is no more a username than a password is a username. In the case of a username/password it's the combination that's required to verify the identity. Is it really? I think if I send you an email at colinbartlett@whateversitehostsyouremail.com I've verified your identity as much as I need with only your username. A username and password is a case of identification (username) and authentication (password). Authentication is proof. When you have authenticated identification (like a username and password) it's proof that the person is why they say they are. The reason people conflate identification with authentication is that we typically use the two together. But there are lots of cases where we only care about one or the other. For example, many systems (such as routers) implement administrative tasks with an administrative password. You don't care who performed the task, you only care that they had permission to do it. That's authentication without identification. Similarly, there are plenty of cases where you don't care about authentication, you only care about identification. For example, anyone can send you an email. On many systems you can send people messages anonymously: there's no authentication necessary, no proof of anything necessary to be allowed to send the message. The only thing necessary is the identity of the receiver. That's identification without authentication. Fingerprints are identification. They are used as authentication because the difficulty of collecting the identification gives a small barrier to falsifying authentication, but they're pretty terrible for that purpose. You leave your fingerprints all over the place: it's like if you just went around writing your bank PIN everywhere. There are already proofs of concepts of people constructing fingerprints from polymers; this is a simple case of privilege escalation, where gaining one level of privilege allows you access to a higher level of privilege. Given that most people give everyone access to their fingerprints that's a pretty low point to allow escalation from.
- lucb1e 12y ago
  > Biometric information is a means to verify identification Fair enough. I agree that it should be, and that perhaps saying "they're usernames" is not really the way to go. But would you set your password to something you leave on almost every surface you ever touch?
- blake8086 12y ago
  How should I go about resetting my fingerprint after it's compromised?
- rdtsc 12y ago
  > I am really tired of this argument. Ok. Neither the argument nor your counterargument really make sense. Yeah you can argue a very long username, something like a UUID might as well be a username and password all in one in some circumstances. But stepping back, this is kind of a dead end argument. It doesn't help with security. Biometric information and username/pass both have enough cons that you really want both. Basically you need both: * Something you know (your username/password) * Something you have (some kind of a card, your finger, you retina, some physical token). [Ok some researches say "biometrics" is something else not just "something you have" it is inherence -- something you "are". But well, I cut your finger and now it isn't something you "are" anymore. It is something _I_ have] This is the classic multi-factor authentication, most commonly used version is 2FA (two-factor authentication).
- pessimizer 12y ago
  I can use your finger like I can use your username. I can't use your password without you telling it to me. Your finger just identifies you. Your name also identifies you. Your password authenticates you to someone (as it is a shared secret, or rather shared evidence of a secret.) Just like knowing what what you did at Bob's party in 1983 can authenticate you to Fred (who watched) if you mention it in a letter.
- unethical_ban 12y ago
  No, a username is not meant to verify identification. Your username is your identification. It's public (or at least, not sensitive). Your passwords is the authentication to your identity. Sure, a fingerprint might be one of several factors for authentication at secure sites, but that is rarely the only thing. It usually coincides with badge readers, photo-ID, etc.

by DevX101 12y ago

Fingerprints are usernames, not passwords http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...

colinbartlett 12y ago

I am really tired of this argument. Biometric information is a means to verify identification. A username and a password is also a means to verify identification. A fingerprint is no more a username than a password is a username. In the case of a username/password it's the combination that's required to verify the identity.

jude- 12y ago
Fingerprints identify individuals, but they should not be relied upon for authentication (which is what the article was getting at). Unlike a password or private key, you can't change your fingerprints when they get compromised.
tlrobinson 12y ago
So a fingerprint is like a username and password you go around writing on everything you touch. Got it.
kerkeslager 12y ago
> Biometric information is a means to verify identification. A username and a password is also a means to verify identification. A fingerprint is no more a username than a password is a username. In the case of a username/password it's the combination that's required to verify the identity. Is it really? I think if I send you an email at colinbartlett@whateversitehostsyouremail.com I've verified your identity as much as I need with only your username. A username and password is a case of identification (username) and authentication (password). Authentication is proof. When you have authenticated identification (like a username and password) it's proof that the person is why they say they are. The reason people conflate identification with authentication is that we typically use the two together. But there are lots of cases where we only care about one or the other. For example, many systems (such as routers) implement administrative tasks with an administrative password. You don't care who performed the task, you only care that they had permission to do it. That's authentication without identification. Similarly, there are plenty of cases where you don't care about authentication, you only care about identification. For example, anyone can send you an email. On many systems you can send people messages anonymously: there's no authentication necessary, no proof of anything necessary to be allowed to send the message. The only thing necessary is the identity of the receiver. That's identification without authentication. Fingerprints are identification. They are used as authentication because the difficulty of collecting the identification gives a small barrier to falsifying authentication, but they're pretty terrible for that purpose. You leave your fingerprints all over the place: it's like if you just went around writing your bank PIN everywhere. There are already proofs of concepts of people constructing fingerprints from polymers; this is a simple case of privilege escalation, where gaining one level of privilege allows you access to a higher level of privilege. Given that most people give everyone access to their fingerprints that's a pretty low point to allow escalation from.
lucb1e 12y ago
> Biometric information is a means to verify identification Fair enough. I agree that it should be, and that perhaps saying "they're usernames" is not really the way to go. But would you set your password to something you leave on almost every surface you ever touch?
blake8086 12y ago
How should I go about resetting my fingerprint after it's compromised?
rdtsc 12y ago
> I am really tired of this argument. Ok. Neither the argument nor your counterargument really make sense. Yeah you can argue a very long username, something like a UUID might as well be a username and password all in one in some circumstances. But stepping back, this is kind of a dead end argument. It doesn't help with security. Biometric information and username/pass both have enough cons that you really want both. Basically you need both: * Something you know (your username/password) * Something you have (some kind of a card, your finger, you retina, some physical token). [Ok some researches say "biometrics" is something else not just "something you have" it is inherence -- something you "are". But well, I cut your finger and now it isn't something you "are" anymore. It is something _I_ have] This is the classic multi-factor authentication, most commonly used version is 2FA (two-factor authentication).
pessimizer 12y ago
I can use your finger like I can use your username. I can't use your password without you telling it to me. Your finger just identifies you. Your name also identifies you. Your password authenticates you to someone (as it is a shared secret, or rather shared evidence of a secret.) Just like knowing what what you did at Bob's party in 1983 can authenticate you to Fred (who watched) if you mention it in a letter.
unethical_ban 12y ago
No, a username is not meant to verify identification. Your username is your identification. It's public (or at least, not sensitive). Your passwords is the authentication to your identity. Sure, a fingerprint might be one of several factors for authentication at secure sites, but that is rarely the only thing. It usually coincides with badge readers, photo-ID, etc.