4 ms·

It is better to think of it like a username than a password. None of my devices support biometrics, but if they did, I would want to have both fingerprint AND p

It is better to think of it like a username than a password. None of my devices support biometrics, but if they did, I would want to have both fingerprint AND password, if that's possible. Does anyone know if any of Apple, Samsung, et al allow that?

JoeAltmaier 12y ago
True. And in my opinion username is useless and should be abandoned. A good password is all you need - say 128-bit high-entropy. Its not going to be duplicated; its enough to identify you. What's the username hanging around for?
- deleted 12y ago
  [deleted]
- _asummers 12y ago
  Probability says that it won't be duplicated, but what if it is? You can't say "no, sorry, you can't choose this password" because that leaks information. This is even ignoring adversarial attacks to try and get this or any birthday attacks. In my thinking about this problem from the IoT space lately, I've been thinking about servers assigning credentials to devices, rather than devices telling you their creds. Assign a UUID and let the device generate their password/key, and the pair gives you a multiplicatively large space.
  - JoeAltmaier 12y ago
    That's an obsolete notion. You are not going to duplicate a 128-bit high-entropy number. Not in several lifetimes of our sun. Your notion is interesting. Anything that automates the client-side is good. People are terrible at managing a security contract 'by hand' {edit} really, this superstitious notion that random numbers are 'not good enough' is embedded in our programmer culture. Folks continue to use lame solutions instead of just buying into the uuid-as-foolproof-identifier. It totally eliminates whole classes of problems and bugs. And you should be more concerned your computer will be hit by lightening, become self-ware and win the lottery 7 times, and molecularly reorganize into a teacup, before that uuid will be duplicated anywhere/anywhen.
    - _asummers 12y ago
      For the record, I'm not the one downvoting you (I don't even have that ability yet!). Security is always done in layers, though, and while you're correct that it is extremely unlikely, the chance is nonzero. As such you have to prepare for that and design your system to be resilient to these types of things. In castle terms, you trust that no one will ever breach your wall, but that doesn't mean you don't have guards and an armory inside for the unlikely event it does.
      - JoeAltmaier 12y ago
        No, no, a thousand times no. You do not have to prepare for the astronomically improbable. UUID collision is a myth, and should be treated as such.
HackinOut 12y ago
I think Samsung does it with facial recognition on the Galaxy S's lock screen. Should work better and better and you don't need an additional sensor. EDIT: So does Kinect for Xbox one.
- _asummers 12y ago
  As far as facial recognition on Kinect, I don't mind it as the keeper to my gaming system, but simply having my face unlock my bank account suffers the same problem as a finger print. Your face is on so many cameras every single day. A password should be kept private. Additionally, I'm a bald man with glasses, how many others with this description would be able to open my Xbox with their face? It is useful in combination with a password, but should not (and I would argue cannot) replace a password system of some kind.
  - HackinOut 12y ago
    OP mentioned using biometrics as a username in combination with a password. [1] seems to imply you can add a password or pass code. [1] http://support.xbox.com/en-US/xbox-360/kinect/auto-sign-in http://support.xbox.com/en-US/xbox-360/kinect/auto-sign-in
- spacefight 12y ago
  That sounds still like crap. Has anyone defeated that already with still picture?
  - praseodym 12y ago
    Yes it has: https://www.youtube.com/watch?v=NpNCXxtOzAo https://www.youtube.com/watch?v=NpNCXxtOzAo and http://www.ibtimes.co.uk/samsung-galaxy-s3-face-unlock-flaw-photograph-353445 http://www.ibtimes.co.uk/samsung-galaxy-s3-face-unlock-flaw-...
  - HackinOut 12y ago
    OP mentioned using biometrics as a username in combination with a password. [1] seems to imply you can add a password or pass code on xbox and I think you can do that too on a Galaxy S (?) [1] http://support.xbox.com/en-US/xbox-360/kinect/auto-sign-in http://support.xbox.com/en-US/xbox-360/kinect/auto-sign-in
chestnut-tree 12y ago
"It is better to think of it like a username than a password" Biometric passports with fingerprint data are common in many EU countries. The fingerprint is used to verify a person's identity, so in a way it's used as both a username and password. Allowing the state to capture and store something very private to every individual is not without controversy. A few years ago, a German man called Michael Schwarz had his application for a passport rejected when he refused to have his fingerprints taken. He took the matter to the European Court of Justice (ECJ). In October 2013, the ECJ ruled in favour of fingerprinting for passports. The ECJ agreed that fingerprinting was a privacy intrusion but that this was outweighed by the need for security and protection against fraud. Strictly speaking, the fingerprint data should only be held in the passport, not in a central database. Whether you agree or not with fingerprint capture will probably be influenced by how much you trust the authorities in your country. And of course, many countries collect fingerprints from visitors entering their country.
- _asummers 12y ago
  It's really unfortunate that is the case. I don't mind fingerprints, but they have to be used in combination with something else to be valid. You should be able to challenge another thing to build a valid profile. I don't trust ALL authorities in ALL countries I happen to visit or live in to be both competent with security and malevolent for ALL time. To put all your eggs in the fingerprint basket seems shortsighted. I trust that if I had enemies that needed my fingerprint for something, that could get it easily. I touch enough objects on a daily basis that the likelihood is extremely high. I mean, someone could simply lift them from my front door, or follow me waiting for me to drop a coffee cup in the trash.

JoeAltmaier 12y ago

True. And in my opinion username is useless and should be abandoned. A good password is all you need - say 128-bit high-entropy. Its not going to be duplicated; its enough to identify you. What's the username hanging around for?

deleted 12y ago
[deleted]
_asummers 12y ago
Probability says that it won't be duplicated, but what if it is? You can't say "no, sorry, you can't choose this password" because that leaks information. This is even ignoring adversarial attacks to try and get this or any birthday attacks. In my thinking about this problem from the IoT space lately, I've been thinking about servers assigning credentials to devices, rather than devices telling you their creds. Assign a UUID and let the device generate their password/key, and the pair gives you a multiplicatively large space.
- JoeAltmaier 12y ago
  That's an obsolete notion. You are not going to duplicate a 128-bit high-entropy number. Not in several lifetimes of our sun. Your notion is interesting. Anything that automates the client-side is good. People are terrible at managing a security contract 'by hand' {edit} really, this superstitious notion that random numbers are 'not good enough' is embedded in our programmer culture. Folks continue to use lame solutions instead of just buying into the uuid-as-foolproof-identifier. It totally eliminates whole classes of problems and bugs. And you should be more concerned your computer will be hit by lightening, become self-ware and win the lottery 7 times, and molecularly reorganize into a teacup, before that uuid will be duplicated anywhere/anywhen.
  - _asummers 12y ago
    For the record, I'm not the one downvoting you (I don't even have that ability yet!). Security is always done in layers, though, and while you're correct that it is extremely unlikely, the chance is nonzero. As such you have to prepare for that and design your system to be resilient to these types of things. In castle terms, you trust that no one will ever breach your wall, but that doesn't mean you don't have guards and an armory inside for the unlikely event it does.
    - JoeAltmaier 12y ago
      No, no, a thousand times no. You do not have to prepare for the astronomically improbable. UUID collision is a myth, and should be treated as such.

HackinOut 12y ago

I think Samsung does it with facial recognition on the Galaxy S's lock screen. Should work better and better and you don't need an additional sensor. EDIT: So does Kinect for Xbox one.

_asummers 12y ago
As far as facial recognition on Kinect, I don't mind it as the keeper to my gaming system, but simply having my face unlock my bank account suffers the same problem as a finger print. Your face is on so many cameras every single day. A password should be kept private. Additionally, I'm a bald man with glasses, how many others with this description would be able to open my Xbox with their face? It is useful in combination with a password, but should not (and I would argue cannot) replace a password system of some kind.
- HackinOut 12y ago
  OP mentioned using biometrics as a username in combination with a password. [1] seems to imply you can add a password or pass code. [1] http://support.xbox.com/en-US/xbox-360/kinect/auto-sign-in http://support.xbox.com/en-US/xbox-360/kinect/auto-sign-in
spacefight 12y ago
That sounds still like crap. Has anyone defeated that already with still picture?
- praseodym 12y ago
  Yes it has: https://www.youtube.com/watch?v=NpNCXxtOzAo https://www.youtube.com/watch?v=NpNCXxtOzAo and http://www.ibtimes.co.uk/samsung-galaxy-s3-face-unlock-flaw-photograph-353445 http://www.ibtimes.co.uk/samsung-galaxy-s3-face-unlock-flaw-...
- HackinOut 12y ago
  OP mentioned using biometrics as a username in combination with a password. [1] seems to imply you can add a password or pass code on xbox and I think you can do that too on a Galaxy S (?) [1] http://support.xbox.com/en-US/xbox-360/kinect/auto-sign-in http://support.xbox.com/en-US/xbox-360/kinect/auto-sign-in

chestnut-tree 12y ago

"It is better to think of it like a username than a password" Biometric passports with fingerprint data are common in many EU countries. The fingerprint is used to verify a person's identity, so in a way it's used as both a username and password. Allowing the state to capture and store something very private to every individual is not without controversy. A few years ago, a German man called Michael Schwarz had his application for a passport rejected when he refused to have his fingerprints taken. He took the matter to the European Court of Justice (ECJ). In October 2013, the ECJ ruled in favour of fingerprinting for passports. The ECJ agreed that fingerprinting was a privacy intrusion but that this was outweighed by the need for security and protection against fraud. Strictly speaking, the fingerprint data should only be held in the passport, not in a central database. Whether you agree or not with fingerprint capture will probably be influenced by how much you trust the authorities in your country. And of course, many countries collect fingerprints from visitors entering their country.

_asummers 12y ago
It's really unfortunate that is the case. I don't mind fingerprints, but they have to be used in combination with something else to be valid. You should be able to challenge another thing to build a valid profile. I don't trust ALL authorities in ALL countries I happen to visit or live in to be both competent with security and malevolent for ALL time. To put all your eggs in the fingerprint basket seems shortsighted. I trust that if I had enemies that needed my fingerprint for something, that could get it easily. I touch enough objects on a daily basis that the likelihood is extremely high. I mean, someone could simply lift them from my front door, or follow me waiting for me to drop a coffee cup in the trash.