5 ms·

A fingerprint is a good username and ridiculous as a password. This excellent article captures my thoughts pretty well: http://blog.dustinkirkland.com/2013/10/

by SEJeff 12y ago

A fingerprint is a good username and ridiculous as a password. This excellent article captures my thoughts pretty well: http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...

TheLoneWolfling 12y ago
It's not even a good username. You can change usernames as often as you wish. Kind of hard to do that with your fingerprint.
- Tomte 12y ago
  Tell that to Valve. I wish I could change my Steam user name that I chose in my juvenile years.
  - TheLoneWolfling 12y ago
    You won't be able to carry over games purchased, true. But you can create a new account. You can't even do that much with fingerprints.
    - kybernetikos 12y ago
      I have a main account and a little finger account.
      - TheLoneWolfling 12y ago
        Yep, you can do that 8 more times, total. And you can't reuse a fingerprint if an account that you use a fingerprint as the user account for has been compromised.
- SEJeff 12y ago
  What do you think about doing it sort of like how RSA does their 2fa bits? Say it worked like this: You typed in your username, scanned your fingerprint for the rest of the username, and then typed a password / passcode? That makes it virtually impossible to have username collisions (good) and still uses a password. If you were ultra paranoid, you could use a key fob such as a Yubikey and enter a OTP in addition to the above.
  - TheLoneWolfling 12y ago
    That would work, iff there was not a way to show that a particular person owned a particular username. However, I cannot think of any way to prevent that. ...But given the ease of getting someone's fingerprint I'm not sure if this is actually much better than a standard username+password combination (potentially with 2fa) without a fingerprint at this point, and it's less convenient to boot.
arrrg 12y ago
And yet … and yet … See, this is exactly the problem. It’s not at all useless. It’s a pretty great password that defends excellently against a few common problem points (random strangers just picking up your phone and playing with it, random thieves easily getting access in a way that would be convenient and worth it for them) while being completely invisible to me when using it (and actually making unlocking the device easier). It’s rubbish against any kind of targeted attack, sure. Thing is, I personally don’t care about that at all. I couldn’t care less, really. So fingerprints are awesome for me and solve all the problems I want them to solve. I don’t care about perfect security. I don’t care about targeted attacks contingent on physical access to the device.

by SEJeff 12y ago

TheLoneWolfling 12y ago

It's not even a good username. You can change usernames as often as you wish. Kind of hard to do that with your fingerprint.

Tomte 12y ago
Tell that to Valve. I wish I could change my Steam user name that I chose in my juvenile years.
- TheLoneWolfling 12y ago
  You won't be able to carry over games purchased, true. But you can create a new account. You can't even do that much with fingerprints.
  - kybernetikos 12y ago
    I have a main account and a little finger account.
    - TheLoneWolfling 12y ago
      Yep, you can do that 8 more times, total. And you can't reuse a fingerprint if an account that you use a fingerprint as the user account for has been compromised.
SEJeff 12y ago
What do you think about doing it sort of like how RSA does their 2fa bits? Say it worked like this: You typed in your username, scanned your fingerprint for the rest of the username, and then typed a password / passcode? That makes it virtually impossible to have username collisions (good) and still uses a password. If you were ultra paranoid, you could use a key fob such as a Yubikey and enter a OTP in addition to the above.
- TheLoneWolfling 12y ago
  That would work, iff there was not a way to show that a particular person owned a particular username. However, I cannot think of any way to prevent that. ...But given the ease of getting someone's fingerprint I'm not sure if this is actually much better than a standard username+password combination (potentially with 2fa) without a fingerprint at this point, and it's less convenient to boot.

arrrg 12y ago

And yet … and yet … See, this is exactly the problem. It’s not at all useless. It’s a pretty great password that defends excellently against a few common problem points (random strangers just picking up your phone and playing with it, random thieves easily getting access in a way that would be convenient and worth it for them) while being completely invisible to me when using it (and actually making unlocking the device easier). It’s rubbish against any kind of targeted attack, sure. Thing is, I personally don’t care about that at all. I couldn’t care less, really. So fingerprints are awesome for me and solve all the problems I want them to solve. I don’t care about perfect security. I don’t care about targeted attacks contingent on physical access to the device.