4 ms·

Hmm... You're probably right, but this article proves that a four-digit PIN (assuming 10 incorrect attempts would lock the phone) would actually be more secure

Hmm... You're probably right, but this article proves that a four-digit PIN (assuming 10 incorrect attempts would lock the phone) would actually be more secure than a fingerprint. A fingerprint can be cloned and verified (visually) without giving the device a chance to do "defend itself", whereas even the best-case PIN attack* wouldn't necessarily exhaust possibilities before 10 tries. I personally like the swipe gesture, as it is even somewhat resistant to a shoulder-surfing attack (assuming you're turned off horrendous default of drawing the pattern as you drag over it) and is much faster than typing a PIN. * Excluding shoulder-surfing attacks. You know the digits (smudges have built up over them), but not the order.

arrrg 12y ago
Weigh the probability of someone producing a fingerprint replica vs. someone shoulder-surfing. The first seems exceedingly unlikely to me, while the second is at least plausible.
- yourad_io 12y ago
  Fair enough. The only issue is that all (ok, most) your data is on your phone, as are your fingerprints - so if you lose it[1], in all likelihood they'll be happy they got a $1K device for free and wipe it, but if they were determined to get in to get (say) your SSH keys, or something... yeah. They'd need a few hours and some not-so-hard to get machinery. [1] Especially if it is stolen. "I wasn't targeted. Was I targeted? Nah, I wasn't targeted. Just a crime of opportunity. Yes. For sure.".
  - arrrg 12y ago
    There is nothing valuable (expect potentially embarrassing private information that is, however, completely worthless to some random thief) on my phone that is protected by my fingerprint. The valuable stuff (especially passwords) can’t be accessed with my fingerprint. So for me personally that is irrelevant.
georgespencer 12y ago
My point was that for almost all users, it's conceivable that a PIN could be guessed or obtained by someone wanted access to the phone casually. A good friend of mine amazed me by casually reverse engineering my PIN over the course of a week in the pre-TouchID days of iPhone. He wasn't especially interested, he just watched me for a few days to crack it. However a finger print is significantly harder for a casual interloper to simulate.
- yourad_io 12y ago
  Unless you've lost your phone, in which case your fingerprints are all over the device, and if they want to log in, they have to reconstruct it using "information" already on it. Granted re:casual interloper. And your friend just shoulder-surfed you, he didn't reverse engineer anything ;)

arrrg 12y ago

Weigh the probability of someone producing a fingerprint replica vs. someone shoulder-surfing. The first seems exceedingly unlikely to me, while the second is at least plausible.

yourad_io 12y ago
Fair enough. The only issue is that all (ok, most) your data is on your phone, as are your fingerprints - so if you lose it[1], in all likelihood they'll be happy they got a $1K device for free and wipe it, but if they were determined to get in to get (say) your SSH keys, or something... yeah. They'd need a few hours and some not-so-hard to get machinery. [1] Especially if it is stolen. "I wasn't targeted. Was I targeted? Nah, I wasn't targeted. Just a crime of opportunity. Yes. For sure.".
- arrrg 12y ago
  There is nothing valuable (expect potentially embarrassing private information that is, however, completely worthless to some random thief) on my phone that is protected by my fingerprint. The valuable stuff (especially passwords) can’t be accessed with my fingerprint. So for me personally that is irrelevant.

georgespencer 12y ago

My point was that for almost all users, it's conceivable that a PIN could be guessed or obtained by someone wanted access to the phone casually. A good friend of mine amazed me by casually reverse engineering my PIN over the course of a week in the pre-TouchID days of iPhone. He wasn't especially interested, he just watched me for a few days to crack it. However a finger print is significantly harder for a casual interloper to simulate.

yourad_io 12y ago
Unless you've lost your phone, in which case your fingerprints are all over the device, and if they want to log in, they have to reconstruct it using "information" already on it. Granted re:casual interloper. And your friend just shoulder-surfed you, he didn't reverse engineer anything ;)