Hacker News Reader

Comment by nr152522 | Hacker News Reader

Something I have always pondered,...would it be more secure to request a password after the user has been identified by the system?

For example,...

1. User clicks login 2. Webcam uses facial recognition to identify the user. 3. The identified user is requested to enter their password.

In this case, I think, it is harder to impersonate the real user. I am no expert but would interested to know if anyone can see any obvious flaws or if something similar exists?

View on HN

A face is a username, not a password. I can take a picture of you and hold it up in front of the webcam. And my picture will work every time unless you decide to get surgery.

Exactly,...the user is identified and then requested to enter a password. You are identifying the user, then you proceed to ask them a password. I.e. Identifying the user is something you are, then asking them for a password is something you know.

There's no improvement in security from asking for a face rather than a username.

What are the reasons? Genuinely interested as I'd like to understand in more detail.

For the same reason that thumbprints are usernames, not passwords: http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...

Previous HN discussion: https://news.ycombinator.com/item?id=6477505

I'm confused. I never stated that a users face should be used as a password. I was suggesting that their face (or other bio-info) be their username. Am I missing something?

"I was suggesting that their face (or other bio-info) be their username."

What problem does this solve?

Reply on news.ycombinator.com