Hacker News Reader

Comment by rrmm | Hacker News Reader

Shouldn't touch ID be the userid and not the password?

Okay, so there's two requirements for any legit authorization to pass: identification, and authentication. For Unix accounts, the username is the identification bit, and the password is the authentication bit.

Now, you don't usually type the username when you run sudo, do you? That's because most of the time, the username can be gleaned from context. For example, "Which user is this process running under?".

So, if TouchID's purpose was just to supply identification and not any verification that the identification is legit, that would be pretty pointless.

I agree. But my thinking is that touch id just shows who the person claims to be (like a username), but it doesn't actually authenticate they are that person.

I know that in practice apple does use it to auth.

It's a "something you are" authentication factor, since it is presumed that the cost of faking a fingerprint is too high to be worth it in those cases.

I guess I like the trade-offs of something-you-have/something-you-know even if the cost of faking them is actually lower.

I am probably in a minority.

Could you setup your system to still need "something you know" when logging in, but use your TouchID for additional authentication (like sudo) once already in the system?

That seems like the best of both worlds there.

When done correctly, fingerprints are both something you are and something you have: The fingerprint data should reside in and work only to activate an HSM that then proves possession of an attested key pair. That way the HSM (and the device it sits in) is your something to have.

I wonder how much the cost will be reduced though considering that you will most probably be able to find a matching fingerprint on the same keyboard.

Use your thumb print.

Lift the thumbprint off of the TouchID sensor itself? That is, assuming the premise of the grandparent comment is valid and fingerprints lifted off of the keyboard would be enough.

Slide, rather than raise, your thumb off the sensor.

When I hold my phone, I use my opposable thumb to hold the front of the phone. Anyone can lift it off there.

You only use your thumb on the space bar, and when you do, it's the side. But when you scan your thumb, it's the face of the print, ergo, impossible to lift thumb print from nearby key.

https://www.schneier.com/crypto-gram/archives/2002/0515.html...

"He used $10 of ingredients you could buy, and whipped up his gummy fingers in the equivalent of a home kitchen. And he defeated eleven different commercial fingerprint readers, with both optical and capacitive sensors, and some with "live finger detection" features."

That article's a little old now and the tech may well have improved since but I wouldn't put too much faith in fingerprint readers. (Also: other attack vectors exist).

The sensor is pretty good at detecting real finger since it's tuned to the capacitance of human skin, possible to fake but not particularly easy.

If they'll move to the new optical sensors the the refracted IR ones can sense the flow of blood in the veins of your finger.

They (including Apple) told us once too often that their new fingerprint sensor will now really, really, finally solve all issues. With every new generation they tell us that all flaws of all previous generations have been solved. And once too often, they we proven to be wrong.

So I agree with zwp (not sure why he was downvoted):

I wouldn't put too much faith in fingerprint readers.

My point is that this is still more expensive than harvesting knowledge factors with phishing and stealing dbs where people use the same factors.

Yeah, I'm not an international spy: even if it is 'easy', nobody is going to spend a few hours faking my fingerprint just to get into my phone or my laptop. And if they are so motivated, then there's a much bigger problem at hand.

There are plenty of people still using 4 digit passcode (especially simple ones like 0000 or 1234) which is easy to 'steal' by watching somebody unlock their phone before pickpocketing them.

The bigger issue in my mind is revocation and separation of identities. I only have one set of fingerprints. What's more, I may not want my biological identity connected to online identities. It would be like having to give every website your SSN/National ID to identify yourself rather than merely a unique ID. You are giving out a huge amount of info with your fingerprint.

Now some of the above issues aren't specifically in play with this particular app: It's locally owned/controlled hardware only. Also, as you say most of us aren't international spies (though I do find that getting a bit close to 'I have nothing to hide').

A sensible approach would be to have a master token which is unlocked using your fingerprint and used to generate one-time tokens for identification - perhaps like Apple Pay.

As you point out, there's a right way to do fingerprints, which Apple did. Only the key pair stored in the secure enclave is tied to your online identity.

There is a missing link in the trust chain though, which is attestation of that secure enclave (how do we know it is a legitimate and uncompromised one?) However, privacy preserving attestation mechanisms such as DAA [1] require somewhat expensive crypto.

[1] https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation

TouchID sensor isn't that easy to fool with replicated fingerprints.

If you are afraid that some one will cut off your finger to unlock your computer don't use the touchID, that said if some one is willing to do that to unlock it i wouldn't want to imagine what they'll do to you to get the password.

;)

You don't really need to cut their finger off. Just get them drunk enough to pass out.

Or take a picture or find their photo on a social network http://www.geek.com/apple/bypassing-touch-id-with-a-phony-fi...

"could be as simple as taking a photo"

I don't buy this story or their "sources" at all. A zoomed in photo is enough to create a accurate 3d model? Really?

I might be naive at times, but this time I'm calling BS.

Starbug (same guy who was the first to fool a Touch ID sensor) demonstrated that he could create fingerprint masks from press photos of a politician. See his very entertaining talk at 31c3: http://youtube.com/watch?v=VVxL9ymiyAU

I think the gp was alluding to an argument originally from this blog post [1], which posits that biometrics should only be used to identify, and should never be used to authenticate.

And I'd have to agree, fingerprints are a terrible substitute for a passphrase.

[1] http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...

I'm not sure that's true. Anyone can claim to be "rrmm" but only one person has that set of fingerprints.

I certainly agree that a fingerprint is a much greater claim to an identity than a username. 'Casually' of course fingerprints work fine for auth, but fingerprints can and have been reproduced. Technology may alleviate that issue eventually, and you could argue that all auth methods have their issues.

The bigger issue I see is that 'rrmm' is an identity I assumed. I have many different identities. I only have one set of finger prints. (Fingerprinting to unlock a local store of keys would fix some of this problem, but I am fond of plausible deniablity in identification).

"at a time", wasn't the movie "demolition man" showed us the physical danger of biometrics (/s)

No need for /s. That's a valid concern that gets mentioned often in discussions like this.

If a biometric sensor can be tricked by a body part that is no longer attached to the body, that's a serious issue. But AFAIK at least modern sensors try to verify if it's still alive and then there's also the biological effect that a body part quickly changes its properties if it is no longer supported by the body.

The biggest danger in that is probably criminals who don't know that it is likely that a detached body parts stops functioning.

Fingerprints can be separated from their owner and fingers can be controlled by others. They are also duplicable, depending on the sophistication of the sensor.

Reply on news.ycombinator.com