Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys
cnet.com
cnet.com
1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin )
2. Goods of all kinds are being delivered faster
The scary thing for me is that thieves love goods delivered quickly, so they can turn them quickly, and cut down on their ability to get intercepted.
So what does the 'mugging' or identity theft of tomorrow look like? Am I taken at my doorstep and forced to make purchases from my phone with my thumb, while a drone arrives 10 minutes later with 10 iPads OR do I have my phone stolen and thumb lopped off with tree clippers so the fraudster has more time? What happens as retinal scanning becomes more common? What if it is my blood that unlocks my finances & credit?
edit: i've heard thumbs are available for purchase
or a toe. i got bored and tried a toe. it worked. but i'm not putting my feet on my iPhone again.
Necessity is truly the mother of innovation.
For me it was a matter of porn not being as important to me as she was so the porn had to go. Plus for some people, porn does affect their own interactions with their partner negatively (reduces sexual drive, reduced sexual interest in their partner since s/he isn't like what they see in porn, etc.). Some people also view their spouses' watching porn as a sign that the one who doesn't like porn is inadequate - which leads to all sorts of insecurities coming out.
As usual, different strokes for different folks. Whether you _need_ to address it is entirely up to you and what you want from your relationship.
(I do know couples who both were into porn and that didn't cause an issue)
(I saw this come up in a Facebook group a few months ago)
Truthfully, lots of different scannable areas will unlock a phone. I've successfully and reliably configured my toes, the knuckles on my hands, and the tip of my nose. All of them work pretty good.
Unless observed using biometric security in a specific manner, an adversary might have a hard time deducing what kind of print will provide access.
Even if they've determined that the phone contains biometric scans tied to security, how would they know it's yours, and not someone else's, or even a specially printed 3D key ring fob or something?
Then again, criminals don't always think deeply about such details during a crime. They might just chop off both hands, grab the phone, and figure out the rest on the run.
Tongue only slightly in cheek.
With me they'd have to take my index fingers because I've got a phone with the reader on the back of the device (which, imo, is the best place to put it, as far as convenience goes.)
Anecdotal, but I know people who have configured only the index finger to unlock the phone because they prefer it to the thumb.
Yes you can. In fact, it's a lot easier for you to do so involuntarily.
EDIT: And, it should be noted, once it has been "divulged" or otherwise compromised, it's a lot more painful to change your thumbprint than a PIN or other non-biometric password.
It's an interesting topic as we've seen in recent news coverage that authorities can compel the accused to provide a thumbprint to give investigators access. While this may be in accordance to something like password authentication, I'm still concerned about the ramifications. For example, what if authorities compel accused individuals to store their thumbprint rather than use it directly? Is that possible? And how will it be protected?
We had a business problem several years ago where a population of users who didn't need individual access control needed controlled access to a system based on where they were and if they were assigned a specific task.
The solution was an RSA token mapped to a device specific user account. The single auth factor was the rotating code.
The upside of this is that we got to control access to a system potentially available to the public in an environment with high turnover and other operational challenges. The downside is that whomever possessed the token (picture an old style bathroom key tied to a big stick) could access the system.
Your thumb is that token. If you need more identity assurance, you need more factors or a protected secret. iPhone offers the latter. If your opponent is someone with subpoena power, you need to think about what and why you're doing stuff on your phone.
But I've always had trouble with fingerprint readers. At the DMV, govt ID card office (back when I was in the Army), etc. "Place your finger on the scanner. Nope, try again.. press harder. No, harder."
I have no idea what's wrong with my fingers :|
I don't use thumb scanners anymore though as inevitably my finger will change! It definitely isn't for everyone.
Most notable: brick masons. The fingerprints are damaged and smoothed out over the years by acids in the cement and the roughness of the bricks.
I have really moist skin, so I wouldn't be surprised if this was the issue. I had a fingerprint reader on my gen 1 Motorola Atrix and that worked just fine though. I think the company that built that authentication system was purchased by Apple and used in the iPhones. I wonder if his wife would have the same issues with his phone, it might be that his fingerprint scanner is less sensitive.
1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin )"
Unfortunately, your thumb print can be replicated and used. Check out this news story - police actually 3d printed a murder victim's finger to unlock their phone - http://www.theverge.com/2016/7/21/12247370/police-fingerprin...
You divulge your thumb print when you grab ahold of a glass at a restaurant or a door handle in a public space.
Yup, these morons are giving a gym more money and their retinal scan to have private lockers and laundry services. I'm sure they feel James Bond-ish by unlocking a door by staring into the little device on the wall.
No thanks, I'll keep my "regular" membership.
Also before this technology, people kept credit cards in their wallet, which suffered the same fate from house hooligans. And before credit, people did keep $250 in their wallet.
I guess the credit card part is true; around here most people have debit cards with PINs, and which can't be used remotely, so it's unlikely a six-year-old could use it without their parent's consent. Then again, around here those parents would have the legal right to return all those purchases.
Getting robbed turns from "Give me your wallet or I'll shoot/stab you" to "Give me your phone and access or I'll shoot/stab you."
Unlikely given anti-fraud systems.
And ordered physical goods can almost often be returned. Digital purchases canceled. I don't doubt one can come up with a corner case somewhere but major financial transactions do tend to have checks built in.
For instance:
— Maybe you must use two or more particular fingerprints in sequence, selected by you in advance. This would require a “sleep attack” to at least try different combinations of your fingers (without knowing which to use first or how many fingers are required).
— Maybe you have to hold down your thumb in a pattern that you set in advance (e.g. at least 2 seconds on, followed by one second off and one second on).
— Maybe a 3-by-3 grid appears and you have to tap one of the squares that were set in advance by you before using your fingerprint. This is faster than having to enter a whole pass-code but slightly stronger than just tapping a finger.
Of course, each of these trades off time (convenience) for slightly better security.
This is the one feature I've been dying for.
The lock in your bathroom isn't meant to secure the bathroom. It's just a way to ensure that people get the message, "please don't enter".
A fingerprint on a phone is a way of saying the same thing. This phone isn't meant for common use, please don't enter.
A username is an identity. Historically due to the difficulty of verifying identities online, we have used passwords as a way to do so. And when all we need to do is verify an identity or control basic access levels (the bathroom lock!), a fingerprint is absolutely good enough. But a password is more authorization than authentication: requiring a password is appropriate when you need a conscious decision, not mere identification. Such as for paying for Pokémon toys.
So essentially what I'm saying is that I agree with you.
A laser cutter I used to work with had two switches, one of which was a safety switch (like [1]) to prevent accidental activation. The goal here isn't security. It's a design decision to prevent accidents. It's almost a kind of intentional inconvenience.
[1] Safety switch with cap prevent accidental switching: http://acuteelectrical.com.au/safety-switch/
I deal with this in my industry (telecommunications). Just because you've provided proof of identity (eg your phone number, account number), there are still things you're not allowed to do until you've authenticated your identity--and the system determines your authority, to perform an action. This is accomplished through a password, a PIN, etc.
On a phone, it's an interesting shift because with a PIN, we essentially bypassed the need for identity and used only a password; regardless of who you are, you can get in if you have the right key.
With the move to identity being sufficient to unlock a device, we're saying that just on the basis of identity, the authority that used to come with a password (sans identity) can be granted. It's a 180 degree turn.
I don't see a way on my iPhone 6s to require both Touch ID and PIN; it's one or the other. Very few interactions require both, i.e. after a restart it requires the PIN before Touch ID will work.
edit: to clarify the difference
You seem to be suggesting we add extra layers here so that merely authenticating as the device's owner is insufficient authorization to conduct some actions, and re-authenticating as the owner by using something they know (secret token like PIN/password) instead of something they possess (finger) will re-grant authorization, but users find this constant re-auth very annoying.
Most would probably prefer device makers to allow them to trust the people whom they sleep around rather than input another authentication method all the time. Personal responsibility has to enter into the equation somewhere.
My advice to this parent would be to keep their phone and/or body inaccessible while unconscious.
For example, most phone manufacturers think that the owner of a phone should always have permission to perform any action on the phone, so as long as they can authenticate the person holding the phone, they can authorize them to do anything. In this case, authentication => authorization.
Contrast this with OAuth, which it seems most people don't understand well. OAuth is a mechanism for authorizing people other than yourself to perform actions on your behalf, e.g. a third party application to post on your Facebook wall. In this case, authorization !=> authentication.
However, sometimes third-party applications don't care about performing actions on your behalf. They work on the assumption that only the owner of the account could authorize an OAuth token to give back to them, so they use other OAuth providers as authentication, e.g. login via Facebook. So in this case, authorization => authentication.
Another example is accessing secret files at a company. A person might be authorized to view the files but only from a secure device. In this case, authentication is required but not sufficient for authorization. In this case, authentication !=> authorization.
In the case of payment via phone, you need authorization. Authentication can be one factor in the authorization process, but clearly its not sufficient because the authorizing party could be asleep and therefore unaware of the transaction. Phone manufacturers might want to look at risk-based escalation -- requiring more factors for some applications, or as the sum of money increases, or perhaps even based on time of day.
It feels like there's a bit of a spectrum, though. The lock on a houses door won't prevent a determined criminal, but it sends a very strong signal and is inconvenient to break.
Perhaps we should thing of there as being multiple dimensions to locks, such as security, signaling, effort to circumvent, and convenience? (Perhaps also conscientiousness in disabling, in relation to @saosebastiao's point.)
If someone wants into YOUR phone, they'll get it. If someone wants into A phone, a thumbprint may be plenty.
I recall a similar article on gun ownership in homes, and it noted that gun ownership did not protect any specific home, but rather it decreased home robbery rates for a region.
What's up with that? Isn't there a law that limits liability for unauthorized purchases to $50? (And don't most banks and credit cards just make it $0?)
http://www.which.co.uk/consumer-rights/advice/i-want-to-retu...
As for the question of liability, there's usually a proviso for taking legal/criminal action against the perpetrator. Even if the parent wanted to take action against their child, being below the age of criminal responsibility, the parents may be legally responsible in any case.
http://www.reuters.com/article/us-apps-kids-idUSBREA2U0M9201...
Confirming you're the correct person is only half of the equation.
I believe that most biometric readers for security (e.g., offices and such) look for a pulse or other indicator so using a severed body-part would not work. Always annoys me when I see that done in movies.
(One office I worked in had fingerprint access. The bathrooms were outside the secured area, and I soon got into the habit of rubbing my hands together after washing to warm them up, as a cold finger wouldn't read.)
People seem to numb out when they hear this in person. I don't understand why...
For me, with the banking apps on my phone for example, I use my fingerprint to get into my phone and then manually type in the password. Seems like the best combo to me for mobile security. (Not that I'm worried about it, I'm just security minded.)
Or she made it up.....
I have a small child that's been coming up to me with my phone and trying to nonchalantly guide my finger to unlock it since she was 4. She's never done it in my sleep (that I know of), but I don't for a second doubt she'd be able to do it if she was motivated to.
I remember loving the TV as a kid but recall that somehow, magically, my parents kept me off it outside TV hours without use of a password. I need to figure out that secret before its too late!
TL;DR - If kids can't see it, it doesn't exist.
It really does encourage you as a parent to have discipline with not only their screen time but your own as well.
My parents were worried because I spent too much time reading, I've known people who's parents were worried because they spent too much time with music, or painting, or with friends, or playing football, or swimming, etc...
Children find things they like and explore them. Yes, as a parent your job is to get them to try a wider range of things and open them up to other stuff, but it's not 'screens' that are suddenly a new danger.
I'd argue that's relatively rare though - it usually comes down to a lack of better options or a temporary indulgence.
Not saying children can't become hyperfocused on one thing, just that parents tend to claim it's the issue when they aren't giving other options or after what isn't really an excessive amount of time with a thing.
Large teams of adults are exploiting every trick in the book to get them addicted tho'...
She does enjoy playing games as well, but those are timeboxed and she knows better than to try to pull something off like use my thumbprint to get around me telling her no. When she tries to "sneak" a thumbprint to unlock my iPhone, it's because she likes the self-sufficiency of turning on and choosing music herself (or because it's a song[1] I won't play for her anymore in an effort to maintain my sanity). And I really don't mind that self-sufficiency when she's up at the crack of dawn on a Saturday and is trying to be as non-intrusive as possible to let me lay in until a late 7am or so.
Before: "Daddy, give me the tablet! Now!"
After: "Daddy, the tablet's out of batteries, what should we do?" "Oh, let's go outside and play together!
(Similarly for the DailyWTF stories that people often claim can't be real. Well, even if the story you're looking at is made up, it's still happened a dozen times in the last week. Count yourself lucky that you can react in disbelief to these sorts of stories.)
I must admit, however, my first thought wasn't about authentication - but on the wisdom of using phones as babysitters.
(Of course, I should say I have no idea whether this actually happened either, or if my sister just realised she hadn't reminded us she's a mother for 20 minutes. I didn't ask, it's drama I could live without.)
(As an aside... who the hell decided that autoplay video/audio was legit?! Yeah, I'm an old guy... and once upon a time that sort of thing was avoided... but really.)
(Autoplay is the scourge of the internet and sites that autoplay audio or video should be treated the same as, say, sites that use the blink tag)
At least <blink> didn't cause my browser to spontaneously start making noises.
It was? I remember websites showing off their ability to make your browser automatically play background music as early as the late 90's / early 00's.
Professionally, I remember being in design meetings ~'96/'97 where someone would say, "hey, we could...[blast audio/video]" and the more in the know people would down the idea as being bad form [without regard to the bandwidth issues at the time]. That's the attitude I miss.
I don't entirely disagree but really, in the context of a fairly trivial matter for anyone who isn't the person in question, what's the difference?
For example, I found a 20 euro bill on the ground at the ATM the other day. It makes no difference to you whether that's true - it only makes a difference to me and the person that lost the bill. At best it serves as a cautionary tale to those that don't pay attention to their money at the ATM.
If the story is plausible (that is, possible and not unlikely) and isn't particularly exceptional (such as, "click here to find out about obama's secret slave trading circle"), what's the difference?
That is, what is the concrete difference, to you and anyone commenting here, whether that child really did that or not? It's not unlikely enough that it would not occur. And we've seen a lot of very real stories about children stealing credit cards to spend hundreds or thousands on mobile games. And if you don't believe those either I can give you a personal account: When I was a kid I repeatedly broke the parental phone lock to call expensive numbers on the TV.
This is an iteration of the same thing.