Given that the authentication methods are "differently secure," wouldn't it be good if we were offered the option to combine them and require both for unlock? I would love to use Face ID + PIN or Touch ID + PIN for better security.
I want to be able to set touch or PINs for certain apps, so that I can have multi level security. Why is there so much emphasis on one master password/touch ID/face ID instead of having multiple security checks?
- Your username is who you think you are.
- Your second-factor (faceprint, thumbprint, keyfob) is who you claim to be.
- Your password is your proof.
But even with a 4 digit PIN most people didn't have PINs set up on their devices, so increasing friction will not result in more security.
If you want max security now, you can simply turn off TouchID or FaceID and us a very long alpha numeric password.
Would be interesting to see whether username-less public systems suffer fewer intrusions. Some users would record their passwords in unsafe places, but they couldn't reuse a password eliminating password stuffing as an attack surface.
Of course, if you allow password resets you'd still have a kind of "backup" username presuming a person's email address could be used for the reset. But that wouldn't significantly weaken the security, arguably.
How bout: Touch ID + Face ID. Hahaa
I think the only way for Touch ID to come back is for it to cover the whole display, so it can authenticate every touch.
The phone could constantly monitor both Face ID and full-screen Touch ID at the same time, and if it detects anything funky going down it can panic and lock. Would close down attacks where someone grabs your phone off you while it's unlocked and quickly disables security.
Touch ID only works on the first try about half the time for me, I would love to bring that experience to all my interactions with my phone.