Hacker News Reader

Comment by paulannesley | Hacker News Reader

Fingerprints are not passwords, but I don't think it's useful to think of them as usernames either.

This is a much more pragmatic take on it by Troy Hunt, the person behind “Have I been pwned?”: https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pra...

> The first point I'll make here as I begin talking about the 3 main security constructs available is that they're all differently secure.

View on HN

They are as much a password as the key to your house is a password.

And agree that Troy's description is best as it takes us away from unhelpful metaphors.

If you believe your key has been compromised (say duplicated), you can change the lock and your key.

If you believe your fingerprint data has been compromised, can you change your fingerprint data?

>If you believe your fingerprint data has been compromised, can you change your fingerprint data?

Yep. I can use another finger. If all 10 have been compromised you probably have bigger issues.

Or you just turn it off.

In case anyone’s genuinely curious about fingerprint removal, rather boringly the best solution in practice is just to wear gloves. The alternatives are mostly temporary and much more painful than you’d expect, such as branding, abrasion, or chemotherapy drugs such as capecitabine.

Same with SSNs. Try changing yours. And yet, they're used as passwords.

And what's worse is when utility companies require me to "authenticate" over the phone with my name, address & dob: all publicly (to varying degrees) available information.

My pet peeve is an incoming call with authentification demand (name, dob) before we speak. As if I'm going to tell my personal info to random id, no matter is it publicly available or not. At the same time they easily send me sms with private accounting info.

There are many people who get scammed through such calls. I believe it is up to the technology and technology security savvy people to constantly educate others.

Even today when I speak about info security they look like you're wearing a foil hat. Another scam is people knocking into doors to "deliver useful social information" and asking for your ids/signature in the end. It may be marketing info collection or even simply visual wealth evaluation, but sure there are those who believe it's done for good [edit:] intents.

I'm usually let them tell their tale (out of my room, of course), ask a lot of questions, nod with them happily, and in the end I say thanks, but I'm sorry, I don't disclose my info, full stop. Their butthurt is sometimes too cool to watch without popcorn.

I always hoped those tests were more about a human measuring my reaction speed.

If I am who I say I am I should be able to answer all three without much thinking and answer naturally to my name.

What exactly does “fingerprint data has been compromised” mean? Someone lifted my print off a glass?

Lifted it off a glass/phone/anything else you touched. Or it can be "compromised" in the same way your SSN can be compromised through hacking. The millions of people who were exposed in the OPM hack all have records of their fingerprints now floating out on the darkweb somewhere.

It could also be someone lifting it off through software on your phone if you had a device with a terrible implementation for handling fingerprints. See this piece about the HTC One Max from two years ago - the fingerprint was stored as a bitmap image in a "world readable" folder and refreshed with the image from the latest touch!

[1]: http://www.theregister.co.uk/2015/08/10/htc_caught_storing_f...

Someone

1) lifted it off some surface. 2) got the right fingerprint when they did it 3) modeled a fake fingerprint well enough that it would fool touchID 4) Was able to get access to your touchID device while you weren't aware or unable to stop them

Most experts recommend that you instead use a pin-code of at least 6 numbers, or a password of at least 12 random characters using at least one number, and at one punctuation mark. In that case the attacker's algorithm changes to

1) Check for posted note containing password on computer monitor, or 2) Check purse or wallet for posted note containing passcode

A badly-written program that stores the fingerprint data in a reversible/plaintext manner. Once their database gets pwned (and/or is left wide open on the cloud) your biometrics can be reconstructed and used to authenticate as you.

As far as your phone is concerned, yes. Nine times, for most people.

Believe it or not it's actually nineteen times, not nine. Though the last ten introduce a fair amount of inconvenience and eww-factor when unlocking your phone.

I don't know about Apple phones, but I had luck getting my phone to unlock by using my chin. It wasn't really reliable (stopped working after a few hours, probably because of the beard growing), but I'm sure we can figure something out.

Being male, I actually have 21 digits, if you can stomach more inconvenience and eww-factor when unlocking a phone.

I tried using TouchID with my toes and it didn't really work.

> Nine times, for most people.

It's not too difficult to get access to the full 50000-odd combinations (see https://support.apple.com/en-us/HT204587 for where that number comes from) Apple hardware can identify with a little work.

https://www.theguardian.com/technology/2014/dec/30/hacker-fa...

You can only try a few before the phone locks itself, I believe.

The idea was to be able to use more than your own 10 fingers for locking/unlocking as the owner. Not to brute-force TouchID as a thief.

This is irrelevant, because if you believe that you're at risk from your fingerprint data being compromised, you can always fall back to not using biometrics at all. They aren't your primary authentication mechanism.

Whether you can fallback to not using biometrics is irrelevant to whether biometrics is equivalent to usernames or passwords. In fact, your point that one can fallback to not using biometrics once it is compromised proves that biometrics is not equivalent to passwords.

At no point have I argued that biometrics are equivalent to passwords. But to conclude that biometrics must be equivalent to usernames because of that fact would be a false dichotomy. Biometrics serve an auxiliary role in security as an optional, subservient supplement to passwords.

If you never use your password do you then expect to remember it?

Yes. If you read about how biometrics are implemented on handsets, a user is required to enter their password every time that the device is rebooted. The password is also required at random intervals, once every few days or so. And if the biometric scanners log a handful of failed accesses, the handset is locked and a password is again required to enter.

The trend is we are going to see more use of biometrics to authenticate.

I don't leave an impression of my keys on everything that I touch.

If your fingerprint scanner is based on simple ridge profiles, then it's shouldn't be used for security. For example, some recent Apple keynotes claim they now use sub-dermal features for identification.

Implementation matters more than what the sensor is authing with.

What if we did something like a mix of password + finger print, by using multiple fingers in a pattern?

Like, say, middle - index - ring.

It would be doubly unique.

It would be more unique but it would take away the convenience of having your phone unlocked nearly instantly with your finger. If you're going by security, a password plus fingerprint would be most secure but inconvenient.

No. A key to your house can be easily changed. You can not change your biometrics without surgery, and even then, you still often can't really change them.

biometrics make poor passwords.

Biometrics aren't passwords. They are unique identifiers and they make the best, most secure access control identifiers there are.

Because security that people use is >> security people won't use

Right. Unique identifiers == usernames, NOT passwords.

You can't change them, therefor they make poor secrets.

Fingerprints are better passwords than no password.

And the hassle of entering even a 4 digit numeric PIN was what Apple was trying to overcome.

Too many people were leaving their phones completely unlocked all the time.

It's irrational, but I'm not going to use a security measure that increases the likelihood a malicious actor removes my finger.

1. Then you have the option not to use it, and always will (biometrics are used to augment passwords, not replace them).

2. Using passwords as a security measure increases the likelihood that a malicious actor will beat them out of you with a five-dollar wrench (and this does not mean that passwords are a bad idea).

If a malicious actor will cut off your finger, he'll also put a gun to your head and demand the password... which you will no doubt give him.

And it's much easier to point a gun and demand the password.

The psychological detachment required to cut off a finger significantly lowers the number of criminals that will unlock your phone against your will.

Seriously the amount of fingers cutted since the introduction of iPhone 5s amount certainly to zero or we would have heard the information buzzing around on all cheap news networks almost immediately.

So I'm pretty confident now that this argument is moot by now.

Yet we still don't have enough mileage to determine if face peeling will be a more likely issue with iPhoneX. But I could bet that "face offing" relatively is not more likely than finger cutting...

But it certainly was the reason why Mercedes stopped using thumbprints for cars in Asia. The thiefs just cut off the finger.

Sources for that?

The iPhone has a liveness test as part of its biometric.

I wonder if the finger cutter knows that...

If someone is willing to cut off your finger to access your device, that means they have access to you and the device and the means to convince you to unlock it.

Cutting off someones finger to access their phone is like using high explosives to blow up a door you can easily kick open. Criminals actually don't want to get caught.

Maybe the first one won't, but the next time they most definitely will. Stealing a phone is one thing, cutting someone's finger is another risk-wise. So if you have to dramatically increase the potential penalty for getting caught, you'll make sure it actually works before doing it repeatedly, and this kind of info is shared among thugs

I have some important stuff on my phone, but not important enough to give up a finger.

When the bolt cutters come out they are in. Sue me.

  username   • password 
  public     • private 
  detachable • non-detachable 
  unique     • arbitrary

A name has to be unique. But it can simultaneously be used as a password if it is impossible to detach (copy) it and associate with another thing. One way to do it is to simply hide it like private keys and normal passwords but in this case it cannot be used as a name. An alternative approach is to make it difficult to copy/reproduce (similar to normal car or house keys). In the case of fingerprints, they can well be used as a password (in addition to its role as a name) until it is impossible to create artificial fingers and attach them to other persons.

Fingerprints are not private though, so they fail your very first criterium of passwords. Fingerprints are also not arbitrary[1], it is possible to combine two (or more) fingerprints resulting in a new "fingerprint" in its own right, as well as being a fingerprint that is similar enough to the two (or more) original fingerprint to have a high chance of fooling most sensors on smart phones for all fingerprints involved. Also, uniqueness vs. arbitrariness smells like a false dichotomy to me. Something can be both arbitrary and unique (see for example uuids).

[1] - https://www.nytimes.com/2017/04/10/technology/fingerprint-se...

Only 1% of Dropbox users have two-factor auth enabled. But probably only 10% of Dropbox users care about the security of their files. I don't.

Reply on news.ycombinator.com