Hacker News Reader

Hacker News

Comment by ballenf | Hacker News Reader

Parent Full thread

ballenf

They are as much a password as the key to your house is a password.

And agree that Troy's description is best as it takes us away from unhelpful metaphors.

View on HN

If you believe your key has been compromised (say duplicated), you can change the lock and your key.

If you believe your fingerprint data has been compromised, can you change your fingerprint data?

>If you believe your fingerprint data has been compromised, can you change your fingerprint data?

Yep. I can use another finger. If all 10 have been compromised you probably have bigger issues.

Or you just turn it off.

In case anyone’s genuinely curious about fingerprint removal, rather boringly the best solution in practice is just to wear gloves. The alternatives are mostly temporary and much more painful than you’d expect, such as branding, abrasion, or chemotherapy drugs such as capecitabine.

Same with SSNs. Try changing yours. And yet, they're used as passwords.

And what's worse is when utility companies require me to "authenticate" over the phone with my name, address & dob: all publicly (to varying degrees) available information.

My pet peeve is an incoming call with authentification demand (name, dob) before we speak. As if I'm going to tell my personal info to random id, no matter is it publicly available or not. At the same time they easily send me sms with private accounting info.

There are many people who get scammed through such calls. I believe it is up to the technology and technology security savvy people to constantly educate others.

Even today when I speak about info security they look like you're wearing a foil hat. Another scam is people knocking into doors to "deliver useful social information" and asking for your ids/signature in the end. It may be marketing info collection or even simply visual wealth evaluation, but sure there are those who believe it's done for good [edit:] intents.

I'm usually let them tell their tale (out of my room, of course), ask a lot of questions, nod with them happily, and in the end I say thanks, but I'm sorry, I don't disclose my info, full stop. Their butthurt is sometimes too cool to watch without popcorn.

I always hoped those tests were more about a human measuring my reaction speed.

If I am who I say I am I should be able to answer all three without much thinking and answer naturally to my name.

What exactly does “fingerprint data has been compromised” mean? Someone lifted my print off a glass?

Lifted it off a glass/phone/anything else you touched. Or it can be "compromised" in the same way your SSN can be compromised through hacking. The millions of people who were exposed in the OPM hack all have records of their fingerprints now floating out on the darkweb somewhere.

It could also be someone lifting it off through software on your phone if you had a device with a terrible implementation for handling fingerprints. See this piece about the HTC One Max from two years ago - the fingerprint was stored as a bitmap image in a "world readable" folder and refreshed with the image from the latest touch!

[1]: http://www.theregister.co.uk/2015/08/10/htc_caught_storing_f...

Someone

1) lifted it off some surface. 2) got the right fingerprint when they did it 3) modeled a fake fingerprint well enough that it would fool touchID 4) Was able to get access to your touchID device while you weren't aware or unable to stop them

Most experts recommend that you instead use a pin-code of at least 6 numbers, or a password of at least 12 random characters using at least one number, and at one punctuation mark. In that case the attacker's algorithm changes to

1) Check for posted note containing password on computer monitor, or 2) Check purse or wallet for posted note containing passcode

A badly-written program that stores the fingerprint data in a reversible/plaintext manner. Once their database gets pwned (and/or is left wide open on the cloud) your biometrics can be reconstructed and used to authenticate as you.

As far as your phone is concerned, yes. Nine times, for most people.

Believe it or not it's actually nineteen times, not nine. Though the last ten introduce a fair amount of inconvenience and eww-factor when unlocking your phone.

I don't know about Apple phones, but I had luck getting my phone to unlock by using my chin. It wasn't really reliable (stopped working after a few hours, probably because of the beard growing), but I'm sure we can figure something out.

Being male, I actually have 21 digits, if you can stomach more inconvenience and eww-factor when unlocking a phone.

I tried using TouchID with my toes and it didn't really work.

> Nine times, for most people.

It's not too difficult to get access to the full 50000-odd combinations (see https://support.apple.com/en-us/HT204587 for where that number comes from) Apple hardware can identify with a little work.

https://www.theguardian.com/technology/2014/dec/30/hacker-fa...

You can only try a few before the phone locks itself, I believe.

The idea was to be able to use more than your own 10 fingers for locking/unlocking as the owner. Not to brute-force TouchID as a thief.

This is irrelevant, because if you believe that you're at risk from your fingerprint data being compromised, you can always fall back to not using biometrics at all. They aren't your primary authentication mechanism.

Whether you can fallback to not using biometrics is irrelevant to whether biometrics is equivalent to usernames or passwords. In fact, your point that one can fallback to not using biometrics once it is compromised proves that biometrics is not equivalent to passwords.

At no point have I argued that biometrics are equivalent to passwords. But to conclude that biometrics must be equivalent to usernames because of that fact would be a false dichotomy. Biometrics serve an auxiliary role in security as an optional, subservient supplement to passwords.

If you never use your password do you then expect to remember it?

Yes. If you read about how biometrics are implemented on handsets, a user is required to enter their password every time that the device is rebooted. The password is also required at random intervals, once every few days or so. And if the biometric scanners log a handful of failed accesses, the handset is locked and a password is again required to enter.

The trend is we are going to see more use of biometrics to authenticate.

I don't leave an impression of my keys on everything that I touch.

If your fingerprint scanner is based on simple ridge profiles, then it's shouldn't be used for security. For example, some recent Apple keynotes claim they now use sub-dermal features for identification.

Implementation matters more than what the sensor is authing with.

What if we did something like a mix of password + finger print, by using multiple fingers in a pattern?

Like, say, middle - index - ring.

It would be doubly unique.

It would be more unique but it would take away the convenience of having your phone unlocked nearly instantly with your finger. If you're going by security, a password plus fingerprint would be most secure but inconvenient.

No. A key to your house can be easily changed. You can not change your biometrics without surgery, and even then, you still often can't really change them.

biometrics make poor passwords.

Biometrics aren't passwords. They are unique identifiers and they make the best, most secure access control identifiers there are.

Because security that people use is >> security people won't use

Right. Unique identifiers == usernames, NOT passwords.

You can't change them, therefor they make poor secrets.

Reply on news.ycombinator.com