Hacker News Reader

Comment by bluGill | Hacker News Reader

it is a different level of security. The comic is fully correct, but you should still use a secret. That is why there are 3 different types of authentication. The first is something you have - a card or key. The second is something you know - a password. The third is something you are - a fingerprint. Each provides protection against a different attack and is vulnerable to different attacks. The more important the secret the more of them you should use.

Note that you quickly get to the point where you need more than one person involved. You can compromise one person as much as you want, but if that person doesn't have the complete secret it doesn't do any good.

View on HN

> The third is something you are - a fingerprint.

A fingerprint isn't “something you are”, because it can be destroyed while you remain, and information about it can be captured and reproduced by attackers who are not you.

It's just a particularly hard to lose (but easy to discover, and impractical to replace if compromised, at least more times than you have fingers) “something you have.” In security factor terms, I'm not convinced the idea of a distinct “something you are” category is coherent, since most candidates seem similar to that.

"Something you are" is a term of art, not a very specific statement of fact to be legally overanalyzed. A fp is very much "something you are".

> "Something you are" is a term of art,

Yes, what I am saying is that in practice what that term of art refers to is not an independent, orthogonal kind of security factor from “have” and “know” but a strictly worse form of “have”.

DNA is something you are.

The reason DNA is useful as criminal evidence is you leave it everywhere; that makes it a horrible security factor: like fingerprints it's an impractical to replace wheb compromised “thing you have” that you leave everywhere for attackers.

That is a very good reason to not use it alone. However when combined with other it provides a good indication that someone was actually there. Either that, or the attacker went through more effort to get the secrets.

Maybe? Although not yet practical, in theory it too can be captured and reproduced.

Calling a fingerprint "something you are" is a stretch. You are leaving fingerprints everywhere, they can be lifted from any smooth surface you touched (or even high-resolution photo) and then used to open biometric locks.

The fingerprint belongs to you. Calling it 'something you are' is conveying this, without claim to it being somehow difficult to clone or entirely unique. Mother's maiden name is similar in this regard.

Reply on news.ycombinator.com